By publication date
Exploited and new serious CVEs: May 2019
110 records · 14 KEV. In publication order.
Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.
Month boundaries are UTC, the same rule as the publication date on each record page.
Page 2 of 2
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
41Plan | CVE-2019-9858Weaponized | Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17.horde · groupware · CWE-22 | High8.8 | — | 18.8% | May 29, 2019 |
66This week | CVE-2018-13383Weaponized | A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxfortinet · fortiproxy · CWE-787 | Medium6.5 | KEV | 33.6% | May 29, 2019 |
42Plan | CVE-2019-12347Proof of concept | In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accounnetgate · pfsense · CWE-79 | Medium6.1 | — | 58.5% | May 29, 2019 |
99Now | CVE-2019-9670Weaponized | mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, assynacor · zimbra collaboration suite · CWE-611 | Critical9.8 | KEV | 99.9% | May 29, 2019 |
53Plan | CVE-2019-8457No exploit | SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tsqlite · sqlite · CWE-125 | Critical9.8 | — | 45.4% | May 30, 2019 |
40Plan | CVE-2019-12480Proof of concept | BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in Atbacnet protocol stack project · bacnet protocol stack · CWE-125 | High7.5 | — | 33.8% | May 30, 2019 |
94Now | CVE-2019-9874Weaponized | Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 tositecore · cms · CWE-502 | Critical9.8 | KEV | 83.7% | May 31, 2019 |
69This week | CVE-2019-9875Weaponized | Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary codesitecore · cms · CWE-502 | High8.8 | KEV | 13.7% | May 31, 2019 |
60This week | CVE-2019-10123Weaponized | SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous ais · logistic software · CWE-89 | Critical9.8 | — | 65.8% | May 31, 2019 |
42Plan | CVE-2019-9653Proof of concept | NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharacnuuo · network video recorder firmware · CWE-78 | Critical9.8 | — | 11.4% | May 31, 2019 |
- CVE-2019-985841Plan
Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17.
HighCVSS 8.8WeaponizedEPSS 18%horde · groupwareMay 29, 2019
- CVE-2018-1338366This week
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProx
MediumCVSS 6.5KEVWeaponizedEPSS 33%fortinet · fortiproxyMay 29, 2019
- CVE-2019-1234742Plan
In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accoun
MediumCVSS 6.1Proof of conceptEPSS 58%netgate · pfsenseMay 29, 2019
- CVE-2019-967099Now
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as
CriticalCVSS 9.8KEVWeaponizedEPSS 99%synacor · zimbra collaboration suiteMay 29, 2019
- CVE-2019-845753Plan
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree t
CriticalCVSS 9.8No exploitEPSS 45%sqlite · sqliteMay 30, 2019
- CVE-2019-1248040Plan
BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in At
HighCVSS 7.5Proof of conceptEPSS 33%bacnet protocol stack project · bacnet protocol stackMay 30, 2019
- CVE-2019-987494Now
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to
CriticalCVSS 9.8KEVWeaponizedEPSS 83%sitecore · cmsMay 31, 2019
- CVE-2019-987569This week
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code
HighCVSS 8.8KEVWeaponizedEPSS 13%sitecore · cmsMay 31, 2019
- CVE-2019-1012360This week
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous
CriticalCVSS 9.8WeaponizedEPSS 65%ais · logistic softwareMay 31, 2019
- CVE-2019-965342Plan
NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharac
CriticalCVSS 9.8Proof of conceptEPSS 11%nuuo · network video recorder firmwareMay 31, 2019