Week 52, 2019
23–29 December 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-19781 An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.EPSS 100%
- Critical 9.9 EPSS 85%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Medium 5.8
CVE-2019-19985 The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.EPSS 71%
- Unscored EPSS 36%
- Unscored EPSS 13%
-
Unscored
CVE-2019-20049 An issue was discovered on Alcatel-Lucent OmniVista 4760 devices. A remote unauthenticated attacker can chain a directory traversal (which helps to bypass auth…EPSS 13%
- Unscored EPSS 12%
-
Unscored
CVE-2014-5289 Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request.EPSS 12%
-
Unscored
CVE-2019-19924 SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error ha…EPSS 11%
-
High 7.5
CVE-2019-17563 In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attackEPSS 11%
Advisories
- Debian Security (DSA / DLA) 81 critical
- SUSE / openSUSE Security Updates 7
- BSI CERT-Bund (WID) 4
- Oracle Linux Security Advisories (ELSA) 2
- DSA-4596-1 tomcat8 - security update 6 CVEs