Week 46, 2019
11–17 November 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-5029 An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands surrounded…EPSS 57%
-
Critical 9.8
CVE-2019-8246 Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .EPSS 4.6%
- Critical 9.8 EPSS 2.3%
- Critical 9.8 EPSS 1.7%
- Critical 9.8 EPSS 1.4%
- Critical 9.8 EPSS 1.4%
- Critical 9.8
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2019-1429 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory …EPSS 77%
Microsoft · Internet Explorer 11 · Internet Explorer 10 · Internet Explorer 9
-
Unscored
CVE-2019-1439 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis…EPSS 75%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
Unscored
CVE-2019-1234 A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'.EPSS 75%
-
Unscored
CVE-2019-18952 SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload. This can be combined with CVE-2019-18951 to achieve remote code execution via a…EPSS 44%
-
Unscored
CVE-2019-18939 eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with acces…EPSS 41%
-
Unscored
CVE-2019-18938 eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with acce…EPSS 34%
-
Unscored
CVE-2019-18937 eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with a…EPSS 34%
-
High 7.8
CVE-2019-1405 An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP…EPSS 30%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
Advisories
- SUSE / openSUSE Security Updates 58
- Oracle Linux Security Advisories (ELSA) 52
- Ubuntu Security Notices (USN) 19
- Debian Security (DSA / DLA) 16
- Amazon Linux Security Center (ALAS) 7
- CISA ICS & IT advisories 61 critical
- BSI CERT-Bund (WID) 4
- Siemens ProductCERT 1
- ICSA-19-318-05 ABB Power Generation Information Manager (PGIM) and Plant Connect 1 CVEs