By publication date

Exploited and new serious CVEs: May 2019

110 records · 14 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
58Plan	CVE-2019-0227Proof of concept	A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.apache · axis · CWE-918 Pre-auth SSRF	High7.5	—	91.9%	May 1, 2019
97Now	CVE-2017-18368Weaponized	The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability inzyxel · p660hn-t1a v2 firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	KEV	94.5%	May 2, 2019
60This week	CVE-2017-18369Weaponized	The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwardinbillion · 5200w-t firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	67.6%	May 2, 2019
42Plan	CVE-2017-18370Weaponized	The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Logzyxel · p660hn-t1a v2 firmware · CWE-78 RCE Command injection	High8.8	—	24.4%	May 2, 2019
60This week	CVE-2017-18371Weaponized	The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two zyxel · p660hn-t1a v2 firmware · CWE-798 pre-auth RCE Hard-coded credentials Command injection	Critical9.8	—	22.5%	May 2, 2019
42Plan	CVE-2017-18372Weaponized	The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Settibillion · 5200w-t firmware · CWE-78 RCE Command injection	High8.8	—	21.8%	May 2, 2019
36Monitor	CVE-2018-12404No exploit	A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content.mozilla · network security services Pre-auth	Medium5.9	—	44.2%	May 2, 2019
36Monitor	CVE-2019-9017Proof of concept	DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name.solarwinds · dameware mini remote control · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	19.2%	May 2, 2019
35Monitor	CVE-2018-20824Proof of concept	The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site atlassian · jira · CWE-79 Pre-auth XSS	Medium6.1	—	37.9%	May 3, 2019
60This week	CVE-2019-3799Weaponized	Directory Traversal with spring-cloud-config-servervmware · spring cloud config · CWE-22 Pre-auth Path traversal	Medium6.5	—	85.2%	May 6, 2019
56Plan	CVE-2019-5434Proof of concept	An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" pararevive-sas · revive adserver · CWE-502 Pre-auth Deserialization	Critical9.8	—	57.0%	May 6, 2019
41Plan	CVE-2018-4061No exploit	An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.sierrawireless · airlink es450 firmware · CWE-78 RCE Command injection	High8.8	—	19.4%	May 6, 2019
24Monitor	CVE-2018-4068No exploit	An exploitable information disclosure vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3.sierrawireless · airlink es450 firmware · CWE-200 Pre-auth Info leak	Medium5.3	—	11.3%	May 6, 2019
73This week	CVE-2018-4063Weaponized	An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3.sierrawireless · aleos · CWE-434 RCE File upload	High8.8	KEV	27.2%	May 6, 2019
40Plan	CVE-2018-4070No exploit	An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLinsierrawireless · airlink es450 firmware · CWE-200 Info leak	High8.8	—	17.9%	May 6, 2019
40Plan	CVE-2018-4071No exploit	An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLinsierrawireless · airlink es450 firmware · CWE-200 Info leak	High8.8	—	18.3%	May 6, 2019
43Plan	CVE-2018-4072No exploit	An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLinksierrawireless · airlink es450 firmware · CWE-732	High8.8	—	26.4%	May 6, 2019
43Plan	CVE-2018-4073No exploit	An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLinksierrawireless · airlink es450 firmware · CWE-732	High8.8	—	25.6%	May 6, 2019
44Plan	CVE-2018-14485Proof of concept	BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.blogengine · blogengine.net · CWE-611 Pre-auth XXE	Critical9.8	—	16.2%	May 7, 2019
56Plan	CVE-2019-8387Proof of concept	MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.barni · master ip camera01 firmware pre-auth RCE	Critical9.8	—	55.7%	May 8, 2019
32Monitor	CVE-2019-11508No exploit	In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticateivanti · connect secure · CWE-22 RCE Path traversal	High7.2	—	14.6%	May 8, 2019
100Now	CVE-2019-11510Weaponized	In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attackivanti · connect secure · CWE-22 Pre-auth Path traversal	Critical10.0	KEV	99.9%	May 8, 2019
51Plan	CVE-2019-7442Proof of concept	An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remotcyberark · enterprise password vault · CWE-611 Pre-auth Auth bypass XXE	Critical9.8	—	40.0%	May 8, 2019
