Week 21, 2019
20–26 May 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2018-7841 A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of char…EPSS 72%
- Critical 9.8 EPSS 8.1%
- Critical 9.8 EPSS 1.9%
- Critical 9.8 EPSS 1.9%
- Critical 9.8 EPSS 1.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-12314 Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/Maco…EPSS 84%
-
Unscored
CVE-2019-11231 An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content…EPSS 70%
-
Unscored
CVE-2019-7816 ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerability. Successful explo…EPSS 68%
-
Unscored
CVE-2019-8442 The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version …EPSS 60%
-
Unscored
CVE-2019-7111 Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier ha…EPSS 56%
-
Unscored
CVE-2019-3403 The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 a…EPSS 54%
-
Unscored
CVE-2019-7089 Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier ha…EPSS 45%
-
Unscored
CVE-2019-6814 A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiali…EPSS 37%
Advisories
- SUSE / openSUSE Security Updates 332 critical
- Debian Security (DSA / DLA) 173 critical
- Ubuntu Security Notices (USN) 91 critical
- BSI CERT-Bund (WID) 5
- Oracle Linux Security Advisories (ELSA) 31 critical
- CISA ICS & IT advisories 2
- CERT@VDE 11 critical
- ELSA-2019-1265 Critical: firefox security update (Oracle Linux 7) 13 CVEs
- DSA-4452-1 jackson-databind - security update 11 CVEs
- DLA-1796-1 jruby - security update 10 CVEs
- USN-3990-1 python-urllib3 vulnerabilities 3 CVEs
- VDE-2019-010 Miele: Multiple Vulnerabilities in XGW 3000 ZigBee Gateway 2 CVEs
- DLA-1797-1 drupal7 - security update 2 CVEs
- openSUSE-SU-2019:1433-1 Security update for libxslt 1 CVEs
- openSUSE-SU-2019:1428-1 Security update for libxslt 1 CVEs