Week 19, 2019
6–12 May 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.9
CVE-2019-11510 In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a speci…EPSS 100%
- Critical 10.0 EPSS 30%
-
Critical 9.8
CVE-2019-5021 Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a …EPSS 6.3%
- Critical 9.8 EPSS 5.4%
- Critical 9.8 EPSS 2.7%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 6.5 EPSS 85%
-
Unscored
CVE-2019-5434 An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "opena…EPSS 57%
-
Unscored
CVE-2019-8387 MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.EPSS 56%
-
Unscored
CVE-2019-7442 An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read…EPSS 40%
-
High 8.8
CVE-2018-4063 An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP r…EPSS 27%
-
Unscored
CVE-2018-4072 An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Th…EPSS 26%
-
Unscored
CVE-2018-4073 An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Th…EPSS 26%
-
Unscored
CVE-2018-4061 An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially craf…EPSS 19%
Advisories
- SUSE / openSUSE Security Updates 313 critical
- Debian Security (DSA / DLA) 132 critical
- Ubuntu Security Notices (USN) 7
- BSI CERT-Bund (WID) 7
- AlmaLinux Security Advisories 6
- Oracle Linux Security Advisories (ELSA) 4
- Rocky Linux Security Advisories 3
- Amazon Linux Security Center (ALAS) 1
- DSA-4441-1 symfony - security update 8 CVEs
- DLA-1778-1 symfony - security update 4 CVEs
- SUSE-SU-2019:1214-1 Security update for jakarta-commons-fileupload 1 CVEs
- SUSE-SU-2019:14044-1 Security update for jakarta-commons-fileupload 1 CVEs
- SUSE-SU-2019:1212-1 Security update for jakarta-commons-fileupload 1 CVEs