Week 49, 2019

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2019-5544 OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical sever…
  EPSS 98%
• Critical 9.8
  CVE-2019-7195 This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend upd…
  EPSS 89%
• Critical 9.8
  CVE-2019-7192 This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend upda…
  EPSS 88%
• Critical 9.8
  CVE-2019-7194 This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend upd…
  EPSS 83%
• Critical 9.8
  CVE-2019-5096 An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in version…
  EPSS 67%
• Critical 9.8
  CVE-2019-19576 Remote code execution in verot/class.upload.php
  EPSS 26%
• Critical 9.8
  CVE-2019-7193 This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating …
  EPSS 14%
• Critical 9.8
  CVE-2019-5132 An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll GEM Raster parser of the Accusoft ImageGear 19.3.0 library. A specially crafted GE…
  EPSS 3.7%
• Critical 9.8
  CVE-2019-5076 An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG header-parser of the Accusoft ImageGear 19.3.0 library. A specially crafted PN…
  EPSS 3.7%
• Critical 9.8
  CVE-2019-17556 Deserialization of Untrusted Data in Apache Olingo

  Apache · Olingo

  EPSS 3.6%
• Critical 9.8
  CVE-2019-5083 An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll TIFdecodethunderscan function of Accusoft ImageGear 19.3.0 library. A specially cr…
  EPSS 3.6%
• Critical 9.8
  CVE-2019-5133 An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll BMP parser of the ImageGear 19.3.0 library. A specially crafted BMP file can cause…
  EPSS 3.2%
• Critical 9.8
  CVE-2019-10769 Sandbox Breakout / Arbitrary Code Execution in safer-eval
  EPSS 2.6%
• Critical 9.8
  CVE-2019-15631 Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrar…

  MuleSoft · Mule API Gateway 2.x · Mule CE/EE 3.x

  EPSS 2.3%
• Critical 9.8
  CVE-2019-19617 phpMyAdmin unsanitized Git information
  EPSS 2.3%

All 22 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.2
  CVE-2019-19609 Command Injection in strapi
  EPSS 54%
• Unscored
  CVE-2019-12518 Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.
  EPSS 51%
• Medium 5.3
  CVE-2019-5097 A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.…
  EPSS 45%
• Unscored
  CVE-2019-19492 FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.
  EPSS 29%
• High 8.8
  CVE-2012-1592 Unrestricted Upload of File with Dangerous Type in Apache Struts2

  libstruts1.2-java · libstruts1.2-java

  EPSS 29%
• Unscored
  CVE-2019-19597 D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH …
  EPSS 21%
• Unscored
  CVE-2019-19642 On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who…
  EPSS 19%
• Unscored
  CVE-2019-1551 rsaz_512_sqr overflow bug on x86_64

  OpenSSL · OpenSSL

  EPSS 14%