Week 34, 2019

19–25 August 2019

New CVEs: 544
Critical: 17
High: 56
Newly exploited: 0
Advisories: 72
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2019-1935 Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability
Cisco · Cisco Unified Computing System Director

EPSS 83%
Critical 9.8
CVE-2019-1937 Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
Cisco · Cisco Unified Computing System Director

EPSS 76%
Critical 9.8
CVE-2019-1938 Cisco UCS Director and Cisco UCS Director Express for Big Data API Authentication Bypass Vulnerability
Cisco · Cisco Unified Computing System Director

EPSS 4.6%
Critical 9.8
CVE-2019-1974 Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
Cisco · Cisco Unified Computing System Director

EPSS 4.5%
Critical 9.8
CVE-2019-10746 Prototype Pollution in mixin-deep
EPSS 3.7%
Critical 9.8
CVE-2019-15224 rest-client Gem Contains Malicious Code
EPSS 3.6%
Critical 9.8
CVE-2019-5041 An exploitable Stack Based Buffer Overflow vulnerability exists in the EnumMetaInfo function of Aspose Aspose.Words library, version 18.11.0.0. A specially cra…
EPSS 3.3%
Critical 9.8
CVE-2019-1581 PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface
Palo Alto Networks · PAN-OS

EPSS 3.2%
Critical 9.8
CVE-2019-5032 An exploitable out-of-bounds read vulnerability exists in the LabelSst record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can ca…
EPSS 3.1%
Critical 9.8
CVE-2019-5033 An exploitable out-of-bounds read vulnerability exists in the Number record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can caus…
EPSS 3.1%
Critical 9.1
CVE-2019-11601 Path traversal in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software
EPSS 2.7%
Critical 9.8
CVE-2019-10747 Prototype Pollution in set-value
EPSS 2.5%
Critical 9.8
CVE-2019-10750 Prototype Pollution in deeply
EPSS 1.7%
Critical 9.8
CVE-2019-15537 SQL Injection in SimpleSAMLphp
EPSS 1.6%
Critical 9.6
CVE-2019-6159 A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded Baseboard Management Con…
IBM · legacy System x IMM (IMM v1) firmware

EPSS 1.1%

All 17 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

SUSE-SU-2019:2180-1 Security update for python-Django 4 CVEs
SUSE-SU-2019:2091-1 Security update for python 2 CVEs