Week 28, 2019
8–14 July 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 5.7%
- Critical 9.8 EPSS 4.4%
-
Critical 9.8
CVE-2017-12652 libpng before 1.6.32 does not properly check the length of chunks against the user limit.EPSS 4.1%
- Critical 9.8 EPSS 3.3%
-
Critical 9.8
CVE-2019-13354 strong_password Ruby gem malicious version causing Remote Code Execution vulnerabilityEPSS 3.3%
-
Critical 9.9
CVE-2019-13478 The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.EPSS 3.3%
- Critical 9.1 EPSS 2.2%
- Critical 9.8 EPSS 1.5%
- Critical 9.3 EPSS 1.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-13396 FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POS…EPSS 63%
-
Unscored
CVE-2019-12527 An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decod…EPSS 50%
-
Unscored
CVE-2019-13132 In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a …EPSS 42%
-
Unscored
CVE-2018-19571 GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks.EPSS 32%
-
High 7.2
CVE-2019-10192 A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By c…EPSS 26%
-
Unscored
CVE-2019-12525 An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Au…EPSS 24%
-
High 7.2
CVE-2019-10193 A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By …EPSS 23%
-
Unscored
CVE-2019-13597 _s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts via Sahi Launcher. Also, one can create a…EPSS 14%
Advisories
- SUSE / openSUSE Security Updates 381 critical
- CISA ICS & IT advisories 142 critical
- Debian Security (DSA / DLA) 121 critical
- Ubuntu Security Notices (USN) 10
- BSI CERT-Bund (WID) 6
- Oracle Linux Security Advisories (ELSA) 41 critical
- SUSE-SU-2019:1804-1 Security update for ruby-bundled-gems-rpmhelper, ruby2.5 21 CVEs
- ELSA-2019-1763 Critical: firefox security update (Oracle Linux 7) 8 CVEs
- ICSA-19-192-07 Schneider Electric Floating License Manager 4 CVEs
- ICSA-19-192-05 AVEVA Vijeo Citect and Citect SCADA Floating License Manager 4 CVEs
- DLA-1852-1 python3.4 - security update 1 CVEs