Week 36, 2019
2–8 September 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.9 EPSS 79%
-
Critical 9.8
CVE-2019-10891 An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnap_main, which calls system() without checking the parameter that…EPSS 19%
-
Critical 9.8
CVE-2019-13656 An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to…EPSS 5.8%
CA Technologies · Workload Automation AE · Client Automation
- Critical 9.8 EPSS 1.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 6.1 EPSS 83%
-
Unscored
CVE-2019-16113 Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code ca…EPSS 78%
-
High 8.8
CVE-2019-15949 Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via t…EPSS 77%
-
Unscored
CVE-2019-15043 In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the …EPSS 63%
-
Unscored
CVE-2019-15846 Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.EPSS 36%
-
Unscored
CVE-2019-15813 Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell.EPSS 33%
-
Unscored
CVE-2019-16119 SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id param…EPSS 25%
- Medium 6.5 EPSS 22%
Advisories
- SUSE / openSUSE Security Updates 525 critical
- Debian Security (DSA / DLA) 14
- Ubuntu Security Notices (USN) 8
- Oracle Linux Security Advisories (ELSA) 81 critical
- BSI CERT-Bund (WID) 6
- CISA ICS & IT advisories 4
- Rocky Linux Security Advisories 1
- AlmaLinux Security Advisories 1
- ELSA-2019-2663 Critical: firefox security update (Oracle Linux 8) 13 CVEs
- SUSE-SU-2019:2257-1 Security update for python-Django 6 CVEs
- SUSE-SU-2019:2300-1 Security update for python-urllib3 4 CVEs
- openSUSE-SU-2019:2078-1 Security update for python-SQLAlchemy 2 CVEs
- openSUSE-SU-2019:2064-1 Security update for python-SQLAlchemy 2 CVEs
- SUSE-SU-2019:2261-1 Security update for python-SQLAlchemy 2 CVEs