Week 35, 2019

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2019-12643 Cisco REST API Container for IOS XE Software Authentication Bypass Vulnerability

  Cisco · Cisco IOS XE Software

  EPSS 5.3%
• Critical 10.0
  CVE-2019-11061 HG100 has a broken access control vulnerability in its Web API Server

  ASUS · HG100 firmware

  EPSS 4%
• Critical 10.0
  CVE-2019-11063 SmartHome application has a broken access control vulnerability in its Web API Server

  ASUS · SmartHome ios app · SmartHome Android app

  EPSS 3.9%
• Critical 9.8
  CVE-2019-14300 Several Ricoh printers have multiple buffer overflows parsing HTTP cookie headers, which allow an attacker to cause a denial of service or code execution via c…
  EPSS 3.1%
• Critical 9.8
  CVE-2019-14308 Several Ricoh printers have multiple buffer overflows parsing LPD packets, which allow an attacker to cause a denial of service or code execution via crafted r…
  EPSS 3.1%
• Critical 9.1
  CVE-2019-15753 OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning
  EPSS 2.6%
• Critical 9.8
  CVE-2019-15521 Spoon Library as used in Fork CMS allows PHP object injection
  EPSS 2.5%
• Critical 9.8
  CVE-2019-15552 Use after free in libflate
  EPSS 2.5%
• Critical 9.8
  CVE-2019-15657 Arbitrary Code Execution in eslint-utils
  EPSS 2.3%
• Critical 9.8
  CVE-2019-15554 Memory corruption in smallvec
  EPSS 2.1%
• Critical 9.8
  CVE-2018-21000 Heap overflow or corruption in safe-transmute
  EPSS 2%
• Critical 9.8
  CVE-2019-15563 OHDSI WebAPI vulnerable to SQL Injection
  EPSS 1.9%
• Critical 9.8
  CVE-2019-15551 Double free in smallvec
  EPSS 1.9%
• Critical 9.8
  CVE-2018-20991 Double free in smallvec
  EPSS 1.8%
• Critical 9.8
  CVE-2018-20996 Double free in crossbeam
  EPSS 1.7%

All 20 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 6.5
  CVE-2019-11248 Kubernetes kubelet exposes /debug/pprof info on healthz port

  Kubernetes · Kubernetes

  EPSS 75%
• Unscored
  CVE-2019-11500 In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' …
  EPSS 62%
• High 7.8
  CVE-2019-15752 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMD…
  EPSS 49%
• Unscored
  CVE-2019-14314 A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would all…
  EPSS 43%
• Unscored
  CVE-2019-15642 rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the…
  EPSS 37%
• High 7.5
  CVE-2019-13608 Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
  EPSS 30%
• High 7.5
  CVE-2019-12402 Denial of Service in Apache Commons Compress

  Apache Software Foundation · Apache Commons Compress

  EPSS 16%
• High 7.1
  CVE-2019-15637 Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects T…
  EPSS 14%