By publication date

Exploited and new serious CVEs: April 2019

122 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
31Monitor	CVE-2019-1002100No exploit	In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Sekubernetes · kubernetes · CWE-770 Denial of service	Medium6.5	—	16.9%	Apr 1, 2019
26Monitor	CVE-2019-1002101Proof of concept	kubectl cp path traversalkubernetes · kubernetes · CWE-59 Path traversal	Medium5.5	—	12.8%	Apr 1, 2019
36Monitor	CVE-2019-6715Proof of concept	pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL fieboldgrid · w3 total cache Pre-auth	High7.5	—	19.3%	Apr 1, 2019
55Plan	CVE-2019-9193Weaponized	In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to postgresql · postgresql · CWE-78 RCE Command injection	High7.2	—	91.6%	Apr 1, 2019
62This week	CVE-2019-10692Weaponized	In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before codecabin · wp go maps · CWE-89 Pre-auth SQL injection	Critical9.8	—	77.3%	Apr 2, 2019
38Monitor	CVE-2018-4314Proof of concept	A use after free issue was addressed with improved memory management.apple · safari · CWE-416 Pre-auth Memory safety	High8.8	—	10.2%	Apr 3, 2019
62This week	CVE-2018-4344Weaponized	A memory corruption issue was addressed with improved memory handling.apple · iphone os · CWE-119 Memory safety	High7.8	KEV	2.3%	Apr 3, 2019
41Plan	CVE-2018-4407Proof of concept	A memory corruption issue was addressed with improved validation.apple · iphone os · CWE-119 Memory safety	High8.8	—	21.2%	Apr 3, 2019
46Plan	CVE-2018-4416Proof of concept	Multiple memory corruption issues were addressed with improved memory handling.apple · safari · CWE-119 Pre-auth Memory safety	High8.8	—	35.4%	Apr 3, 2019
39Monitor	CVE-2018-4441Proof of concept	A memory corruption issue was addressed with improved memory handling.apple · safari · CWE-119 Pre-auth Memory safety	High8.8	—	12.7%	Apr 3, 2019
32Monitor	CVE-2019-10863Proof of concept	A command injection vulnerability exists in TeemIp versions before 2.4.0.combodo · teemip · CWE-94 RCE Command injection	High7.2	—	13.4%	Apr 4, 2019
56Plan	CVE-2019-10867Weaponized	An issue was discovered in Pimcore before 5.7.1.pimcore · pimcore · CWE-502 Deserialization	High8.8	—	68.8%	Apr 4, 2019
59Plan	CVE-2019-6553No exploit	A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior.rockwellautomation · rslinx · CWE-121 Pre-auth Memory safety	Critical9.8	—	66.1%	Apr 4, 2019
69This week	CVE-2019-11001Weaponized	On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionreolink · rlc-410w firmware · CWE-78 RCE Command injection	High7.2	KEV	37.5%	Apr 8, 2019
33Monitor	CVE-2019-0215No exploit	In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 apache · http server	High7.5	—	10.6%	Apr 8, 2019
35Monitor	CVE-2019-0217Proof of concept	In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a userapache · http server · CWE-362 Race condition	High7.5	—	17.4%	Apr 8, 2019
81Now	CVE-2019-0211Weaponized	In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes orapache · http server · CWE-416 RCE Local privilege escalation Memory safety	High7.8	KEV	65.0%	Apr 8, 2019
37Monitor	CVE-2019-0592No exploit	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Cmicrosoft · chakracore · CWE-787 pre-auth RCE Memory safety	High7.5	—	22.8%	Apr 8, 2019
40Plan	CVE-2019-0603No exploit	A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory.microsoft · windows 10 RCE	High7.5	—	34.2%	Apr 8, 2019
24Monitor	CVE-2019-0612Proof of concept	A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects.microsoft · edge pre-auth RCE	Medium5.3	—	10.5%	Apr 8, 2019
37Monitor	CVE-2019-0617No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	19.5%	Apr 8, 2019
34Monitor	CVE-2019-0639No exploit	A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Enginmicrosoft · internet explorer · CWE-190 pre-auth RCE Memory safety	High7.5	—	12.0%	Apr 8, 2019
36Monitor	CVE-2019-0666No exploit	A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remmicrosoft · internet explorer · CWE-787 pre-auth RCE Memory safety	High7.5	—	20.4%	Apr 8, 2019
39Monitor	CVE-2019-0667Proof of concept	A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remmicrosoft · internet explorer · CWE-787 pre-auth RCE Memory safety	High7.5	—	31.2%	Apr 8, 2019
49Plan	CVE-2019-0697No exploit	A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, akamicrosoft · windows 10 · CWE-787 pre-auth RCE Memory safety	Critical9.8	—	32.9%	Apr 8, 2019
58Plan	CVE-2019-0698No exploit	A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, akamicrosoft · windows 10 · CWE-787 pre-auth RCE Memory safety	Critical9.8	—	62.8%	Apr 8, 2019
