Week 48, 2019
25 November – 1 December 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-18580 Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerability. A remote unauthenticated attacker …EPSS 4.9%
- Critical 9.8 EPSS 1.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2011-2523 vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.EPSS 96%
-
Medium 6.5
CVE-2019-5825 Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa…EPSS 56%
-
High 8.8
CVE-2019-13720 Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 49%
- High 7.7 EPSS 46%
-
Unscored
CVE-2019-18679 An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HT…EPSS 43%
-
Unscored
CVE-2019-19307 An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-…EPSS 41%
-
Unscored
CVE-2019-15298 A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/fo…EPSS 27%
-
Unscored
CVE-2019-18922 A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] allows unauthenticated attackers to read …EPSS 24%
Advisories
- SUSE / openSUSE Security Updates 617 critical
- Debian Security (DSA / DLA) 20
- Ubuntu Security Notices (USN) 8
- Oracle Linux Security Advisories (ELSA) 4
- BSI CERT-Bund (WID) 2
- CISA ICS & IT advisories 21 critical
- openSUSE-SU-2019:2597-1 Security update for clamav 2 CVEs
- openSUSE-SU-2019:2595-1 Security update for clamav 2 CVEs
- SUSE-SU-2019:3068-1 Security update for ardana-db, ardana-keystone, ardana-neutron, ardana-nova, crowbar-core, crowbar-openstack, crowbar-ui, openstack-barbican, openstack-heat-templates, openstack-keystone, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-sahara, python-psutil, release-notes-suse-openstack-cloud 2 CVEs
- SUSE-SU-2019:3066-1 Security update for clamav 2 CVEs
- SUSE-SU-2019:14231-1 Security update for clamav 2 CVEs
- SUSE-SU-2019:3053-1 Security update for clamav 2 CVEs
- openSUSE-SU-2019:2599-1 Security update for phpMyAdmin 1 CVEs
- ICSA-19-330-01 ABB Relion 670 Series 1 CVEs