Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2019

87 records · 8 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2019-12569
    36Monitor

    A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system.

    HighCVSS 7.8No exploitEPSS 15%

    rakuten · viberJun 2, 2019

  • CVE-2019-11580
    98Now

    Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds.

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    atlassian · crowdJun 3, 2019

  • CVE-2019-12593
    42Plan

    IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c dir

    HighCVSS 7.5Proof of conceptEPSS 40%

    icewarp · mail serverJun 3, 2019

  • CVE-2018-5406
    39Monitor

    The Quest Kace K1000 Appliance misconfigures the Cross-Origin Resource Sharing (CORS) mechanism.

    HighCVSS 8.8Proof of conceptEPSS 12%

    quest · kace systems management appliance firmwareJun 3, 2019

  • CVE-2019-6753
    25Monitor

    This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.3.0.10826.

    MediumCVSS 5.5No exploitEPSS 10%

    foxitsoftware · foxit readerJun 3, 2019

  • CVE-2019-12169
    60This week

    ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive t

    HighCVSS 8.8WeaponizedEPSS 72%

    atutor · atutorJun 3, 2019

  • CVE-2019-10009
    29Monitor

    A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505.

    MediumCVSS 6.5Proof of conceptEPSS 11%

    southrivertech · titan ftp serverJun 3, 2019

  • CVE-2019-10883
    59Plan

    Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection.

    CriticalCVSS 9.8No exploitEPSS 65%

    citrix · citrix sd-wan centerJun 3, 2019

  • CVE-2018-13379
    99Now

    An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    fortinet · fortiproxyJun 4, 2019

  • CVE-2018-13380
    43Plan

    A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet F

    MediumCVSS 6.1Proof of conceptEPSS 62%

    fortinet · fortiosJun 4, 2019

  • CVE-2018-13382
    85Now

    An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 t

    HighCVSS 7.5KEVWeaponizedEPSS 81%

    fortinet · fortiproxyJun 4, 2019

  • CVE-2019-12616
    32Monitor

    An issue was discovered in phpMyAdmin before 4.9.0.

    MediumCVSS 6.5Proof of conceptEPSS 20%

    phpmyadmin · phpmyadminJun 5, 2019

  • CVE-2019-10149
    99Now

    A flaw was found in Exim versions 4.87 to 4.91 (inclusive).

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    exim · eximJun 5, 2019

  • CVE-2019-12735
    40Plan

    getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command i

    HighCVSS 8.6Proof of conceptEPSS 18%

    vim · vimJun 5, 2019

  • CVE-2018-7123
    47Plan

    A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

    HighCVSS 7.5No exploitEPSS 57%

    hp · intelligent management centerJun 5, 2019

  • CVE-2019-11944
    43Plan

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

    CriticalCVSS 9.8No exploitEPSS 13%

    hp · intelligent management centerJun 5, 2019

  • CVE-2019-11945
    63This week

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

    CriticalCVSS 9.8No exploitEPSS 78%

    hp · intelligent management centerJun 5, 2019

  • CVE-2019-5355
    46Plan

    A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

    HighCVSS 7.5No exploitEPSS 53%

    hp · intelligent management centerJun 5, 2019

  • CVE-2019-5356
    42Plan

    A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

    CriticalCVSS 9.8No exploitEPSS 10%

    hp · intelligent management centerJun 5, 2019

  • CVE-2019-12196
    60This week

    A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to

    CriticalCVSS 9.8No exploitEPSS 69%

    zohocorp · manageengine netflow analyzerJun 5, 2019

  • CVE-2019-12276
    47Plan

    A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthentic

    HighCVSS 7.5Proof of conceptEPSS 57%

    grandnode · grandnodeJun 5, 2019

  • CVE-2019-9189
    38Monitor

    Prima Systems FlexAir, Versions 2.4.9api3 and prior.

    HighCVSS 8.8Proof of conceptEPSS 11%

    primasystems · flexairJun 5, 2019

  • CVE-2019-8385
    45Plan

    An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358.