49Plan	CVE-2019-1867No exploit	Cisco Elastic Services Controller REST API Authentication Bypass Vulnerabilitycisco · elastic services controller · CWE-287 pre-auth RCE Auth bypass	Critical10.0	—	30.3%	May 10, 2019
33Monitor	CVE-2018-12296Proof of concept	Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain inforseagate · nas os · CWE-732 Pre-auth Auth bypass	High7.5	—	11.3%	May 13, 2019
47Plan	CVE-2018-14714Proof of concept	System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "loadasus · rt-ac3200 firmware pre-auth RCE Command injection	Critical9.8	—	27.4%	May 13, 2019
51Plan	CVE-2018-19986No exploit	In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.Bd-link · dir-818lw firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	41.6%	May 13, 2019
43Plan	CVE-2018-19987Proof of concept	D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, d-link · dir-818lw firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	12.9%	May 13, 2019
35Monitor	CVE-2019-9726Proof of concept	Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of teq-3 · ccu3 firmware · CWE-22 Pre-auth Path traversal	High7.5	—	16.3%	May 13, 2019
56Plan	CVE-2019-11600Proof of concept	A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands vopenproject · openproject · CWE-89 pre-auth RCE SQL injection	High8.1	—	79.9%	May 13, 2019
52Plan	CVE-2019-9618Proof of concept	The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.gracemedia media player project · gracemedia media player · CWE-22 Pre-auth Path traversal	Critical9.8	—	43.7%	May 13, 2019
78This week	CVE-2019-3568Weaponized	A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a whatsapp · whatsapp · CWE-122 pre-auth RCE Memory safety	Critical9.8	KEV	30.0%	May 14, 2019
96Now	CVE-2018-14839Weaponized	LG N1A1 NAS 3718.510 is affected by: Remote Command Execution.lg · n1a1 firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	KEV	89.3%	May 14, 2019
40Plan	CVE-2019-12099Proof of concept	In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_php-fusion · php-fusion · CWE-434 RCE File upload	High8.8	—	17.2%	May 14, 2019
33Monitor	CVE-2019-1717No exploit	Cisco Video Surveillance Manager Web-Based Management Interface Information Disclosure Vulnerabilitycisco · video surveillance manager · CWE-22 Pre-auth Path traversal	High7.5	—	10.0%	May 15, 2019
64This week	CVE-2013-7285Proof of concept	Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run xstream · xstream · CWE-78 pre-auth RCE Command injection	Critical9.8	—	84.3%	May 15, 2019
30Monitor	CVE-2019-1818No exploit	Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerabilitycisco · evolved programmable network manager · CWE-22 Path traversal	Medium6.5	—	13.6%	May 15, 2019
30Monitor	CVE-2019-1819No exploit	Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerabilitycisco · evolved programmable network manager · CWE-22 Path traversal	Medium6.5	—	13.6%	May 15, 2019
30Monitor	CVE-2019-1820No exploit	Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerabilitycisco · evolved programmable network manager · CWE-22 Path traversal	Medium6.5	—	13.6%	May 15, 2019
68This week	CVE-2019-1821Weaponized	Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilitiescisco · evolved programmable network manager · CWE-20 pre-auth RCE	Critical9.8	—	98.0%	May 15, 2019
99Now	CVE-2019-0708Weaponized	A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attackermicrosoft · windows 7 · CWE-416 pre-auth RCE Memory safety	Critical9.8	KEV	99.9%	May 16, 2019
47Plan	CVE-2019-0725No exploit	A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets, aka 'Windows DHCP Sermicrosoft · windows server 2008 · CWE-787 pre-auth RCE Memory safety	Critical9.8	—	28.2%	May 16, 2019
30Monitor	CVE-2019-0758No exploit	An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows microsoft · windows 10 Pre-auth	Medium6.5	—	12.3%	May 16, 2019
63This week	CVE-2019-0863Weaponized	An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevatiomicrosoft · windows 10 1507 Local privilege escalation	High7.8	KEV	5.2%	May 16, 2019
35Monitor	CVE-2019-0885No exploit	A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code microsoft · windows 10 · CWE-20 RCE	High7.8	—	14.3%	May 16, 2019
37Monitor	CVE-2019-0889No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	20.1%	May 16, 2019
35Monitor	CVE-2019-0890No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	13.7%	May 16, 2019
