Week 43, 2019
21–27 October 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 10.0
CVE-2019-5127 A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co…EPSS 45%
-
Critical 10.0
CVE-2019-5129 A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co…EPSS 39%
- Critical 9.8 EPSS 32%
-
Critical 10.0
CVE-2019-5128 A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co…EPSS 30%
- Critical 9.8 EPSS 1.8%
- Critical 9.8 EPSS 1.1%
- Critical 9.8
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 6.1 EPSS 58%
-
Unscored
CVE-2019-18371 An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconf…EPSS 56%
-
Unscored
CVE-2019-18370 An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After uploading, the application uses the tar…EPSS 40%
-
Unscored
CVE-2019-8086 Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive inf…EPSS 23%
-
Unscored
CVE-2019-18217 ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because mai…EPSS 20%
-
Unscored
CVE-2015-9499 The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.EPSS 16%
- Medium 5.3 EPSS 14%
-
Unscored
CVE-2019-17424 A stack-based buffer overflow in the processPrivilage() function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers (serving firewall config…EPSS 13%
Advisories
- SUSE / openSUSE Security Updates 41
- Amazon Linux Security Center (ALAS) 21
- Debian Security (DSA / DLA) 151 critical
- Ubuntu Security Notices (USN) 9
- CISA ICS & IT advisories 42 critical
- Oracle Linux Security Advisories (ELSA) 32 critical
- BSI CERT-Bund (WID) 2
- DSA-4547-1 tcpdump - security update 24 CVEs
- ELSA-2019-3196 Critical: firefox security update (Oracle Linux 8) 8 CVEs
- ELSA-2019-3193 Critical: firefox security update (Oracle Linux 7) 8 CVEs
- ICSA-19-295-01 ICSA-19-295-01_Schneider Electric ProClima 3 CVEs
- ICSA-19-297-01 Rittal Chiller SK 3232-Series 2 CVEs