Skip to content
Noroxi
By publication date

Exploited and new serious CVEs: April 2019

122 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2019-2649
    41Plan

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services).

    HighCVSS 7.5No exploitEPSS 36%

    oracle · weblogic serverApr 23, 2019

  • CVE-2019-2650
    42Plan

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services).

    HighCVSS 7.5No exploitEPSS 39%

    oracle · weblogic serverApr 23, 2019

  • CVE-2019-2684
    34Monitor

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI).

    MediumCVSS 5.9No exploitEPSS 37%

    oracle · jdkApr 23, 2019

  • CVE-2019-2697
    35Monitor

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D).

    HighCVSS 8.1Proof of conceptEPSS 11%

    oracle · jdkApr 23, 2019

  • CVE-2019-2698
    36Monitor

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D).

    HighCVSS 8.1Proof of conceptEPSS 12%

    oracle · jdkApr 23, 2019

  • CVE-2019-7213
    38Monitor

    SmarterTools SmarterMail 16.x before build 6985 allows directory traversal.

    MediumCVSS 6.5Proof of conceptEPSS 41%

    smartertools · smartermailApr 24, 2019

  • CVE-2019-7214
    64This week

    SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data.

    CriticalCVSS 9.8WeaponizedEPSS 84%

    smartertools · smartermailApr 24, 2019

  • CVE-2019-10008
    41Plan

    Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically co

    HighCVSS 8.8Proof of conceptEPSS 19%

    zohocorp · servicedesk plusApr 24, 2019

  • CVE-2018-20434
    60This week

    LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.

    CriticalCVSS 9.8WeaponizedEPSS 71%

    librenms · librenmsApr 24, 2019

  • CVE-2018-16660
    40Plan

    A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated acces

    HighCVSS 8.8WeaponizedEPSS 17%

    imperva · securesphereApr 25, 2019

  • CVE-2019-3721
    31Monitor

    Improper Range Header Processing Vulnerability

    HighCVSS 7.5No exploitEPSS 2%

    dell · emc openmanage server administratorApr 25, 2019

  • CVE-2019-11539
    88Now

    In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 an

    HighCVSS 7.2KEVWeaponizedEPSS 98%

    ivanti · connect secureApr 25, 2019

  • CVE-2019-11542
    48Plan

    In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 an

    HighCVSS 7.2No exploitEPSS 65%

    ivanti · connect secureApr 25, 2019

  • CVE-2019-0186
    30Monitor

    The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks.

    MediumCVSS 6.1Proof of conceptEPSS 20%

    apache · plutoApr 26, 2019

  • CVE-2019-9791
    45Plan

    The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    mozilla · firefoxApr 26, 2019

  • CVE-2019-9792
    43Plan

    The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    mozilla · firefoxApr 26, 2019

  • CVE-2019-9810
    43Plan

    Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflo

    HighCVSS 8.8Proof of conceptEPSS 27%

    mozilla · firefoxApr 26, 2019

  • CVE-2019-2725
    99Now

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    oracle · agile product lifecycle managementApr 26, 2019

  • CVE-2019-11577
    55Plan

    dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses.

    CriticalCVSS 9.8No exploitEPSS 53%

    dhcpcd project · dhcpcdApr 28, 2019

  • CVE-2019-9621
    84Now

    Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3

    HighCVSS 7.5KEVWeaponizedEPSS 81%

    synacor · zimbra collaboration suiteApr 30, 2019

  • CVE-2019-3929
    99Now

    The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    crestron · am-100 firmwareApr 30, 2019

  • CVE-2019-3932
    50Plan

    Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to authentication bypass due to a hard-coded password

    CriticalCVSS 9.8No exploitEPSS 36%

    crestron · am-100 firmwareApr 30, 2019