Week 45, 2019

4–10 November 2019

New CVEs: 395
Critical: 11
High: 49
Newly exploited: 0
Advisories: 198
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token
EPSS 97%
Critical 9.8
CVE-2019-12419 Potential session hijack in Apache CXF
Apache · Apache CXF

EPSS 14%
Critical 9.8
CVE-2013-4409 ReviewBoard and Djblets library are vulnerable to code execution
Python Software Foundation; Beanbag · Djblets · Review Board

EPSS 3.6%
Critical 9.8
CVE-2019-8144 Magento 2 Community Edition RCE Vulnerability
Adobe · Magento 2

EPSS 2.8%
Critical 9.8
CVE-2019-8149 Magento Broken authentication and session managememt
Adobe · Magento 2

EPSS 2.5%
Critical 9.8
CVE-2019-8135 Remote code execution via vulnerable Symphony dependecy injection
Adobe · Magento 2

EPSS 2.5%
Critical 9.8
CVE-2011-4628 Typo3 Authentication Bypass
TYPO3 · typo3

EPSS 1.6%
Critical 9.8
CVE-2019-8158 Magento 2 Community Edition XML Injection
Adobe · Magento 2

EPSS 1.5%
Critical 9.8
CVE-2019-8136 Magento 2 Community Edition Insecure Component
Adobe · Magento 2

EPSS 1.4%
Critical 10.0
CVE-2019-5644 C4G BLIS Improper Access Control
Computing For Good · Basic Laboratory Information System

EPSS 1.3%
Critical 10.0
CVE-2019-5617 C4G BLIS Improper Access Control
Computing For Good · Basic Laboratory Information System

EPSS 1.3%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Unscored
CVE-2014-9013 The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary use…
EPSS 46%
Unscored
CVE-2014-9014 Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote…
EPSS 12%
Unscored
CVE-2013-2261 Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure
EPSS 12%
Medium 5.8
CVE-2019-1978 Cisco Firepower Threat Defense Software Stream Reassembly Bypass Vulnerability
Cisco · Cisco Firepower Threat Defense Software

EPSS 9.4%
Medium 5.9
CVE-2013-5123 Improper Authentication in pip
EPSS 8%
Unscored
CVE-2013-4103 Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input
EPSS 6.9%
Unscored
CVE-2015-8980 The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.
EPSS 6.4%
Medium 6.5
CVE-2019-12406 Potential DOS attack due to unrestricted attachment count in messages
EPSS 6.3%

Advisories

ICSMA-19-311-02 Medtronic Valleylab FT10 and FX8 3 CVEs
openSUSE-SU-2019:2466-1 Security update for gdal 1 CVEs
DLA-1984-1 gdal - security update 1 CVEs
ALSA-2019:3736 Critical: php:7.3 security update 1 CVEs
RLSA-2019:3736 Critical: php:7.3 security update 1 CVEs
ALSA-2019:3735 Critical: php:7.2 security update 1 CVEs
RLSA-2019:3735 Critical: php:7.2 security update 1 CVEs
USN-4175-1 ruby-nokogiri vulnerability 1 CVEs
ICSA-19-309-01 Omron CX-Supervisor 1 CVEs