Week 30, 2019
22–28 July 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 10.0
CVE-2019-11708 Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process op…EPSS 56%
Mozilla · Firefox · Thunderbird · Firefox ESR
- Critical 9.8 EPSS 17%
- Critical 9.1 EPSS 5%
-
Critical 9.0
CVE-2019-12328 A command injection (missing input validation) issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware …EPSS 4.2%
- Critical 9.8 EPSS 3.5%
- Critical 9.8 EPSS 3.1%
- Critical 9.8 EPSS 3.1%
- Critical 9.8 EPSS 3%
- Critical 9.8 EPSS 2.6%
- Critical 9.8 EPSS 1.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.3 EPSS 95%
-
Unscored
CVE-2019-10267 An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the…EPSS 75%
-
Unscored
CVE-2019-14241 HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c.EPSS 70%
- High 7.5 EPSS 56%
-
High 8.8
CVE-2019-11707 A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware…EPSS 38%
Mozilla · Firefox · Thunderbird · Firefox ESR
-
Unscored
CVE-2019-11730 A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directo…EPSS 20%
Mozilla · Firefox · Thunderbird · Firefox ESR
-
Unscored
CVE-2019-10266 An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file struc…EPSS 13%
-
Unscored
CVE-2019-11703 A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a pot…EPSS 11%
Advisories
- SUSE / openSUSE Security Updates 282 critical
- Ubuntu Security Notices (USN) 13
- Debian Security (DSA / DLA) 11
- BSI CERT-Bund (WID) 6
- Oracle Linux Security Advisories (ELSA) 3
- CISA ICS & IT advisories 2
- SUSE-SU-2019:1973-1 Security update for rmt-server 2 CVEs
- SUSE-SU-2019:1955-1 Security update for bzip2 2 CVEs