Week 32, 2019
5–11 August 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-11581 There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker…EPSS 85%
- Critical 9.8 EPSS 48%
- Critical 9.8 EPSS 26%
- Critical 9.1 EPSS 17%
- Critical 9.8 EPSS 6.1%
- Critical 9.8 EPSS 2.3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-12257 Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/AC…EPSS 84%
-
Unscored
CVE-2019-12255 Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an i…EPSS 75%
-
Unscored
CVE-2019-13101 An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to discl…EPSS 67%
-
Unscored
CVE-2019-12265 Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Informa…EPSS 60%
-
Unscored
CVE-2019-12256 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 pac…EPSS 27%
- High 7.2 EPSS 25%
-
Unscored
CVE-2019-12260 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state con…EPSS 23%
-
Unscored
CVE-2019-12258 Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP o…EPSS 23%
Advisories
- SUSE / openSUSE Security Updates 428 critical
- Debian Security (DSA / DLA) 11
- Amazon Linux Security Center (ALAS) 81 critical
- Oracle Linux Security Advisories (ELSA) 7
- Ubuntu Security Notices (USN) 7
- BSI CERT-Bund (WID) 3
- CERT@VDE 11 critical
- Rocky Linux Security Advisories 1
- openSUSE-SU-2019:1839-1 Security update for python-Django 7 CVEs
- ALAS2-2019-1267 Critical: thunderbird security update (Amazon Linux 2) 7 CVEs
- SUSE-SU-2019:2053-1 Security update for python3 3 CVEs
- SUSE-SU-2019:2053-2 Security update for python3 3 CVEs
- SUSE-SU-2019:2046-1 Security update for ardana packages 3 CVEs
- SUSE-SU-2019:14142-1 Security update for python 2 CVEs
- SUSE-SU-2019:2050-1 Security update for python3 2 CVEs
- VDE-2019-015 PHOENIX CONTACT: Security Advisory for multiple Industrial Controllers 1 CVEs
- SUSE-SU-2019:2064-1 Security update for python 1 CVEs
- SUSE-SU-2019:14139-1 Security update for bzip2 1 CVEs