Week 44, 2019
28 October – 3 November 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 89%
-
Critical 9.0
CVE-2018-4031 An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function…EPSS 2.7%
-
Critical 10.0
CVE-2019-5151 An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. A specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leadin…EPSS 2.3%
- Critical 9.1 EPSS 1.4%
- Critical 9.8 EPSS 1.4%
- Critical 9.8 EPSS 1.3%
- Critical 9.8 EPSS 1.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.7 EPSS 100%
-
Unscored
CVE-2019-16662 An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the ro…EPSS 98%
-
Unscored
CVE-2019-16663 An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand p…EPSS 85%
-
Unscored
CVE-2013-1391 Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remot…EPSS 76%
-
Unscored
CVE-2012-0694 SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.EPSS 67%
-
Unscored
CVE-2019-14931 An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Comman…EPSS 57%
-
Unscored
CVE-2019-17181 A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). An attacker may send a crafted HTTP GET or HEAD request that can result in a com…EPSS 48%
-
Unscored
CVE-2019-14928 An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site scrip…EPSS 43%
Advisories
- SUSE / openSUSE Security Updates 331 critical
- Ubuntu Security Notices (USN) 12
- Debian Security (DSA / DLA) 11
- CISA ICS & IT advisories 51 critical
- Amazon Linux Security Center (ALAS) 41 critical
- Oracle Linux Security Advisories (ELSA) 31 critical
- CERT@VDE 1
- BSI CERT-Bund (WID) 1
- SUSE-SU-2019:2867-1 Security update for ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-keystone, openstack-monasca-installer, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-no 11 CVEs
- ICSA-19-304-01 Advantech WISE-PaaS/RMM 4 CVEs
- ALAS2-2019-1344 Critical: php security update (Amazon Linux 2) 1 CVEs
- ELSA-2019-3286 Critical: php security update (Oracle Linux 7) 1 CVEs