37Monitor	CVE-2019-0891No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	20.1%	May 16, 2019
35Monitor	CVE-2019-0893No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	13.7%	May 16, 2019
35Monitor	CVE-2019-0894No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	13.7%	May 16, 2019
35Monitor	CVE-2019-0895No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	13.7%	May 16, 2019
35Monitor	CVE-2019-0896No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	13.7%	May 16, 2019
35Monitor	CVE-2019-0897No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	13.7%	May 16, 2019
35Monitor	CVE-2019-0898No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	13.7%	May 16, 2019
37Monitor	CVE-2019-0899No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	20.1%	May 16, 2019
35Monitor	CVE-2019-0900No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	13.7%	May 16, 2019
35Monitor	CVE-2019-0901No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 RCE	High7.8	—	13.7%	May 16, 2019
41Plan	CVE-2019-0902No exploit	A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Enmicrosoft · windows 10 pre-auth RCE	High8.8	—	19.1%	May 16, 2019
72This week	CVE-2019-0903Weaponized	A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka microsoft · windows 10 1507 pre-auth RCE	High8.8	KEV	21.7%	May 16, 2019
37Monitor	CVE-2019-0940No exploit	A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corrmicrosoft · internet explorer · CWE-787 pre-auth RCE Memory safety	High7.5	—	23.1%	May 16, 2019
35Monitor	CVE-2019-0945No exploit	A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka microsoft · office · CWE-19 RCE	High7.8	—	13.6%	May 16, 2019
35Monitor	CVE-2019-0946No exploit	A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka microsoft · office · CWE-19 RCE	High7.8	—	13.6%	May 16, 2019
35Monitor	CVE-2019-0947No exploit	A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka microsoft · office · CWE-19 RCE	High7.8	—	13.6%	May 16, 2019
35Monitor	CVE-2019-0953No exploit	A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Wmicrosoft · office RCE	High7.8	—	12.9%	May 16, 2019
20Monitor	CVE-2019-8925Proof of concept	An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.zohocorp · manageengine netflow analyzer · CWE-22 Path traversal	Medium4.3	—	11.6%	May 16, 2019
27Monitor	CVE-2019-8929Proof of concept	An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.zohocorp · manageengine netflow analyzer · CWE-79 Pre-auth XSS	Medium6.1	—	11.1%	May 17, 2019
27Monitor	CVE-2019-8937Proof of concept	HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizzdigitaldruid · hoteldruid · CWE-79 Pre-auth XSS	Medium6.1	—	10.6%	May 17, 2019
60This week	CVE-2018-17179Weaponized	An issue was discovered in OpenEMR before 5.0.1 Patch 7.open-emr · openemr · CWE-89 Pre-auth SQL injection	Critical9.8	—	12.7%	May 17, 2019
34Monitor	CVE-2018-19585Proof of concept	GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroringitlab · gitlab · CWE-93 Pre-auth	High7.5	—	14.5%	May 17, 2019
63This week	CVE-2019-4279Weaponized	IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted ibm · websphere application server · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	79.9%	May 17, 2019
37Monitor	CVE-2019-12086Proof of concept	A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.fasterxml · jackson-databind · CWE-502 Pre-auth Deserialization	High7.5	—	21.9%	May 17, 2019
40Plan	CVE-2019-12185Proof of concept	eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component.elabftw · elabftw · CWE-434 RCE File upload	High8.8	—	17.3%	May 19, 2019
38Monitor	CVE-2019-7761No exploit	Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earadobe · acrobat dc · CWE-416 pre-auth RCE Memory safety	High8.8	—	10.2%	May 22, 2019
37Monitor	CVE-2019-12102Proof of concept	Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectkentico · xperience · CWE-732 Pre-auth Auth bypass	Critical9.1	—	2.4%	May 22, 2019
38Monitor	CVE-2019-7820No exploit	Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earadobe · acrobat dc · CWE-843 pre-auth RCE	High8.8	—	10.8%	May 22, 2019
71This week	CVE-2019-11634Weaponized	Citrix Workspace App before 1904 for Windows has Incorrect Access Control.citrix · receiver · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	KEV	8.0%	May 22, 2019
