Week 47, 2019
18–24 November 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-19006 Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.EPSS 55%
- Critical 9.8 EPSS 33%
- Critical 9.8 EPSS 22%
- Critical 9.8 EPSS 3.4%
- Critical 9.8 EPSS 2.2%
- Critical 9.8 EPSS 1.7%
- Critical 9.8 EPSS 1.6%
- Critical 9.8 EPSS 1.5%
- Critical 9.1
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2011-2921 ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can result in command exec…EPSS 83%
-
Unscored
CVE-2019-18610 An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Aste…EPSS 50%
- High 7.2 EPSS 27%
- Unscored EPSS 22%
-
Unscored
CVE-2019-16340 Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.EPSS 19%
- Medium 5.9 EPSS 17%
-
Unscored
CVE-2019-16758 In Lexmark Services Monitor 2.27.4.0.39 (running on TCP port 2070), a remote attacker can use a directory traversal technique using /../../../ or ..%2F..%2F..%…EPSS 17%
-
Unscored
CVE-2018-8879 Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote a…EPSS 17%
Advisories
- SUSE / openSUSE Security Updates 33
- Debian Security (DSA / DLA) 13
- Oracle Linux Security Advisories (ELSA) 92 critical
- BSI CERT-Bund (WID) 6
- Ubuntu Security Notices (USN) 5
- Amazon Linux Security Center (ALAS) 5
- CISA ICS & IT advisories 11 critical
- ICSA-19-323-01 Flexera FlexNet Publisher 4 CVEs
- ELSA-2019-3736 Critical: php:7.3 security update (Oracle Linux 8) 1 CVEs
- ELSA-2019-3735 Critical: php:7.2 security update (Oracle Linux 8) 1 CVEs