Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2019

44 records · 6 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2019-7298
    35Monitor

    An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03.

    HighCVSS 8.1No exploitEPSS 10%

    dlink · dir-823g firmwareFeb 1, 2019

  • CVE-2017-18362
    95Now

    ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct ac

    CriticalCVSS 9.8KEVWeaponizedEPSS 86%

    connectwise · manageditsyncFeb 5, 2019

  • CVE-2018-20753
    78This week

    Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShel

    CriticalCVSS 9.8KEVWeaponizedEPSS 29%

    kaseya · virtual system administratorFeb 5, 2019

  • CVE-2016-1000282
    43Plan

    Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files.

    CriticalCVSS 9.8WeaponizedEPSS 13%

    haraka project · harakaFeb 5, 2019

  • CVE-2018-11803
    48Plan

    Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if

    HighCVSS 7.5No exploitEPSS 58%

    apache · subversionFeb 5, 2019

  • CVE-2018-18990
    33Monitor

    LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation.

    MediumCVSS 5.3No exploitEPSS 39%

    lcds · laquis scadaFeb 5, 2019

  • CVE-2018-20250
    90Now

    In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in

    HighCVSS 7.8KEVWeaponizedEPSS 96%

    rarlab · winrarFeb 5, 2019

  • CVE-2018-20251
    31Monitor

    In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format.

    MediumCVSS 5.5No exploitEPSS 31%

    rarlab · winrarFeb 5, 2019

  • CVE-2018-18500
    43Plan

    A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements.

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    mozilla · firefoxFeb 5, 2019

  • CVE-2018-3991
    49Plan

    An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management, version 6.40.2402.500.

    CriticalCVSS 9.8No exploitEPSS 34%

    wibu · wibukeyFeb 5, 2019

  • CVE-2019-1003005
    41Plan

    A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecuri

    HighCVSS 8.8WeaponizedEPSS 19%

    jenkins · script securityFeb 6, 2019

  • CVE-2019-3822
    43Plan

    libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow.

    CriticalCVSS 9.8No exploitEPSS 12%

    haxx · libcurlFeb 6, 2019

  • CVE-2019-5736
    64This week

    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequen

    HighCVSS 8.6WeaponizedEPSS 98%

    docker · dockerFeb 11, 2019

  • CVE-2018-20781
    31Monitor

    In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daem

    HighCVSS 7.8WeaponizedEPSS 1%

    gnome · gnome keyringFeb 12, 2019

  • CVE-2017-0938
    36Monitor

    Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplificati

    HighCVSS 7.5No exploitEPSS 20%

    ui · airosFeb 12, 2019

  • CVE-2019-6543
    44Plan

    AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 20

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    aveva · indusoft web studioFeb 12, 2019

  • CVE-2019-6545
    34Monitor

    AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 20

    HighCVSS 7.5Proof of conceptEPSS 13%

    aveva · indusoft web studioFeb 12, 2019

  • CVE-2019-8341
    52Plan

    An issue was discovered in Jinja2 2.10.

    CriticalCVSS 9.8Proof of conceptEPSS 43%

    pocoo · jinja2Feb 15, 2019

  • CVE-2019-6974
    37Monitor

    In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition,

    HighCVSS 8.1Proof of conceptEPSS 16%

    linux · linux kernelFeb 15, 2019

  • CVE-2019-8394
    75This week

    Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customizat

    MediumCVSS 6.5KEVWeaponizedEPSS 63%

    zohocorp · manageengine servicedesk plusFeb 17, 2019

  • CVE-2018-20782
    33Monitor

    The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.

    HighCVSS 7.5Proof of conceptEPSS 10%

    globee · woocommerceFeb 17, 2019

  • CVE-2019-6453
    48Plan

    mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers.

    HighCVSS 8.1Proof of conceptEPSS 54%

    mirc · mircFeb 18, 2019

  • CVE-2019-8903
    52Plan

    index.js in Total.js Platform before 3.2.3 allows path traversal.