59Plan	CVE-2019-0703Weaponized	An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Informationmicrosoft · windows 10 1507	Medium6.5	KEV	9.6%	Apr 8, 2019
55Plan	CVE-2019-0726No exploit	A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, akamicrosoft · windows 10 · CWE-787 pre-auth RCE Memory safety	Critical9.8	—	54.4%	Apr 8, 2019
35Monitor	CVE-2019-0748No exploit	A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka microsoft · office RCE	High7.8	—	13.6%	Apr 8, 2019
39Monitor	CVE-2019-0756No exploit	A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Codemicrosoft · windows 10 · CWE-611 pre-auth RCE XXE	High8.8	—	12.4%	Apr 8, 2019
39Monitor	CVE-2019-0765No exploit	A remote code execution vulnerability exists in the way that comctl32.dll handles objects in memory, aka 'Comctl32 Remote Code Execution Vulmicrosoft · windows 10 · CWE-787 pre-auth RCE Memory safety	High8.8	—	14.3%	Apr 8, 2019
32Monitor	CVE-2019-0768Proof of concept	A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under spmicrosoft · internet explorer · CWE-20 Pre-auth	Medium4.3	—	48.5%	Apr 8, 2019
33Monitor	CVE-2019-0769No exploit	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptinmicrosoft · chakracore · CWE-787 pre-auth RCE Memory safety	High7.5	—	10.3%	Apr 8, 2019
33Monitor	CVE-2019-0771No exploit	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptinmicrosoft · chakracore · CWE-787 pre-auth RCE Memory safety	High7.5	—	10.3%	Apr 8, 2019
39Monitor	CVE-2019-0772No exploit	A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remmicrosoft · windows 10 · CWE-787 pre-auth RCE Memory safety	High8.8	—	13.1%	Apr 8, 2019
33Monitor	CVE-2019-0773No exploit	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptinmicrosoft · chakracore · CWE-787 pre-auth RCE Memory safety	High7.5	—	10.3%	Apr 8, 2019
62This week	CVE-2019-0797Weaponized	An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k microsoft · windows 10 1507 Local privilege escalation	High7.8	KEV	1.8%	Apr 8, 2019
77This week	CVE-2019-0808Weaponized	An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k microsoft · windows 7 Local privilege escalation	High7.8	KEV	53.0%	Apr 8, 2019
34Monitor	CVE-2019-0809No exploit	A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading microsoft · visual studio 2017 · CWE-426 RCE	High7.8	—	10.5%	Apr 8, 2019
33Monitor	CVE-2019-0739No exploit	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptinmicrosoft · edge · CWE-787 pre-auth RCE Memory safety	High7.5	—	11.1%	Apr 9, 2019
85Now	CVE-2019-0752Weaponized	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripmicrosoft · internet explorer · CWE-843 pre-auth RCE	High7.5	KEV	81.6%	Apr 9, 2019
40Plan	CVE-2019-0790No exploit	A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Codemicrosoft · windows 10 · CWE-611 pre-auth RCE XXE	High8.8	—	16.2%	Apr 9, 2019
40Plan	CVE-2019-0791No exploit	A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Codemicrosoft · windows 10 · CWE-611 pre-auth RCE XXE	High8.8	—	18.1%	Apr 9, 2019
40Plan	CVE-2019-0792No exploit	A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Codemicrosoft · windows 10 · CWE-611 pre-auth RCE XXE	High8.8	—	18.1%	Apr 9, 2019
40Plan	CVE-2019-0793No exploit	A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Codemicrosoft · windows 10 · CWE-611 pre-auth RCE XXE	High8.8	—	18.1%	Apr 9, 2019
40Plan	CVE-2019-0794No exploit	A remote code execution vulnerability exists when OLE automation improperly handles objects in memory, aka 'OLE Automation Remote Code Execumicrosoft · windows 10 pre-auth RCE	High8.8	—	15.4%	Apr 9, 2019
41Plan	CVE-2019-0795No exploit	A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Codemicrosoft · windows 10 · CWE-611 pre-auth RCE XXE	High8.8	—	21.3%	Apr 9, 2019
37Monitor	CVE-2019-0801No exploit	A remote code execution vulnerability exists when Microsoft Office fails to properly handle certain files.To exploit the vulnerability, an amicrosoft · office · CWE-19 RCE	High7.8	—	18.5%	Apr 9, 2019
75This week	CVE-2019-0803Weaponized	An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k microsoft · windows 10 1507 Local privilege escalation	High7.8	KEV	45.2%	Apr 9, 2019
33Monitor	CVE-2019-0810No exploit	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Cmicrosoft · chakracore · CWE-787 pre-auth RCE Memory safety	High7.5	—	11.5%	Apr 9, 2019
36Monitor	CVE-2019-0812No exploit	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Cmicrosoft · chakracore · CWE-787 pre-auth RCE Memory safety	High7.5	—	18.6%	Apr 9, 2019