38Monitor	CVE-2018-14729Proof of concept	The database backup feature in upload/source/admincp/admincp_db.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP comsenz · discuz\! · CWE-20 RCE	High8.8	—	10.4%	May 22, 2019
60This week	CVE-2019-11231Weaponized	An issue was discovered in GetSimple CMS through 3.3.15.get-simple · getsimple cms · CWE-22 Pre-auth Path traversal	Critical9.8	—	71.5%	May 22, 2019
25Monitor	CVE-2019-3401Proof of concept	The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumeraatlassian · jira · CWE-863 Pre-auth Broken access control (IDOR)	Medium5.3	—	12.7%	May 22, 2019
36Monitor	CVE-2019-3403Proof of concept	The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 befatlassian · jira · CWE-863 Pre-auth Broken access control (IDOR)	Medium5.3	—	51.2%	May 22, 2019
38Monitor	CVE-2019-7824No exploit	Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earadobe · acrobat dc · CWE-787 pre-auth RCE Memory safety	High8.8	—	10.7%	May 22, 2019
39Monitor	CVE-2019-7827No exploit	Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earadobe · acrobat dc · CWE-787 pre-auth RCE Memory safety	High8.8	—	13.6%	May 22, 2019
39Monitor	CVE-2019-7828No exploit	Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earadobe · acrobat dc · CWE-787 pre-auth RCE Memory safety	High8.8	—	13.6%	May 22, 2019
48Plan	CVE-2019-8442Proof of concept	The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.atlassian · jira Pre-auth	High7.5	—	59.8%	May 22, 2019
91Now	CVE-2018-7841Weaponized	A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an ischneider-electric · u.motion builder · CWE-89 Pre-auth SQL injection	Critical9.8	KEV	72.6%	May 22, 2019
50Plan	CVE-2018-7842Proof of concept	A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Moschneider-electric · modicon m580 firmware · CWE-290 Pre-auth Auth bypass	Critical9.8	—	35.0%	May 22, 2019
48Plan	CVE-2018-7846Proof of concept	A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, schneider-electric · modicon m580 firmware · CWE-668 Pre-auth	Critical9.8	—	29.5%	May 22, 2019
60This week	CVE-2019-6814Weaponized	A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impaschneider-electric · net5501 firmware · CWE-287 Pre-auth Auth bypass	Critical9.8	—	36.6%	May 22, 2019
48Plan	CVE-2019-7107No exploit	Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing vulnerability.adobe · indesign pre-auth RCE	Critical9.8	—	28.9%	May 23, 2019
39Monitor	CVE-2019-7125No exploit	Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.3adobe · acrobat dc · CWE-787 pre-auth RCE Memory safety	High8.8	—	13.9%	May 23, 2019
31Monitor	CVE-2019-7109No exploit	Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.3adobe · acrobat dc · CWE-125 Pre-auth Memory safety	Medium6.5	—	15.0%	May 23, 2019
31Monitor	CVE-2019-7110No exploit	Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.3adobe · acrobat dc · CWE-125 Pre-auth Memory safety	Medium6.5	—	15.0%	May 23, 2019
52Plan	CVE-2019-7111No exploit	Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.3adobe · acrobat dc · CWE-787 pre-auth RCE Memory safety	High8.8	—	55.7%	May 23, 2019
31Monitor	CVE-2019-7127No exploit	Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.3adobe · acrobat dc · CWE-125 Pre-auth Memory safety	Medium6.5	—	15.0%	May 23, 2019
64This week	CVE-2019-12314Proof of concept	Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgdeltek · maconomy · CWE-22 Pre-auth Path traversal	Critical9.8	—	84.2%	May 24, 2019
59Plan	CVE-2019-7816No exploit	ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerabilitadobe · coldfusion · CWE-434 pre-auth RCE File upload	Critical9.8	—	67.8%	May 24, 2019
43Plan	CVE-2019-7089No exploit	Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.3adobe · acrobat dc Pre-auth	High7.5	—	44.7%	May 24, 2019
47Plan	CVE-2019-7091No exploit	ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a deserialization of untrusted data vulnerabiadobe · coldfusion · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	25.7%	May 24, 2019
42Plan	CVE-2019-0221Proof of concept	The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escapiapache · tomcat · CWE-79 Pre-auth XSS	Medium6.1	—	59.1%	May 28, 2019
46Plan	CVE-2019-5436No exploit	A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.haxx · libcurl · CWE-122 RCE Memory safety	High7.8	—	49.7%	May 28, 2019

CVE-2019-0227
58Plan
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.