    HighCVSS 7.5WeaponizedEPSS 72%

    totaljs · total.jsFeb 18, 2019

  • CVE-2019-8917
    50Plan

    SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service.

    CriticalCVSS 9.8No exploitEPSS 36%

    solarwinds · orion network performance monitorFeb 18, 2019

  • CVE-2019-5782
    39Monitor

    Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a

    HighCVSS 8.8Proof of conceptEPSS 13%

    google · chromeFeb 19, 2019

  • CVE-2019-8942
    60This week

    WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an a

    HighCVSS 8.8WeaponizedEPSS 82%

    wordpress · wordpressFeb 19, 2019

  • CVE-2019-8943
    54Plan

    WordPress through 5.0.3 allows Path Traversal in wp_crop_image().

    MediumCVSS 6.5WeaponizedEPSS 91%

    wordpress · wordpressFeb 19, 2019

  • CVE-2019-8331
    29Monitor

    In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

    MediumCVSS 6.1Proof of conceptEPSS 16%

    getbootstrap · bootstrapFeb 20, 2019

  • CVE-2019-8953
    40Plan

    The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_lis

    MediumCVSS 6.1Proof of conceptEPSS 52%

    netgate · haproxyFeb 20, 2019

  • CVE-2019-3924
    35Monitor

    MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability.

    HighCVSS 7.5Proof of conceptEPSS 15%

    mikrotik · routerosFeb 20, 2019

  • CVE-2019-8982
    46Plan

    com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leadin

    CriticalCVSS 9.6Proof of conceptEPSS 27%

    wavemaker · wavemarker studioFeb 21, 2019

  • CVE-2019-8985
    43Plan

    On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overf

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    netis-systems · wf2411 firmwareFeb 21, 2019

  • CVE-2019-6340
    90Now

    Drupal core - Highly critical - Remote Code Execution

    HighCVSS 8.1KEVWeaponizedEPSS 92%

    drupal · drupalFeb 21, 2019

  • CVE-2019-9020
    42Plan

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.

    CriticalCVSS 9.8No exploitEPSS 10%

    php · phpFeb 22, 2019

  • CVE-2019-9021
    42Plan

    An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.

    CriticalCVSS 9.8No exploitEPSS 10%

    php · phpFeb 22, 2019

  • CVE-2019-9041
    37Monitor

    An issue was discovered in ZZZCMS zzzphp V1.6.1.

    HighCVSS 7.2Proof of conceptEPSS 31%

    zzzcms · zzzphpFeb 23, 2019

  • CVE-2019-8375
    44Plan

    The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent t

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    webkitgtk · webkitgtkFeb 24, 2019

  • CVE-2019-9082
    94Now

    ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app

    HighCVSS 8.8KEVWeaponizedEPSS 97%

    thinkphp · thinkphpFeb 24, 2019

  • CVE-2019-9122
    42Plan

    An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices.

    HighCVSS 8.8No exploitEPSS 23%

    dlink · dir-825 rev.b firmwareFeb 25, 2019

  • CVE-2018-20033
    40Plan

    A Remote Code Execution vulnerability in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier could allow a

    CriticalCVSS 9.8No exploitEPSS 3%

    flexera · flexnet publisherFeb 25, 2019

  • CVE-2019-9194
    68This week

    elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.

    CriticalCVSS 9.8WeaponizedEPSS 96%

    std42 · elfinderFeb 26, 2019

  • CVE-2019-4061
    28Monitor

    IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets dep

    MediumCVSS 5.3WeaponizedEPSS 22%

    ibm · bigfix platformFeb 27, 2019

  • CVE-2019-1559
    28Monitor

    0-byte record padding oracle

    MediumCVSS 5.9No exploitEPSS 17%

    openssl · opensslFeb 27, 2019

  • CVE-2019-1663
    68This week

    Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 95%

    cisco · rv110w firmwareFeb 28, 2019