35Monitor	CVE-2019-0822No exploit	A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphicsmicrosoft · office RCE	High7.8	—	13.7%	Apr 9, 2019
34Monitor	CVE-2019-0823No exploit	A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka microsoft · office RCE	High7.8	—	10.5%	Apr 9, 2019
34Monitor	CVE-2019-0824No exploit	A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka microsoft · office RCE	High7.8	—	10.5%	Apr 9, 2019
34Monitor	CVE-2019-0825No exploit	A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka microsoft · office RCE	High7.8	—	10.5%	Apr 9, 2019
34Monitor	CVE-2019-0826No exploit	A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka microsoft · office RCE	High7.8	—	10.5%	Apr 9, 2019
34Monitor	CVE-2019-0827No exploit	A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka microsoft · office RCE	High7.8	—	10.5%	Apr 9, 2019
35Monitor	CVE-2019-0828No exploit	A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'microsoft · excel RCE	High7.8	—	13.7%	Apr 9, 2019
73This week	CVE-2019-0841Weaponized	An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elmicrosoft · windows 10 1703 · CWE-59 Local privilege escalation	High7.8	KEV	41.4%	Apr 9, 2019
40Plan	CVE-2019-0842No exploit	A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remmicrosoft · windows 10 · CWE-787 pre-auth RCE Memory safety	High8.8	—	18.0%	Apr 9, 2019
39Monitor	CVE-2019-0845No exploit	A remote code execution vulnerability exists when the IOleCvt interface renders ASP webpage content, aka 'Windows IOleCvt Interface Remote Cmicrosoft · windows 10 pre-auth RCE	High8.8	—	14.8%	Apr 9, 2019
36Monitor	CVE-2019-0846No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	16.1%	Apr 9, 2019
36Monitor	CVE-2019-0847No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	16.1%	Apr 9, 2019
36Monitor	CVE-2019-0851No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	16.1%	Apr 9, 2019
44Plan	CVE-2019-0853No exploit	A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka microsoft · windows 10 · CWE-824 pre-auth RCE Memory safety	High8.8	—	30.0%	Apr 9, 2019
34Monitor	CVE-2019-0856No exploit	A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Remote Code Execution Vulnerabimicrosoft · windows 10 RCE	High7.2	—	19.4%	Apr 9, 2019
62This week	CVE-2019-0859Weaponized	An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k microsoft · windows 10 1507 Local privilege escalation	High7.8	KEV	4.1%	Apr 9, 2019
33Monitor	CVE-2019-0860No exploit	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Cmicrosoft · edge · CWE-787 pre-auth RCE Memory safety	High7.5	—	10.7%	Apr 9, 2019
33Monitor	CVE-2019-0861No exploit	A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Cmicrosoft · edge · CWE-787 pre-auth RCE Memory safety	High7.5	—	11.1%	Apr 9, 2019
33Monitor	CVE-2019-0862No exploit	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripmicrosoft · internet explorer · CWE-787 pre-auth RCE Memory safety	High7.5	—	11.1%	Apr 9, 2019
29Monitor	CVE-2019-8456No exploit	Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configurationcheckpoint · ipsec vpn · CWE-284 Pre-auth Broken access control (IDOR)	Medium5.9	—	20.3%	Apr 9, 2019
52Plan	CVE-2019-0199No exploit	The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS framesapache · tomcat · CWE-400 Pre-auth Denial of service	High7.5	—	72.8%	Apr 10, 2019
43Plan	CVE-2019-4013Proof of concept	IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges.ibm · bigfix platform · CWE-434 File upload	Critical9.9	—	13.0%	Apr 10, 2019
45Plan	CVE-2019-7139Proof of concept	An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data magento · magento · CWE-89 Pre-auth SQL injection	Critical9.8	—	18.3%	Apr 10, 2019
51Plan	CVE-2019-10945Proof of concept	An issue was discovered in Joomla! before 3.9.5.joomla · joomla\! · CWE-22 Pre-auth Path traversal	Critical9.8	—	40.2%	Apr 10, 2019
41Plan	CVE-2019-11068No exploit	libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon rxmlsoft · libxslt Pre-auth	Critical9.8	—	5.2%	Apr 10, 2019
61This week	CVE-2019-11072No exploit	lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) orlighttpd · lighttpd · CWE-190 Pre-auth Memory safety	Critical9.8	—	73.7%	Apr 10, 2019
37Monitor	CVE-2019-3914No exploit	Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a remote, authenticated averizon · fios quantum gateway g1100 firmware · CWE-78 RCE Command injection	High7.2	—	29.8%	Apr 11, 2019
61This week	CVE-2018-19300No exploit	On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware versiond-link · dap-1530 firmware · CWE-20 pre-auth RCE	Critical9.8	—	74.2%	Apr 11, 2019