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    thomsonreuters · concourse matter roomJun 5, 2019

  • CVE-2019-11080
    39Monitor

    Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863.

    HighCVSS 8.8Proof of conceptEPSS 13%

    sitecore · experience platformJun 6, 2019

  • CVE-2019-6989
    38Monitor

    TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispose function.

    HighCVSS 8.8Proof of conceptEPSS 11%

    tp-link · tl-wr940n firmwareJun 6, 2019

  • CVE-2019-12477
    40Plan

    Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without

    MediumCVSS 5.5WeaponizedEPSS 13%

    supra · stv-lc40lt0020f firmwareJun 7, 2019

  • CVE-2018-20523
    24Monitor

    Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection.

    MediumCVSS 5.3Proof of conceptEPSS 10%

    mi · stock browserJun 7, 2019

  • CVE-2018-10700
    35Monitor

    An issue was discovered on Moxa AWK-3121 1.19 devices.

    MediumCVSS 6.1No exploitEPSS 38%

    moxa · awk-3121 firmwareJun 7, 2019

  • CVE-2019-3955
    35Monitor

    Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the server not properly vali

    HighCVSS 7.5No exploitEPSS 17%

    dameware · remote mini controlJun 7, 2019

  • CVE-2019-3957
    37Monitor

    Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly

    HighCVSS 7.4No exploitEPSS 25%

    solarwinds · dameware mini remote controlJun 7, 2019

  • CVE-2019-12780
    60This week

    The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action.

    CriticalCVSS 9.8WeaponizedEPSS 71%

    belkin · crock-pot smart slow cooker with wemo firmwareJun 10, 2019

  • CVE-2019-9879
    53Plan

    The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registratio

    CriticalCVSS 9.8Proof of conceptEPSS 46%

    wpengine · wpgraphqlJun 10, 2019

  • CVE-2019-9880
    47Plan

    An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress.

    CriticalCVSS 9.1Proof of conceptEPSS 35%

    wpengine · wpgraphqlJun 10, 2019

  • CVE-2019-9881
    27Monitor

    The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even wh

    MediumCVSS 5.3Proof of conceptEPSS 18%

    wpengine · wpgraphqlJun 10, 2019

  • CVE-2019-12765
    42Plan

    An issue was discovered in Joomla! before 3.9.7.

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    joomla · joomla\!Jun 11, 2019

  • CVE-2009-5156
    42Plan

    An issue was discovered on ASMAX AR-804gu 66.34.1 devices.

    CriticalCVSS 9.8No exploitEPSS 10%

    veracomp · asmax ar-804gu firmwareJun 11, 2019

  • CVE-2010-5330
    81Now

    On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not

    CriticalCVSS 9.8KEVWeaponizedEPSS 40%

    ui · airosJun 11, 2019

  • CVE-2013-7471
    46Plan

    An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11,

    CriticalCVSS 9.8No exploitEPSS 23%

    dlink · dir-300 firmwareJun 11, 2019

  • CVE-2018-20841
    53Plan

    HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082 allow remote command execution via shell metacharacter

    CriticalCVSS 9.8No exploitEPSS 47%

    hootoo · tripmate titan ht-tm05 firmwareJun 11, 2019

  • CVE-2019-0220
    26Monitor

    A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38.

    MediumCVSS 5.3No exploitEPSS 18%

    apache · http serverJun 11, 2019

  • CVE-2019-0196
    27Monitor

    A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38.

