Week 29, 2019
15–21 July 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-12989 Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.EPSS 95%
- Critical 9.8 EPSS 5.9%
- Critical 9.1 EPSS 5.3%
- Critical 9.8 EPSS 4%
- Critical 9.8 EPSS 1.9%
- Critical 9.8 EPSS 1.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-12725 Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP paramet…EPSS 90%
-
High 8.8
CVE-2019-12991 Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).EPSS 74%
-
Unscored
CVE-2019-0887 A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attacker abuses clipboard…EPSS 71%
-
Unscored
CVE-2019-14205 A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via th…EPSS 63%
-
Unscored
CVE-2019-12815 An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a …EPSS 57%
-
High 8.8
CVE-2019-1068 A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Re…EPSS 57%
Microsoft · Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) · Microsoft SQL Server · Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)
-
High 7.8
CVE-2019-13272 In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relati…EPSS 52%
-
Unscored
CVE-2019-0785 A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP failover server, aka 'Wi…EPSS 50%
Microsoft · Windows Server, version 1903 (Server Core installation) · Windows Server
Advisories
- SUSE / openSUSE Security Updates 626 critical
- Ubuntu Security Notices (USN) 13
- Debian Security (DSA / DLA) 11
- Amazon Linux Security Center (ALAS) 82 critical
- BSI CERT-Bund (WID) 3
- Oracle Linux Security Advisories (ELSA) 2
- CISA ICS & IT advisories 1
- openSUSE-SU-2019:1771-1 Security update for ruby-bundled-gems-rpmhelper, ruby2.5 21 CVEs
- SUSE-SU-2019:14124-1 Security update for MozillaFirefox 12 CVEs
- ALAS2-2019-1251 Critical: dnsmasq security update (Amazon Linux 2) 6 CVEs
- ALAS2-2019-1250 Critical: thunderbird security update (Amazon Linux 2) 6 CVEs
- SUSE-SU-2019:1862-1 Security update for ardana and crowbar 5 CVEs
- SUSE-SU-2019:14122-1 Security update for bzip2 2 CVEs
- openSUSE-SU-2019:1781-1 Security update for bzip2 1 CVEs
- SUSE-SU-2019:1846-1 Security update for bzip2 1 CVEs