Week 18, 2019
29 April – 5 May 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-3929 The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmwar…EPSS 99%
Crestron · Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.
-
Critical 9.8
CVE-2017-18368 The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System …EPSS 95%
-
Critical 9.8
CVE-2019-1804 Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Default SSH Key VulnerabilityEPSS 3.5%
Cisco · Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode 11.0.1b
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.5 EPSS 92%
-
High 7.5
CVE-2019-9621 Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via th…EPSS 81%
-
Unscored
CVE-2017-18369 The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which i…EPSS 68%
-
Unscored
CVE-2018-12404 A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chos…EPSS 44%
-
Unscored
CVE-2018-20824 The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vul…EPSS 38%
-
Unscored
CVE-2019-3932 Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to authentication bypass due to a hard-coded password in return.tgi. A re…EPSS 36%
-
Unscored
CVE-2017-18370 The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding functio…EPSS 24%
-
Unscored
CVE-2017-18371 The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service a…EPSS 23%
Advisories
- SUSE / openSUSE Security Updates 31
- Debian Security (DSA / DLA) 8
- Ubuntu Security Notices (USN) 8
- CISA ICS & IT advisories 52 critical
- BSI CERT-Bund (WID) 4
- Amazon Linux Security Center (ALAS) 3
- ICSA-19-122-03 Sierra Wireless AirLink ALEOS (Update B) 6 CVEs
- ICSA-19-122-01 Orpak SiteOmat 6 CVEs