Week 33, 2019
12–18 August 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-15107 An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.EPSS 100%
-
Critical 9.8
CVE-2019-1181 Remote Desktop Services Remote Code Execution VulnerabilityEPSS 78%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Critical 9.8
CVE-2019-1182 Remote Desktop Services Remote Code Execution VulnerabilityEPSS 17%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Critical 9.8
CVE-2019-1226 Remote Desktop Services Remote Code Execution VulnerabilityEPSS 8.2%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Critical 9.8
CVE-2019-1222 Remote Desktop Services Remote Code Execution VulnerabilityEPSS 7.6%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Critical 9.8
CVE-2019-0344 Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbi…EPSS 7.5%
-
Critical 9.8
CVE-2019-1212 Windows DHCP Server Denial of Service VulnerabilityEPSS 6.7%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
- Critical 9.8 EPSS 5.9%
-
Critical 9.8
CVE-2019-1213 Windows DHCP Server Remote Code Execution VulnerabilityEPSS 4.2%
Microsoft · Windows Server 2008 Service Pack 2 · Windows Server 2008 Service Pack 2 (Server Core installation)
-
Critical 9.8
CVE-2019-1205 Microsoft Word Remote Code Execution VulnerabilityEPSS 4%
Microsoft · Microsoft Office 2019 · Microsoft SharePoint Server 2019 · Microsoft Office 2019 for Mac
-
Critical 9.8
CVE-2019-0736 Windows DHCP Client Remote Code Execution VulnerabilityEPSS 4%
Microsoft · Windows Server 2016 · Windows Server 2016 (Server Core installation) · Windows 10 Version 1607
-
Critical 9.8
CVE-2019-15052 The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle …EPSS 2.9%
- Critical 9.8 EPSS 2.4%
- Critical 9.8 EPSS 2.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2019-9515 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of serviceEPSS 87%
-
High 7.5
CVE-2019-9512 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of serviceEPSS 83%
-
High 7.5
CVE-2019-9514 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of serviceEPSS 83%
-
High 7.5
CVE-2019-9513 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of serviceEPSS 82%
- Unscored EPSS 78%
-
Medium 6.7
CVE-2019-1184 Windows Elevation of Privilege VulnerabilityEPSS 70%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Unscored
CVE-2019-14530 An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by …EPSS 66%
-
High 7.5
CVE-2019-9511 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serviceEPSS 60%
Advisories
- Oracle Linux Security Advisories (ELSA) 68
- SUSE / openSUSE Security Updates 596 critical
- Debian Security (DSA / DLA) 223 critical
- Ubuntu Security Notices (USN) 14
- CISA ICS & IT advisories 7
- BSI CERT-Bund (WID) 4
- Siemens ProductCERT 2
- Rocky Linux Security Advisories 2
- AlmaLinux Security Advisories 2
- Schneider Electric CPCERT 1
- openSUSE-SU-2019:1872-1 Security update for python-Django 7 CVEs
- SUSE-SU-2019:2119-1 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork 4 CVEs
- SUSE-SU-2019:2117-1 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork 4 CVEs
- DSA-4498-1 python-django - security update 4 CVEs
- DLA-1883-1 tomcat8 - security update 3 CVEs
- openSUSE-SU-2019:1861-1 Security update for phpMyAdmin 2 CVEs
- DLA-1879-1 jackson-databind - security update 2 CVEs
- openSUSE-SU-2019:1918-1 Security update for bzip2 1 CVEs
- openSUSE-SU-2019:1906-1 Security update for python 1 CVEs