55Plan	CVE-2019-9733Proof of concept	An issue was discovered in JFrog Artifactory 6.7.3.jfrog · artifactory Pre-auth Hard-coded credentials	Critical9.8	—	53.8%	Apr 11, 2019
51Plan	CVE-2019-11229Proof of concept	models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.gitea · gitea RCE	High8.8	—	54.9%	Apr 15, 2019
62This week	CVE-2019-0232Weaponized	When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 apache · tomcat · CWE-78 pre-auth RCE Command injection	High8.1	—	99.9%	Apr 15, 2019
94Now	CVE-2019-3398Weaponized	Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource.atlassian · confluence server · CWE-22 RCE Path traversal	High8.8	KEV	97.0%	Apr 18, 2019
37Monitor	CVE-2019-3719Proof of concept	Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability.dell · supportassist pre-auth RCE	High8.0	—	16.2%	Apr 18, 2019
38Monitor	CVE-2019-11354Proof of concept	The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler.ea · origin · CWE-74 RCE SSTI	High7.8	—	23.1%	Apr 19, 2019
50Plan	CVE-2019-11358Proof of concept	jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototypjquery · jquery · CWE-1321 Pre-auth Prototype pollution	Medium6.1	—	86.8%	Apr 19, 2019
43Plan	CVE-2019-11395Proof of concept	A buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long string, as demonstrated by SMTP RCPT TO, tabslab · mailcarrier · CWE-787 pre-auth RCE Memory safety	Critical9.8	—	14.5%	Apr 22, 2019
34Monitor	CVE-2019-11415Proof of concept	An issue was discovered on Intelbras IWR 3000N 1.5.0 devices.intelbras · iwr 3000n firmware Pre-auth Denial of service	High7.5	—	13.7%	Apr 22, 2019
32Monitor	CVE-2019-11444Proof of concept	An issue was discovered in Liferay Portal CE 7.1.2 GA3.liferay · liferay portal · CWE-78 RCE Command injection	High7.2	—	12.5%	Apr 22, 2019
32Monitor	CVE-2019-11445Proof of concept	OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home dopenkm · openkm · CWE-434 RCE File upload	High7.2	—	14.2%	Apr 22, 2019
51Plan	CVE-2019-11447Proof of concept	An issue was discovered in CutePHP CuteNews 2.1.2.cutephp · cutenews · CWE-434 File upload	High8.8	—	52.5%	Apr 22, 2019
43Plan	CVE-2019-11448Proof of concept	An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0.zohocorp · manageengine applications manager · CWE-89 Pre-auth SQL injection	Critical9.8	—	12.4%	Apr 22, 2019
30Monitor	CVE-2019-9955Proof of concept	On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN,zyxel · atp200 firmware · CWE-79 Pre-auth XSS	Medium6.1	—	21.1%	Apr 22, 2019
44Plan	CVE-2019-11469Proof of concept	Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection.zohocorp · manageengine applications manager · CWE-89 Pre-auth SQL injection	Critical9.8	—	16.9%	Apr 23, 2019
57Plan	CVE-2019-7304Proof of concept	Local privilege escalation via snapd socketcanonical · snapd · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.8	—	60.8%	Apr 23, 2019
27Monitor	CVE-2019-2557Weaponized	Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Products Suite (subcomponent: Load Testing for oracle · application testing suite	Medium6.3	—	5.4%	Apr 23, 2019
56Plan	CVE-2019-2578Proof of concept	Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI).oracle · webcenter sites Pre-auth	High8.6	—	72.4%	Apr 23, 2019
30Monitor	CVE-2019-2588Proof of concept	Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).oracle · business intelligence publisher	Medium4.9	—	36.7%	Apr 23, 2019
86Now	CVE-2019-2616Weaponized	Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).oracle · business intelligence publisher Pre-auth	High7.2	KEV	91.8%	Apr 23, 2019
32Monitor	CVE-2019-2618Proof of concept	Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).oracle · weblogic server	Medium5.5	—	32.8%	Apr 23, 2019

CVE-2019-1002100
31Monitor
In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Se
MediumCVSS 6.5No exploitEPSS 16%
- Denial of service
kubernetes · kubernetesApr 1, 2019
CVE-2019-1002101
26Monitor
kubectl cp path traversal
MediumCVSS 5.5Proof of conceptEPSS 12%
- Path traversal
kubernetes · kubernetesApr 1, 2019
CVE-2019-6715
36Monitor
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via the SubscribeURL fie
HighCVSS 7.5Proof of conceptEPSS 19%
- Pre-auth
boldgrid · w3 total cacheApr 1, 2019
CVE-2019-9193
55Plan
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to
HighCVSS 7.2WeaponizedEPSS 91%
- RCE
- Command injection
postgresql · postgresqlApr 1, 2019
CVE-2019-10692
62This week
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before
CriticalCVSS 9.8WeaponizedEPSS 77%
- Pre-auth
- SQL injection
codecabin · wp go mapsApr 2, 2019
CVE-2018-4314
38Monitor
A use after free issue was addressed with improved memory management.
