Week 50, 2019
9–15 December 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-18935 Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when…EPSS 100%
-
Critical 9.8
CVE-2019-19230 An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execu…EPSS 3.8%
- Critical 9.8 EPSS 3.6%
-
Critical 9.8
CVE-2019-5085 An exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.15. A specially craf…EPSS 3.4%
-
Critical 9.8
CVE-2019-18339 A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The HTTP service (default port 5401/tcp) of the SiVMS/SiNVR Video Serv…EPSS 2.7%
-
Critical 9.8
CVE-2019-18337 A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains an authentication bypass v…EPSS 2.5%
-
Critical 9.8
CVE-2013-2095 RubyGem openshift-origin-controller is vulnerable to command injectionEPSS 2.5%
rubygem-openshift-origin-controller · rubygem-openshift-origin-controller
-
Critical 9.1
CVE-2019-5090 An exploitable information disclosure vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.15. A specia…EPSS 2.3%
- Critical 9.8 EPSS 2.1%
-
Critical 9.1
CVE-2019-4244 IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to gain unauthorized information and unrestricted control over Zookeeper installatio…EPSS 2.1%
-
Critical 9.9
CVE-2019-18342 A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server…EPSS 2.1%
- Critical 9.8 EPSS 2%
-
Critical 9.8
CVE-2019-19750 minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.EPSS 1.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2013-5743 Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.EPSS 80%
-
High 7.8
CVE-2019-1458 An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…EPSS 74%
-
Unscored
CVE-2019-17270 Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={C…EPSS 58%
- High 7.5 EPSS 27%
-
Unscored
CVE-2019-19719 Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.EPSS 22%
-
Unscored
CVE-2019-1468 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Cod…EPSS 18%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
Unscored
CVE-2019-1462 A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft Powe…EPSS 18%
Microsoft · Microsoft Office · Office 365 ProPlus · Microsoft PowerPoint
-
Unscored
CVE-2019-1481 An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Media Player Informatio…EPSS 17%
Advisories
- SUSE / openSUSE Security Updates 46
- Debian Security (DSA / DLA) 171 critical
- CISA ICS & IT advisories 113 critical
- Ubuntu Security Notices (USN) 11
- Oracle Linux Security Advisories (ELSA) 8
- Amazon Linux Security Center (ALAS) 8
- BSI CERT-Bund (WID) 6
- Siemens ProductCERT 31 critical
- ICSA-19-351-02 Siemens SPPA-T3000 (Update A) 54 CVEs
- SSA-761617 SSA-761617: Authentication Bypass and Information Disclosure Vulnerabilities in SiNVR/SiVMS Video Server 2 CVEs
- ICSA-19-344-02 Siemens and PKE SiNVR, SiVMS Video Server (Update A) 2 CVEs
- DLA-2030-1 jackson-databind - security update 2 CVEs
- ICSA-19-346-01 Advantech DiagAnywhere Server 1 CVEs