Week 16, 2019
15–21 April 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 9.5%
-
Critical 10.0
CVE-2019-4202 IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on…EPSS 4.2%
-
Critical 9.8
CVE-2019-1710 Cisco IOS XR 64-Bit Software for Cisco ASR 9000 Series Aggregation Services Routers Network Isolation VulnerabilityEPSS 2.8%
- Critical 9.8 EPSS 2.5%
- Critical 9.9 EPSS 2.3%
- Critical 9.8 EPSS 1.3%
- Critical 9.8 EPSS 1.3%
- Critical 9.3
- Critical 9.3
- Critical 9.3
- Critical 9.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.1 EPSS 100%
-
High 8.8
CVE-2019-3398 Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attach…EPSS 97%
- Medium 6.1 EPSS 87%
-
Unscored
CVE-2019-11354 The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to e…EPSS 23%
-
High 7.1
CVE-2019-3719 Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access lay…EPSS 16%
-
Unscored
CVE-2019-11395 A buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long string, as demonstrated by SMTP RCPT TO, POP3 USER, POP3 LIS…EPSS 15%
-
Unscored
CVE-2019-11415 An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. A malformed login request allows remote attackers to cause a denial of service (reboot), as demon…EPSS 14%
-
Unscored
CVE-2019-11374 74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.EPSS 9.9%
Advisories
- SUSE / openSUSE Security Updates 332 critical
- Debian Security (DSA / DLA) 61 critical
- BSI CERT-Bund (WID) 5
- Ubuntu Security Notices (USN) 51 critical
- Oracle Linux Security Advisories (ELSA) 4
- CISA ICS & IT advisories 31 critical
- SUSE-SU-2019:0972-1 Security update for python 2 CVEs
- SUSE-SU-2019:14018-1 Security update for python 2 CVEs
- ICSA-19-106-02 WAGO Series 750-88x and 750-87x 1 CVEs
- USN-3947-1 libxslt vulnerability 1 CVEs
- DLA-1756-1 libxslt - security update 1 CVEs