HighCVSS 7.5Proof of conceptEPSS 91%
- Pre-auth
- SSRF
apache · axisMay 1, 2019
CVE-2017-18368
97Now
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in
CriticalCVSS 9.8KEVWeaponizedEPSS 94%
- pre-auth RCE
- Command injection
zyxel · p660hn-t1a v2 firmwareMay 2, 2019
CVE-2017-18369
60This week
The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwardin
CriticalCVSS 9.8WeaponizedEPSS 67%
- pre-auth RCE
- Command injection
billion · 5200w-t firmwareMay 2, 2019
CVE-2017-18370
42Plan
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log
HighCVSS 8.8WeaponizedEPSS 24%
- RCE
- Command injection
zyxel · p660hn-t1a v2 firmwareMay 2, 2019
CVE-2017-18371
60This week
The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two
CriticalCVSS 9.8WeaponizedEPSS 22%
- pre-auth RCE
- Hard-coded credentials
- Command injection
zyxel · p660hn-t1a v2 firmwareMay 2, 2019
CVE-2017-18372
42Plan
The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setti
HighCVSS 8.8WeaponizedEPSS 21%
- RCE
- Command injection
billion · 5200w-t firmwareMay 2, 2019
CVE-2018-12404
36Monitor
A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content.
MediumCVSS 5.9No exploitEPSS 44%
- Pre-auth
mozilla · network security servicesMay 2, 2019
CVE-2019-9017
36Monitor
DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name.
HighCVSS 7.5Proof of conceptEPSS 19%
- Pre-auth
- Memory safety
- Denial of service
solarwinds · dameware mini remote controlMay 2, 2019
CVE-2018-20824
35Monitor
The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site
MediumCVSS 6.1Proof of conceptEPSS 37%
- Pre-auth
- XSS
atlassian · jiraMay 3, 2019
CVE-2019-3799
60This week
Directory Traversal with spring-cloud-config-server
MediumCVSS 6.5WeaponizedEPSS 85%
- Pre-auth
- Path traversal
vmware · spring cloud configMay 6, 2019
CVE-2019-5434
56Plan
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" para
CriticalCVSS 9.8Proof of conceptEPSS 57%
- Pre-auth
- Deserialization
revive-sas · revive adserverMay 6, 2019
CVE-2018-4061
41Plan
An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.
HighCVSS 8.8No exploitEPSS 19%
- RCE
- Command injection
sierrawireless · airlink es450 firmwareMay 6, 2019
CVE-2018-4068
24Monitor
An exploitable information disclosure vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3.
MediumCVSS 5.3No exploitEPSS 11%
- Pre-auth
- Info leak
sierrawireless · airlink es450 firmwareMay 6, 2019
CVE-2018-4063
73This week
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3.
HighCVSS 8.8KEVWeaponizedEPSS 27%
- RCE
- File upload
sierrawireless · aleosMay 6, 2019
CVE-2018-4070
40Plan
An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLin
HighCVSS 8.8No exploitEPSS 17%
- Info leak
sierrawireless · airlink es450 firmwareMay 6, 2019
CVE-2018-4071
40Plan
An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLin
HighCVSS 8.8No exploitEPSS 18%
- Info leak
sierrawireless · airlink es450 firmwareMay 6, 2019
CVE-2018-4072
43Plan
An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink
HighCVSS 8.8No exploitEPSS 26%
sierrawireless · airlink es450 firmwareMay 6, 2019
CVE-2018-4073
43Plan
An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink
HighCVSS 8.8No exploitEPSS 25%
sierrawireless · airlink es450 firmwareMay 6, 2019
CVE-2018-14485
44Plan
BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
CriticalCVSS 9.8Proof of conceptEPSS 16%
- Pre-auth
- XXE
blogengine · blogengine.netMay 7, 2019
CVE-2019-8387
56Plan
MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.