HighCVSS 8.8Proof of conceptEPSS 10%
- Pre-auth
- Memory safety
apple · safariApr 3, 2019
CVE-2018-4344
62This week
A memory corruption issue was addressed with improved memory handling.
HighCVSS 7.8KEVWeaponizedEPSS 2%
- Memory safety
apple · iphone osApr 3, 2019
CVE-2018-4407
41Plan
A memory corruption issue was addressed with improved validation.
HighCVSS 8.8Proof of conceptEPSS 21%
- Memory safety
apple · iphone osApr 3, 2019
CVE-2018-4416
46Plan
Multiple memory corruption issues were addressed with improved memory handling.
HighCVSS 8.8Proof of conceptEPSS 35%
- Pre-auth
- Memory safety
apple · safariApr 3, 2019
CVE-2018-4441
39Monitor
A memory corruption issue was addressed with improved memory handling.
HighCVSS 8.8Proof of conceptEPSS 12%
- Pre-auth
- Memory safety
apple · safariApr 3, 2019
CVE-2019-10863
32Monitor
A command injection vulnerability exists in TeemIp versions before 2.4.0.
HighCVSS 7.2Proof of conceptEPSS 13%
- RCE
- Command injection
combodo · teemipApr 4, 2019
CVE-2019-10867
56Plan
An issue was discovered in Pimcore before 5.7.1.
HighCVSS 8.8WeaponizedEPSS 68%
- Deserialization
pimcore · pimcoreApr 4, 2019
CVE-2019-6553
59Plan
A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior.
CriticalCVSS 9.8No exploitEPSS 66%
- Pre-auth
- Memory safety
rockwellautomation · rslinxApr 4, 2019
CVE-2019-11001
69This week
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" function
HighCVSS 7.2KEVWeaponizedEPSS 37%
- RCE
- Command injection
reolink · rlc-410w firmwareApr 8, 2019
CVE-2019-0215
33Monitor
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3
HighCVSS 7.5No exploitEPSS 10%
apache · http serverApr 8, 2019
CVE-2019-0217
35Monitor
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user
HighCVSS 7.5Proof of conceptEPSS 17%
- Race condition
apache · http serverApr 8, 2019
CVE-2019-0211
81Now
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or
HighCVSS 7.8KEVWeaponizedEPSS 65%
- RCE
- Local privilege escalation
- Memory safety
apache · http serverApr 8, 2019
CVE-2019-0592
37Monitor
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C
HighCVSS 7.5No exploitEPSS 22%
- pre-auth RCE
- Memory safety
microsoft · chakracoreApr 8, 2019
CVE-2019-0603
40Plan
A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory.
HighCVSS 7.5No exploitEPSS 34%
- RCE
microsoft · windows 10Apr 8, 2019
CVE-2019-0612
24Monitor
A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects.
