Week 22, 2019
27 May – 2 June 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-9670 mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Au…EPSS 100%
-
Critical 9.8
CVE-2019-9874 Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unau…EPSS 84%
- Critical 9.8 EPSS 2%
-
Critical 9.9
CVE-2019-10328 Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader PluginEPSS 1.9%
- Critical 9.8 EPSS 1.5%
- Critical 9.3
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-10123 SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute…EPSS 66%
-
Unscored
CVE-2019-12347 In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php acti…EPSS 59%
- Medium 6.1 EPSS 58%
-
High 7.8
CVE-2019-5436 A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.EPSS 50%
-
Unscored
CVE-2019-8457 SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.EPSS 45%
-
Unscored
CVE-2019-12480 BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, Atom…EPSS 34%
-
Medium 4.3
CVE-2018-13383 A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and …EPSS 31%
-
High 8.8
CVE-2019-9875 Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a seria…EPSS 25%
Advisories
- SUSE / openSUSE Security Updates 362 critical
- Ubuntu Security Notices (USN) 14
- Debian Security (DSA / DLA) 9
- Amazon Linux Security Center (ALAS) 6
- BSI CERT-Bund (WID) 4
- Oracle Linux Security Advisories (ELSA) 2
- CISA ICS & IT advisories 2
- CERT@VDE 11 critical
- VDE-2019-011 Pepperl+Fuchs: Remote code execution vulnerability in HMI devices 3 CVEs
- SUSE-SU-2019:1381-1 Security update for rmt-server 2 CVEs
- SUSE-SU-2019:1368-1 Recommended update for sles12sp3-docker-image, sles12sp4-image, system-user-root 1 CVEs