Week 23, 2019

3–9 June 2019

New CVEs: 435
Critical: 17
High: 56
Newly exploited: 0
Advisories: 65
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.1
CVE-2018-13379 An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and Fo…
Fortinet · Fortinet FortiOS, FortiProxy

EPSS 100%
Critical 9.0
CVE-2019-10149 A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead t…
Exim · Exim

EPSS 100%
Critical 9.8
CVE-2019-11580 Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or au…
Atlassian · Crowd

EPSS 95%
Critical 9.1
CVE-2018-13382 An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1…
Fortinet · Fortinet FortiOS, FortiProxy

EPSS 82%
Critical 9.1
CVE-2017-14854 A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution. The vulnerability affects all versions prior to…
EPSS 7.4%
Critical 9.8
CVE-2017-14728 An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this expl…
EPSS 6.4%
Critical 10.0
CVE-2019-6742 This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to 1.4.20.2. Authentication is not …
Samsung · Galaxy S9

EPSS 5.9%
Critical 9.8
CVE-2019-10160 A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and…
Python · python

EPSS 5.2%
Critical 9.8
CVE-2017-14851 A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25. The vulnerability is in the login page, where the authentication valid…
EPSS 4.1%
Critical 9.8
CVE-2019-11768 phpMyAdmin SQL injection in Designer feature
EPSS 3.5%
Critical 9.6
CVE-2019-6740 This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SM…
Samsung · Galaxy S9

EPSS 3.3%
Critical 9.0
CVE-2019-12739 lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filenam…
EPSS 2.5%
Critical 9.8
CVE-2018-19800 aubio Buffer Overflow vulnerability
EPSS 2.2%
Critical 9.1
CVE-2019-3723 Web Parameter Tampering Vulnerability
DELL EMC · OpenManage Server Administrator

EPSS 1.8%
Critical 9.3
CVE-2019-12243 Istio may not check inbound TCP connections against istio-policy
EPSS 1.2%

All 17 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

VDE-2019-009 PHOENIX CONTACT: Multiple Vulnerabilities in AXC F 2152 46 CVEs
ICSA-19-155-01 PHOENIX CONTACT PLCNext AXC F 2152 46 CVEs
ICSA-19-157-01 Optergy Proton Enterprise Building Management System 7 CVEs
openSUSE-SU-2019:1527-1 Security update for rmt-server 2 CVEs
SUSE-SU-2019:1439-1 Security update for python 2 CVEs
openSUSE-SU-2019:1524-1 Security update exim 1 CVEs
USN-4010-1 exim4 vulnerability 1 CVEs
DSA-4456-1 exim4 - security update 1 CVEs
VDE-2019-012 TECSON/GOK: Improper Authentication and Access Control on multiple devices 1 CVEs
openSUSE-SU-2019:1495-1 Recommended update for sles12sp3-docker-image, sles12sp4-image, system-user-root 1 CVEs