CriticalCVSS 9.8Proof of conceptEPSS 55%
- pre-auth RCE
barni · master ip camera01 firmwareMay 8, 2019
CVE-2019-11508
32Monitor
In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticate
HighCVSS 7.2No exploitEPSS 14%
- RCE
- Path traversal
ivanti · connect secureMay 8, 2019
CVE-2019-11510
100Now
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attack
CriticalCVSS 10.0KEVWeaponizedEPSS 99%
- Pre-auth
- Path traversal
ivanti · connect secureMay 8, 2019
CVE-2019-7442
51Plan
An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remot
CriticalCVSS 9.8Proof of conceptEPSS 40%
- Pre-auth
- Auth bypass
- XXE
cyberark · enterprise password vaultMay 8, 2019
CVE-2019-1867
49Plan
Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability
CriticalCVSS 10.0No exploitEPSS 30%
- pre-auth RCE
- Auth bypass
cisco · elastic services controllerMay 10, 2019
CVE-2018-12296
33Monitor
Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain infor
HighCVSS 7.5Proof of conceptEPSS 11%
- Pre-auth
- Auth bypass
seagate · nas osMay 13, 2019
CVE-2018-14714
47Plan
System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "load
CriticalCVSS 9.8Proof of conceptEPSS 27%
- pre-auth RCE
- Command injection
asus · rt-ac3200 firmwareMay 13, 2019
CVE-2018-19986
51Plan
In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B
CriticalCVSS 9.8No exploitEPSS 41%
- pre-auth RCE
- Command injection
d-link · dir-818lw firmwareMay 13, 2019
CVE-2018-19987
43Plan
D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA,
CriticalCVSS 9.8Proof of conceptEPSS 12%
- pre-auth RCE
- Command injection
d-link · dir-818lw firmwareMay 13, 2019
CVE-2019-9726
35Monitor
Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of t
HighCVSS 7.5Proof of conceptEPSS 16%
- Pre-auth
- Path traversal
eq-3 · ccu3 firmwareMay 13, 2019
CVE-2019-11600
56Plan
A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands v
HighCVSS 8.1Proof of conceptEPSS 79%
- pre-auth RCE
- SQL injection
openproject · openprojectMay 13, 2019
CVE-2019-9618
52Plan
The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.
CriticalCVSS 9.8Proof of conceptEPSS 43%
- Pre-auth
- Path traversal
gracemedia media player project · gracemedia media playerMay 13, 2019
CVE-2019-3568
78This week
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a
CriticalCVSS 9.8KEVWeaponizedEPSS 30%
- pre-auth RCE
- Memory safety
whatsapp · whatsappMay 14, 2019
CVE-2018-14839
96Now
LG N1A1 NAS 3718.510 is affected by: Remote Command Execution.
CriticalCVSS 9.8KEVWeaponizedEPSS 89%
- pre-auth RCE
- Command injection
lg · n1a1 firmwareMay 14, 2019
CVE-2019-12099
40Plan
In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_
HighCVSS 8.8Proof of conceptEPSS 17%
- RCE
- File upload
php-fusion · php-fusionMay 14, 2019
CVE-2019-1717
33Monitor
Cisco Video Surveillance Manager Web-Based Management Interface Information Disclosure Vulnerability
HighCVSS 7.5No exploitEPSS 10%
- Pre-auth
- Path traversal
cisco · video surveillance managerMay 15, 2019
CVE-2013-7285
64This week
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run
CriticalCVSS 9.8Proof of conceptEPSS 84%
- pre-auth RCE
- Command injection
xstream · xstreamMay 15, 2019
CVE-2019-1818
30Monitor
Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability
MediumCVSS 6.5No exploitEPSS 13%
- Path traversal
cisco · evolved programmable network managerMay 15, 2019
CVE-2019-1819
30Monitor
Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability
MediumCVSS 6.5No exploitEPSS 13%
- Path traversal
cisco · evolved programmable network managerMay 15, 2019
CVE-2019-1820
30Monitor
Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability
MediumCVSS 6.5No exploitEPSS 13%
- Path traversal
cisco · evolved programmable network managerMay 15, 2019
CVE-2019-1821
68This week
Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerabilities
CriticalCVSS 9.8WeaponizedEPSS 98%
- pre-auth RCE
cisco · evolved programmable network managerMay 15, 2019
CVE-2019-0708
99Now
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- pre-auth RCE
- Memory safety
microsoft · windows 7May 16, 2019
CVE-2019-0725
47Plan
A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets, aka 'Windows DHCP Ser
CriticalCVSS 9.8No exploitEPSS 28%
- pre-auth RCE
- Memory safety
microsoft · windows server 2008May 16, 2019
CVE-2019-0758
30Monitor
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows
MediumCVSS 6.5No exploitEPSS 12%
- Pre-auth
microsoft · windows 10May 16, 2019
CVE-2019-0863
63This week
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevatio
HighCVSS 7.8KEVWeaponizedEPSS 5%
- Local privilege escalation
