Week 24, 2019
10–16 June 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2010-5330 On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demo…EPSS 40%
- Critical 9.8 EPSS 3%
-
Critical 9.8
CVE-2019-3412 All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by command execution vulnerability. Due to some interfaces do not adequately verify parameters…EPSS 2.9%
-
Critical 9.0
CVE-2019-3409 All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadequate parameter veri…EPSS 1.9%
- Critical 9.8 EPSS 1.4%
- Critical 10.0
- Critical
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-12840 In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to upda…EPSS 78%
-
Unscored
CVE-2019-12780 The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST reque…EPSS 71%
- Medium 6.5 EPSS 54%
-
Medium 4.7
CVE-2019-1009 Windows GDI Information Disclosure VulnerabilityEPSS 48%
Microsoft · Windows Server 2008 R2 Service Pack 1 · Windows Server 2008 R2 Service Pack 1 (Server Core installation) · Windows Server 2008 Service Pack 2
-
Unscored
CVE-2018-20841 HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082 allow remote command execution via shell metacharacters in the mac parame…EPSS 48%
-
Medium 5.3
CVE-2019-1040 Windows NTLM Tampering VulnerabilityEPSS 48%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Unscored
CVE-2019-9879 The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. Thi…EPSS 46%
-
Unscored
CVE-2019-7839 ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability. Successful exploitation coul…EPSS 44%
Advisories
- SUSE / openSUSE Security Updates 27
- Debian Security (DSA / DLA) 131 critical
- Ubuntu Security Notices (USN) 8
- CISA ICS & IT advisories 72 critical
- Amazon Linux Security Center (ALAS) 62 critical
- BSI CERT-Bund (WID) 3
- CERT@VDE 11 critical
- Oracle Linux Security Advisories (ELSA) 1
- Microsoft Security Response Center 1
- VDE-2019-013 WAGO: Multiple Vulnerabilities in industrial managed switches 19 CVEs
- ALAS2-2019-1229 Critical: thunderbird security update (Amazon Linux 2) 12 CVEs
- DSA-4460-1 mediawiki - security update 10 CVEs
- ALAS2-2019-1222 Critical: kernel security update (Amazon Linux 2) 3 CVEs
- ICSMA-19-164-01 BD Alaris Gateway Workstation 2 CVEs
- ICSA-19-164-02 WAGO Industrial Managed Switches 852-303, 852-1305, and 852-1505 2 CVEs