MediumCVSS 5.3Proof of conceptEPSS 10%
- pre-auth RCE
microsoft · edgeApr 8, 2019
CVE-2019-0617
37Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 19%
- RCE
microsoft · windows 10Apr 8, 2019
CVE-2019-0639
34Monitor
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engin
HighCVSS 7.5No exploitEPSS 12%
- pre-auth RCE
- Memory safety
microsoft · internet explorerApr 8, 2019
CVE-2019-0666
36Monitor
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Rem
HighCVSS 7.5No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · internet explorerApr 8, 2019
CVE-2019-0667
39Monitor
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Rem
HighCVSS 7.5Proof of conceptEPSS 31%
- pre-auth RCE
- Memory safety
microsoft · internet explorerApr 8, 2019
CVE-2019-0697
49Plan
A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka
CriticalCVSS 9.8No exploitEPSS 32%
- pre-auth RCE
- Memory safety
microsoft · windows 10Apr 8, 2019
CVE-2019-0698
58Plan
A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka
CriticalCVSS 9.8No exploitEPSS 62%
- pre-auth RCE
- Memory safety
microsoft · windows 10Apr 8, 2019
CVE-2019-0703
59Plan
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information
MediumCVSS 6.5KEVWeaponizedEPSS 9%
microsoft · windows 10 1507Apr 8, 2019
CVE-2019-0726
55Plan
A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka
CriticalCVSS 9.8No exploitEPSS 54%
- pre-auth RCE
- Memory safety
microsoft · windows 10Apr 8, 2019
CVE-2019-0748
35Monitor
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · officeApr 8, 2019
CVE-2019-0756
39Monitor
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code
HighCVSS 8.8No exploitEPSS 12%
- pre-auth RCE
- XXE
microsoft · windows 10Apr 8, 2019
CVE-2019-0765
39Monitor
A remote code execution vulnerability exists in the way that comctl32.dll handles objects in memory, aka 'Comctl32 Remote Code Execution Vul
HighCVSS 8.8No exploitEPSS 14%
- pre-auth RCE
- Memory safety
microsoft · windows 10Apr 8, 2019
CVE-2019-0768
32Monitor
A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under sp
MediumCVSS 4.3Proof of conceptEPSS 48%
- Pre-auth
microsoft · internet explorerApr 8, 2019
CVE-2019-0769
33Monitor
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptin
HighCVSS 7.5No exploitEPSS 10%
- pre-auth RCE
- Memory safety
microsoft · chakracoreApr 8, 2019
CVE-2019-0771
33Monitor
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptin
HighCVSS 7.5No exploitEPSS 10%
- pre-auth RCE
- Memory safety
microsoft · chakracoreApr 8, 2019
CVE-2019-0772
39Monitor
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Rem
HighCVSS 8.8No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · windows 10Apr 8, 2019
CVE-2019-0773
33Monitor
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptin
HighCVSS 7.5No exploitEPSS 10%
- pre-auth RCE
- Memory safety
microsoft · chakracoreApr 8, 2019
CVE-2019-0797
62This week
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k
HighCVSS 7.8KEVWeaponizedEPSS 1%
- Local privilege escalation
microsoft · windows 10 1507Apr 8, 2019
CVE-2019-0808
77This week
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k
HighCVSS 7.8KEVWeaponizedEPSS 53%
- Local privilege escalation
microsoft · windows 7Apr 8, 2019
CVE-2019-0809
34Monitor
A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading
HighCVSS 7.8No exploitEPSS 10%
- RCE
microsoft · visual studio 2017Apr 8, 2019
CVE-2019-0739
33Monitor
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptin
HighCVSS 7.5No exploitEPSS 11%
- pre-auth RCE
- Memory safety
microsoft · edgeApr 9, 2019
CVE-2019-0752
85Now
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip
HighCVSS 7.5KEVWeaponizedEPSS 81%
- pre-auth RCE
microsoft · internet explorerApr 9, 2019
CVE-2019-0790
40Plan
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code
HighCVSS 8.8No exploitEPSS 16%
- pre-auth RCE
- XXE
microsoft · windows 10Apr 9, 2019
CVE-2019-0791
40Plan
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code
HighCVSS 8.8No exploitEPSS 18%
- pre-auth RCE
- XXE
microsoft · windows 10Apr 9, 2019
CVE-2019-0792
40Plan
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code
HighCVSS 8.8No exploitEPSS 18%
- pre-auth RCE
- XXE
microsoft · windows 10Apr 9, 2019
CVE-2019-0793
40Plan
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code
HighCVSS 8.8No exploitEPSS 18%
- pre-auth RCE
- XXE
microsoft · windows 10Apr 9, 2019
CVE-2019-0794
40Plan
A remote code execution vulnerability exists when OLE automation improperly handles objects in memory, aka 'OLE Automation Remote Code Execu
HighCVSS 8.8No exploitEPSS 15%
- pre-auth RCE
microsoft · windows 10Apr 9, 2019
CVE-2019-0795
41Plan
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code
HighCVSS 8.8No exploitEPSS 21%
- pre-auth RCE
- XXE
microsoft · windows 10Apr 9, 2019
CVE-2019-0801
37Monitor
A remote code execution vulnerability exists when Microsoft Office fails to properly handle certain files.To exploit the vulnerability, an a
HighCVSS 7.8No exploitEPSS 18%
- RCE
microsoft · officeApr 9, 2019
CVE-2019-0803
75This week
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k