microsoft · windows 10 1507May 16, 2019
CVE-2019-0885
35Monitor
A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code
HighCVSS 7.8No exploitEPSS 14%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0889
37Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 20%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0890
35Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0891
37Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 20%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0893
35Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0894
35Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0895
35Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0896
35Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0897
35Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0898
35Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0899
37Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 20%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0900
35Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0901
35Monitor
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · windows 10May 16, 2019
CVE-2019-0902
41Plan
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En
HighCVSS 8.8No exploitEPSS 19%
- pre-auth RCE
microsoft · windows 10May 16, 2019
CVE-2019-0903
72This week
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka
HighCVSS 8.8KEVWeaponizedEPSS 21%
- pre-auth RCE
microsoft · windows 10 1507May 16, 2019
CVE-2019-0940
37Monitor
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corr
HighCVSS 7.5No exploitEPSS 23%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMay 16, 2019
CVE-2019-0945
35Monitor
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · officeMay 16, 2019
CVE-2019-0946
35Monitor
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · officeMay 16, 2019
CVE-2019-0947
35Monitor
A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka
HighCVSS 7.8No exploitEPSS 13%
- RCE
microsoft · officeMay 16, 2019
CVE-2019-0953
35Monitor
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft W
HighCVSS 7.8No exploitEPSS 12%
- RCE
microsoft · officeMay 16, 2019
CVE-2019-8925
20Monitor
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.
MediumCVSS 4.3Proof of conceptEPSS 11%
- Path traversal
zohocorp · manageengine netflow analyzerMay 16, 2019
CVE-2019-8929
27Monitor
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2.
MediumCVSS 6.1Proof of conceptEPSS 11%
- Pre-auth
- XSS
zohocorp · manageengine netflow analyzerMay 17, 2019
CVE-2019-8937
27Monitor
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizz
MediumCVSS 6.1Proof of conceptEPSS 10%
- Pre-auth
- XSS
digitaldruid · hoteldruidMay 17, 2019
CVE-2018-17179
60This week
An issue was discovered in OpenEMR before 5.0.1 Patch 7.
CriticalCVSS 9.8WeaponizedEPSS 12%
- Pre-auth
- SQL injection
open-emr · openemrMay 17, 2019
CVE-2018-19585
34Monitor
GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirrorin
HighCVSS 7.5Proof of conceptEPSS 14%
- Pre-auth
gitlab · gitlabMay 17, 2019
CVE-2019-4279
63This week
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted
CriticalCVSS 9.8WeaponizedEPSS 79%
- pre-auth RCE
- Deserialization
ibm · websphere application serverMay 17, 2019
CVE-2019-12086
37Monitor
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.
HighCVSS 7.5Proof of conceptEPSS 21%
- Pre-auth
- Deserialization
fasterxml · jackson-databindMay 17, 2019
CVE-2019-12185
40Plan
eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component.
HighCVSS 8.8Proof of conceptEPSS 17%
- RCE
- File upload
elabftw · elabftwMay 19, 2019
CVE-2019-7761
38Monitor
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and ear
HighCVSS 8.8No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · acrobat dcMay 22, 2019
CVE-2019-12102
37Monitor
Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselect
CriticalCVSS 9.1Proof of conceptEPSS 2%
- Pre-auth
- Auth bypass
kentico · xperienceMay 22, 2019
CVE-2019-7820
38Monitor
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and ear
HighCVSS 8.8No exploitEPSS 10%
- pre-auth RCE
adobe · acrobat dcMay 22, 2019
CVE-2019-11634
71This week
Citrix Workspace App before 1904 for Windows has Incorrect Access Control.
CriticalCVSS 9.8KEVWeaponizedEPSS 8%
- Pre-auth
- Broken access control (IDOR)
citrix · receiverMay 22, 2019
CVE-2018-14729
38Monitor
The database backup feature in upload/source/admincp/admincp_db.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP
HighCVSS 8.8Proof of conceptEPSS 10%
- RCE
comsenz · discuz\!May 22, 2019
CVE-2019-11231
60This week
An issue was discovered in GetSimple CMS through 3.3.15.
