Week 27, 2019
1–7 July 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 97%
- Critical 9.8 EPSS 27%
-
Critical 9.8
CVE-2019-4087 IBM Spectrum Protect Servers 7.1 and 8.1 and Storage Agents are vulnerable to a stack-based buffer overflow, caused by improper bounds checking by servers and …EPSS 7%
- Critical 9.8 EPSS 1.6%
- Critical 9.8 EPSS 1.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-7276 Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.EPSS 93%
-
Unscored
CVE-2019-13372 /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via…EPSS 82%
- Unscored EPSS 82%
- High 7.5 EPSS 76%
-
Unscored
CVE-2019-13345 The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.EPSS 74%
-
Unscored
CVE-2017-8229 Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420…EPSS 74%
- High 7.5 EPSS 74%
- Unscored EPSS 70%
Advisories
- SUSE / openSUSE Security Updates 332 critical
- Debian Security (DSA / DLA) 101 critical
- Ubuntu Security Notices (USN) 61 critical
- BSI CERT-Bund (WID) 4
- Oracle Linux Security Advisories (ELSA) 3
- CISA ICS & IT advisories 2
- openSUSE-SU-2019:1689-1 Security update for phpMyAdmin 2 CVEs
- USN-4045-1 thunderbird vulnerabilities 2 CVEs
- SUSE-SU-2019:1221-2 Security update for libxslt 1 CVEs
- DSA-4474-1 firefox-esr - security update 1 CVEs