HighCVSS 7.8KEVWeaponizedEPSS 45%
- Local privilege escalation
microsoft · windows 10 1507Apr 9, 2019
CVE-2019-0810
33Monitor
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C
HighCVSS 7.5No exploitEPSS 11%
- pre-auth RCE
- Memory safety
microsoft · chakracoreApr 9, 2019
CVE-2019-0812
36Monitor
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C
HighCVSS 7.5No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · chakracoreApr 9, 2019
CVE-2019-0822
35Monitor
A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · officeApr 9, 2019
CVE-2019-0823
34Monitor
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka
HighCVSS 7.8No exploitEPSS 10%
- RCE
microsoft · officeApr 9, 2019
CVE-2019-0824
34Monitor
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka
HighCVSS 7.8No exploitEPSS 10%
- RCE
microsoft · officeApr 9, 2019
CVE-2019-0825
34Monitor
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka
HighCVSS 7.8No exploitEPSS 10%
- RCE
microsoft · officeApr 9, 2019
CVE-2019-0826
34Monitor
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka
HighCVSS 7.8No exploitEPSS 10%
- RCE
microsoft · officeApr 9, 2019
CVE-2019-0827
34Monitor
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka
HighCVSS 7.8No exploitEPSS 10%
- RCE
microsoft · officeApr 9, 2019
CVE-2019-0828
35Monitor
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · excelApr 9, 2019
CVE-2019-0841
73This week
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows El
HighCVSS 7.8KEVWeaponizedEPSS 41%
- Local privilege escalation
microsoft · windows 10 1703Apr 9, 2019
CVE-2019-0842
40Plan
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Rem
HighCVSS 8.8No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · windows 10Apr 9, 2019
CVE-2019-0845
39Monitor
A remote code execution vulnerability exists when the IOleCvt interface renders ASP webpage content, aka 'Windows IOleCvt Interface Remote C
HighCVSS 8.8No exploitEPSS 14%
- pre-auth RCE
microsoft · windows 10Apr 9, 2019
CVE-2019-0846
36Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 16%
- RCE
microsoft · windows 10Apr 9, 2019
CVE-2019-0847
36Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 16%
- RCE
microsoft · windows 10Apr 9, 2019
CVE-2019-0851
36Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 16%
- RCE
microsoft · windows 10Apr 9, 2019
CVE-2019-0853
44Plan
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka
HighCVSS 8.8No exploitEPSS 30%
- pre-auth RCE
- Memory safety
microsoft · windows 10Apr 9, 2019
CVE-2019-0856
34Monitor
A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Remote Code Execution Vulnerabi
HighCVSS 7.2No exploitEPSS 19%
- RCE
microsoft · windows 10Apr 9, 2019
CVE-2019-0859
62This week
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k
HighCVSS 7.8KEVWeaponizedEPSS 4%
- Local privilege escalation
microsoft · windows 10 1507Apr 9, 2019
CVE-2019-0860
33Monitor
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C
HighCVSS 7.5No exploitEPSS 10%
- pre-auth RCE
- Memory safety
microsoft · edgeApr 9, 2019
CVE-2019-0861
33Monitor
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C
HighCVSS 7.5No exploitEPSS 11%
- pre-auth RCE
- Memory safety
microsoft · edgeApr 9, 2019
CVE-2019-0862
33Monitor
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip
HighCVSS 7.5No exploitEPSS 11%
- pre-auth RCE
- Memory safety
microsoft · internet explorerApr 9, 2019
CVE-2019-8456
29Monitor
Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration
MediumCVSS 5.9No exploitEPSS 20%
- Pre-auth
- Broken access control (IDOR)
checkpoint · ipsec vpnApr 9, 2019
CVE-2019-0199
52Plan
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames
HighCVSS 7.5No exploitEPSS 72%
- Pre-auth
- Denial of service
apache · tomcatApr 10, 2019
CVE-2019-4013
43Plan
IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges.
CriticalCVSS 9.9Proof of conceptEPSS 13%
- File upload
ibm · bigfix platformApr 10, 2019
CVE-2019-7139
45Plan
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data
CriticalCVSS 9.8Proof of conceptEPSS 18%
- Pre-auth
- SQL injection
magento · magentoApr 10, 2019
CVE-2019-10945
51Plan
An issue was discovered in Joomla! before 3.9.5.
CriticalCVSS 9.8Proof of conceptEPSS 40%
- Pre-auth
- Path traversal
joomla · joomla\!Apr 10, 2019
CVE-2019-11068
41Plan
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon r
CriticalCVSS 9.8No exploitEPSS 5%
- Pre-auth
xmlsoft · libxsltApr 10, 2019
CVE-2019-11072
61This week
lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or
CriticalCVSS 9.8No exploitEPSS 73%
- Pre-auth
- Memory safety
lighttpd · lighttpdApr 10, 2019
CVE-2019-3914
37Monitor
Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a remote, authenticated a
HighCVSS 7.2No exploitEPSS 29%
- RCE
- Command injection
verizon · fios quantum gateway g1100 firmwareApr 11, 2019
CVE-2018-19300
61This week
On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version
CriticalCVSS 9.8No exploitEPSS 74%
- pre-auth RCE
d-link · dap-1530 firmwareApr 11, 2019
CVE-2019-9733
55Plan
An issue was discovered in JFrog Artifactory 6.7.3.