CriticalCVSS 9.8WeaponizedEPSS 71%
- Pre-auth
- Path traversal
get-simple · getsimple cmsMay 22, 2019
CVE-2019-3401
25Monitor
The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumera
MediumCVSS 5.3Proof of conceptEPSS 12%
- Pre-auth
- Broken access control (IDOR)
atlassian · jiraMay 22, 2019
CVE-2019-3403
36Monitor
The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 bef
MediumCVSS 5.3Proof of conceptEPSS 51%
- Pre-auth
- Broken access control (IDOR)
atlassian · jiraMay 22, 2019
CVE-2019-7824
38Monitor
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and ear
HighCVSS 8.8No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · acrobat dcMay 22, 2019
CVE-2019-7827
39Monitor
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and ear
HighCVSS 8.8No exploitEPSS 13%
- pre-auth RCE
- Memory safety
adobe · acrobat dcMay 22, 2019
CVE-2019-7828
39Monitor
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and ear
HighCVSS 8.8No exploitEPSS 13%
- pre-auth RCE
- Memory safety
adobe · acrobat dcMay 22, 2019
CVE-2019-8442
48Plan
The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.
HighCVSS 7.5Proof of conceptEPSS 59%
- Pre-auth
atlassian · jiraMay 22, 2019
CVE-2018-7841
91Now
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an i
CriticalCVSS 9.8KEVWeaponizedEPSS 72%
- Pre-auth
- SQL injection
schneider-electric · u.motion builderMay 22, 2019
CVE-2018-7842
50Plan
A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Mo
CriticalCVSS 9.8Proof of conceptEPSS 35%
- Pre-auth
- Auth bypass
schneider-electric · modicon m580 firmwareMay 22, 2019
CVE-2018-7846
48Plan
A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340,
CriticalCVSS 9.8Proof of conceptEPSS 29%
- Pre-auth
schneider-electric · modicon m580 firmwareMay 22, 2019
CVE-2019-6814
60This week
A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impa
CriticalCVSS 9.8WeaponizedEPSS 36%
- Pre-auth
- Auth bypass
schneider-electric · net5501 firmwareMay 22, 2019
CVE-2019-7107
48Plan
Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing vulnerability.
CriticalCVSS 9.8No exploitEPSS 28%
- pre-auth RCE
adobe · indesignMay 23, 2019
CVE-2019-7125
39Monitor
Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.3
HighCVSS 8.8No exploitEPSS 13%
- pre-auth RCE
- Memory safety
adobe · acrobat dcMay 23, 2019
CVE-2019-7109
31Monitor
Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.3
MediumCVSS 6.5No exploitEPSS 15%
- Pre-auth
- Memory safety
adobe · acrobat dcMay 23, 2019
CVE-2019-7110
31Monitor
Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.3
MediumCVSS 6.5No exploitEPSS 15%
- Pre-auth
- Memory safety
adobe · acrobat dcMay 23, 2019
CVE-2019-7111
52Plan
Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.3
HighCVSS 8.8No exploitEPSS 55%
- pre-auth RCE
- Memory safety
adobe · acrobat dcMay 23, 2019
CVE-2019-7127
31Monitor
Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.3
MediumCVSS 6.5No exploitEPSS 15%
- Pre-auth
- Memory safety
adobe · acrobat dcMay 23, 2019
CVE-2019-12314
64This week
Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cg
CriticalCVSS 9.8Proof of conceptEPSS 84%
- Pre-auth
- Path traversal
deltek · maconomyMay 24, 2019
CVE-2019-7816
59Plan
ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerabilit
CriticalCVSS 9.8No exploitEPSS 67%
- pre-auth RCE
- File upload
adobe · coldfusionMay 24, 2019
CVE-2019-7089
43Plan
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.3
HighCVSS 7.5No exploitEPSS 44%
- Pre-auth
adobe · acrobat dcMay 24, 2019
CVE-2019-7091
47Plan
ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a deserialization of untrusted data vulnerabi
CriticalCVSS 9.8No exploitEPSS 25%
- pre-auth RCE
- Deserialization
adobe · coldfusionMay 24, 2019
CVE-2019-0221
42Plan
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escapi
MediumCVSS 6.1Proof of conceptEPSS 59%
- Pre-auth
- XSS
apache · tomcatMay 28, 2019
CVE-2019-5436
46Plan
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
HighCVSS 7.8No exploitEPSS 49%
- RCE
- Memory safety
haxx · libcurlMay 28, 2019