Week 31, 2019
29 July – 4 August 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 19%
- Critical 9.8 EPSS 8%
-
Critical 9.1
CVE-2019-14418 An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a…EPSS 4.1%
-
Critical 9.8
CVE-2019-14431 In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and…EPSS 3.7%
- Critical 9.8 EPSS 1.6%
- Critical 9.8 EPSS 1.5%
-
Critical 9.0
CVE-2019-1020011 SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.EPSS 1.3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.2 EPSS 84%
-
Unscored
CVE-2019-13635 The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.EPSS 44%
- Unscored EPSS 28%
-
Unscored
CVE-2019-3948 The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX86…EPSS 25%
-
Unscored
CVE-2019-1117 A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This…EPSS 24%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
Unscored
CVE-2019-1118 A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This…EPSS 24%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
Unscored
CVE-2019-1127 A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This…EPSS 21%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
Unscored
CVE-2019-1119 A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This…EPSS 19%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows 10 Version 1903 for ARM64-based Systems · Windows 10 Version 1903 for 32-bit Systems
Advisories
- Oracle Linux Security Advisories (ELSA) 534 critical
- SUSE / openSUSE Security Updates 374 critical
- Ubuntu Security Notices (USN) 111 critical
- Debian Security (DSA / DLA) 9
- CISA ICS & IT advisories 83 critical
- BSI CERT-Bund (WID) 6
- AlmaLinux Security Advisories 5
- Rocky Linux Security Advisories 1
- Schneider Electric CPCERT 1
- ELSA-2019-1269 Critical: firefox security update (Oracle Linux 8) 13 CVEs
- ICSA-19-211-01 Wind River VxWorks (Update A) 11 CVEs
- ELSA-2019-0966 Critical: firefox security update (Oracle Linux 8) 10 CVEs
- ICSA-19-211-02 Prima Systems FlexAir 9 CVEs
- ELSA-2019-1764 Critical: firefox security update (Oracle Linux 8) 8 CVEs
- USN-4084-1 python-django vulnerabilities 4 CVEs
- openSUSE-SU-2019:1824-1 Security update for rmt-server 2 CVEs
- ICSA-19-213-03 3S-Smart Software Solutions GmbH CODESYS V3 2 CVEs
- ELSA-2019-1696 Critical: firefox security update (Oracle Linux 8) 2 CVEs
- SUSE-SU-2019:2013-1 Security update for bzip2 1 CVEs