Week 39, 2019
23–29 September 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-16920 Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an …EPSS 100%
-
Critical 9.8
CVE-2019-16759 vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.EPSS 100%
-
Critical 9.8
CVE-2019-16928 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat i…EPSS 42%
-
Critical 9.8
CVE-2019-16377 Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctlyEPSS 2.6%
- Critical 9.8 EPSS 2.5%
- Critical 9.9 EPSS 2.4%
-
Critical 9.8
CVE-2019-3746 Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote …EPSS 2.1%
- Critical 9.8 EPSS 1.7%
- Critical 9.8 EPSS 1.5%
- Critical 9.8 EPSS 1.4%
-
Critical 9.9
CVE-2019-10417 Incorrect Authorization in Jenkins Kubernetes :: Pipeline :: Kubernetes Steps PluginEPSS 1.2%
Jenkins Project · Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin
-
Critical 9.9
CVE-2019-10418 Incorrect Authorization in Jenkins Kubernetes :: Pipeline :: Arquillian Steps PluginEPSS 1.2%
Jenkins Project · Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-10092 In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on t…EPSS 81%
-
Unscored
CVE-2019-10098 In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and …EPSS 74%
-
Unscored
CVE-2019-16724 File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) based buffer overflow …EPSS 72%
- Medium 4.3 EPSS 65%
-
Unscored
CVE-2019-16667 diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csr…EPSS 55%
-
Unscored
CVE-2019-10097 In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafte…EPSS 53%
-
High 7.5
CVE-2019-1367 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory …EPSS 52%
Microsoft · Internet Explorer 11 · Internet Explorer 10 · Internet Explorer 9
-
Unscored
CVE-2019-13063 Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_view page.…EPSS 27%
Advisories
- SUSE / openSUSE Security Updates 542 critical
- Debian Security (DSA / DLA) 182 critical
- Ubuntu Security Notices (USN) 4
- BSI CERT-Bund (WID) 4
- Oracle Linux Security Advisories (ELSA) 2
- Amazon Linux Security Center (ALAS) 1
- Schneider Electric CPCERT 1
- openSUSE-SU-2019:2169-1 Security update for curl 2 CVEs
- DSA-4536-1 exim4 - security update 1 CVEs
- DLA-1933-1 ruby-nokogiri - security update 1 CVEs
- SUSE-SU-2019:2462-1 Security update for python-numpy 1 CVEs