Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2019

120 records · 12 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2019-9055
    40Plan

    An issue was discovered in CMS Made Simple 2.2.8.

    HighCVSS 8.8WeaponizedEPSS 12%

    cmsmadesimple · cms made simpleMar 26, 2019

  • CVE-2019-10068
    98Now

    An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions.

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    kentico · xperienceMar 26, 2019

  • CVE-2019-6341
    25Monitor

    Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004

    MediumCVSS 5.4No exploitEPSS 12%

    drupal · drupalMar 26, 2019

  • CVE-2019-5418
    90Now

    There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accep

    HighCVSS 7.5KEVWeaponizedEPSS 98%

    rubyonrails · railsMar 27, 2019

  • CVE-2019-5420
    66This week

    A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically gene

    CriticalCVSS 9.8WeaponizedEPSS 89%

    rubyonrails · railsMar 27, 2019

  • CVE-2019-10232
    46Plan

    Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.

    CriticalCVSS 9.8Proof of conceptEPSS 22%

    teclib-edition · gestionnaire libre de parc informatiqueMar 27, 2019

  • CVE-2019-3829
    48Plan

    A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7.

    HighCVSS 7.5No exploitEPSS 58%

    gnu · gnutlsMar 27, 2019

  • CVE-2017-18365
    60This week

    The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to e

    CriticalCVSS 9.8WeaponizedEPSS 21%

    github · githubMar 28, 2019

  • CVE-2019-5737
    35Monitor

    In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of S

    HighCVSS 7.5Proof of conceptEPSS 16%

    nodejs · node.jsMar 28, 2019

  • CVE-2019-9164
    49Plan

    Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.

    HighCVSS 8.8No exploitEPSS 45%

    nagios · nagios xiMar 28, 2019

  • CVE-2019-9202
    42Plan

    Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.

    HighCVSS 8.8Proof of conceptEPSS 23%

    nagios · incident managerMar 28, 2019

  • CVE-2019-9203
    45Plan

    Authorization bypass in Nagios IM (component of Nagios XI) before 2.2.7 allows closing incidents in IM via the API.

    CriticalCVSS 9.8No exploitEPSS 20%

    nagios · incident managerMar 28, 2019

  • CVE-2019-9204
    45Plan

    SQL injection vulnerability in Nagios IM (component of Nagios XI) before 2.2.7 allows attackers to execute arbitrary SQL commands.

    CriticalCVSS 9.8No exploitEPSS 19%

    nagios · incident managerMar 28, 2019

  • CVE-2019-9167
    31Monitor

    Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow

    MediumCVSS 6.1No exploitEPSS 21%

    nagios · nagios xiMar 28, 2019

  • CVE-2019-0222
    34Monitor

    In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

    HighCVSS 7.5Proof of conceptEPSS 12%

    apache · activemqMar 28, 2019

  • CVE-2019-9922
    33Monitor

    An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!.

    HighCVSS 7.5Proof of conceptEPSS 10%

    harmistechnology · je messengerMar 29, 2019

  • CVE-2019-10655
    60This week

    Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices a

    CriticalCVSS 9.8WeaponizedEPSS 15%

    grandstream · gac2500 firmwareMar 30, 2019

  • CVE-2019-10662
    48Plan

    Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the back

    HighCVSS 8.8No exploitEPSS 43%

    grandstream · ucm6204 firmwareMar 30, 2019

  • CVE-2019-10663
    43Plan

    Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a l

    HighCVSS 8.8No exploitEPSS 27%

    grandstream · ucm6204 firmwareMar 30, 2019

  • CVE-2019-10678
    35Monitor

    Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.

    HighCVSS 7.5Proof of conceptEPSS 17%

    domoticz · domoticzMar 31, 2019