CriticalCVSS 9.8Proof of conceptEPSS 53%
- Pre-auth
- Hard-coded credentials
jfrog · artifactoryApr 11, 2019
CVE-2019-11229
51Plan
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.
HighCVSS 8.8Proof of conceptEPSS 54%
- RCE
gitea · giteaApr 15, 2019
CVE-2019-0232
62This week
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0
HighCVSS 8.1WeaponizedEPSS 99%
- pre-auth RCE
- Command injection
apache · tomcatApr 15, 2019
CVE-2019-3398
94Now
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource.
HighCVSS 8.8KEVWeaponizedEPSS 97%
- RCE
- Path traversal
atlassian · confluence serverApr 18, 2019
CVE-2019-3719
37Monitor
Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability.
HighCVSS 8.0Proof of conceptEPSS 16%
- pre-auth RCE
dell · supportassistApr 18, 2019
CVE-2019-11354
38Monitor
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler.
HighCVSS 7.8Proof of conceptEPSS 23%
- RCE
- SSTI
ea · originApr 19, 2019
CVE-2019-11358
50Plan
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototyp
MediumCVSS 6.1Proof of conceptEPSS 86%
- Pre-auth
- Prototype pollution
jquery · jqueryApr 19, 2019
CVE-2019-11395
43Plan
A buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long string, as demonstrated by SMTP RCPT TO,
CriticalCVSS 9.8Proof of conceptEPSS 14%
- pre-auth RCE
- Memory safety
tabslab · mailcarrierApr 22, 2019
CVE-2019-11415
34Monitor
An issue was discovered on Intelbras IWR 3000N 1.5.0 devices.
HighCVSS 7.5Proof of conceptEPSS 13%
- Pre-auth
- Denial of service
intelbras · iwr 3000n firmwareApr 22, 2019
CVE-2019-11444
32Monitor
An issue was discovered in Liferay Portal CE 7.1.2 GA3.
HighCVSS 7.2Proof of conceptEPSS 12%
- RCE
- Command injection
liferay · liferay portalApr 22, 2019
CVE-2019-11445
32Monitor
OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home d
HighCVSS 7.2Proof of conceptEPSS 14%
- RCE
- File upload
openkm · openkmApr 22, 2019
CVE-2019-11447
51Plan
An issue was discovered in CutePHP CuteNews 2.1.2.
HighCVSS 8.8Proof of conceptEPSS 52%
- File upload
cutephp · cutenewsApr 22, 2019
CVE-2019-11448
43Plan
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0.
CriticalCVSS 9.8Proof of conceptEPSS 12%
- Pre-auth
- SQL injection
zohocorp · manageengine applications managerApr 22, 2019
CVE-2019-9955
30Monitor
On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN,
MediumCVSS 6.1Proof of conceptEPSS 21%
- Pre-auth
- XSS
zyxel · atp200 firmwareApr 22, 2019
CVE-2019-11469
44Plan
Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection.
CriticalCVSS 9.8Proof of conceptEPSS 16%
- Pre-auth
- SQL injection
zohocorp · manageengine applications managerApr 23, 2019
CVE-2019-7304
57Plan
Local privilege escalation via snapd socket
CriticalCVSS 9.8Proof of conceptEPSS 60%
- Pre-auth
- Broken access control (IDOR)
canonical · snapdApr 23, 2019
CVE-2019-2557
27Monitor
Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Products Suite (subcomponent: Load Testing for
MediumCVSS 6.3WeaponizedEPSS 5%
oracle · application testing suiteApr 23, 2019
CVE-2019-2578
56Plan
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI).
HighCVSS 8.6Proof of conceptEPSS 72%
- Pre-auth
oracle · webcenter sitesApr 23, 2019
CVE-2019-2588
30Monitor
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).
MediumCVSS 4.9Proof of conceptEPSS 36%
oracle · business intelligence publisherApr 23, 2019
CVE-2019-2616
86Now
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security).
HighCVSS 7.2KEVWeaponizedEPSS 91%
- Pre-auth
oracle · business intelligence publisherApr 23, 2019
CVE-2019-2618
32Monitor
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components).
MediumCVSS 5.5Proof of conceptEPSS 32%
oracle · weblogic serverApr 23, 2019