    MediumCVSS 5.3No exploitEPSS 19%

    apache · http serverJun 11, 2019

  • CVE-2019-0888
    38Monitor

    ActiveX Data Objects (ADO) Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 11%

    microsoft · windows 10Jun 12, 2019

  • CVE-2019-0948
    22Monitor

    Windows Event Viewer Information Disclosure Vulnerability

    MediumCVSS 4.7Proof of conceptEPSS 12%

    microsoft · windows 10Jun 12, 2019

  • CVE-2019-1009
    33Monitor

    Windows GDI Information Disclosure Vulnerability

    MediumCVSS 4.7No exploitEPSS 48%

    microsoft · windows 7Jun 12, 2019

  • CVE-2019-1019
    39Monitor

    Microsoft Windows Security Feature Bypass Vulnerability

    HighCVSS 8.5Proof of conceptEPSS 15%

    microsoft · windows 10Jun 12, 2019

  • CVE-2019-1040
    35Monitor

    Windows NTLM Tampering Vulnerability

    MediumCVSS 5.3Proof of conceptEPSS 48%

    microsoft · windows 10Jun 12, 2019

  • CVE-2019-1064
    63This week

    Windows Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 6%

    microsoft · windows 10 1607Jun 12, 2019

  • CVE-2019-1069
    63This week

    Task Scheduler Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 6%

    microsoft · windows 10 1507Jun 12, 2019

  • CVE-2019-0307
    40Plan

    Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communicat

    LowCVSS 2.4WeaponizedEPSS 2%

    sap · solution managerJun 12, 2019

  • CVE-2019-7838
    44Plan

    ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerabil

    CriticalCVSS 9.8No exploitEPSS 17%

    adobe · coldfusionJun 12, 2019

  • CVE-2019-7839
    52Plan

    ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    adobe · coldfusionJun 12, 2019

  • CVE-2019-7840
    44Plan

    ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerab

    CriticalCVSS 9.8No exploitEPSS 17%

    adobe · coldfusionJun 12, 2019

  • CVE-2019-12799
    51Plan

    In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, w

    HighCVSS 8.8WeaponizedEPSS 54%

    shopware · shopwareJun 13, 2019

  • CVE-2019-12828
    39Monitor

    An issue was discovered in Electronic Arts Origin before 10.5.39.

    HighCVSS 8.8Proof of conceptEPSS 13%

    ea · originJun 14, 2019

  • CVE-2019-12840
    58Plan

    In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the dat

    HighCVSS 8.8WeaponizedEPSS 77%

    webmin · webminJun 15, 2019

  • CVE-2018-20469
    45Plan

    An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0.

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    sahipro · sahi proJun 17, 2019

  • CVE-2018-20470
    44Plan

    An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0.

    HighCVSS 7.5Proof of conceptEPSS 46%

    sahipro · sahi proJun 17, 2019

  • CVE-2019-12181
    55Plan

    A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.

    HighCVSS 8.8WeaponizedEPSS 65%

    solarwinds · serv-u ftp serverJun 17, 2019

  • CVE-2019-11409
    61This week

    app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of

    HighCVSS 8.8WeaponizedEPSS 87%

    fusionpbx · fusionpbxJun 17, 2019

  • CVE-2019-7315
    33Monitor

    Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal via the web interfac

    HighCVSS 7.5Proof of conceptEPSS 11%

    genieaccess · wip3bvaf firmwareJun 17, 2019

  • CVE-2018-18852
    54Plan

    Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-interface PING feature

    HighCVSS 8.8Proof of conceptEPSS 63%

    cerio · dt-300n firmwareJun 18, 2019

  • CVE-2019-11477
    60This week

    Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs

    HighCVSS 7.5Proof of conceptEPSS 98%

    linux · linux kernelJun 18, 2019

  • CVE-2019-11478
    58Plan

    SACK can cause extensive memory use via fragmented resend queue

    HighCVSS 7.5No exploitEPSS 94%

    linux · linux kernelJun 18, 2019

  • CVE-2019-11479
    57Plan

    Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes.

    HighCVSS 7.5No exploitEPSS 91%

    linux · linux kernelJun 18, 2019

  • CVE-2019-12814
    26Monitor

    A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9.

    MediumCVSS 5.9Proof of conceptEPSS 10%

    fasterxml · jackson-databindJun 19, 2019

  • CVE-2019-6971
    43Plan

    An issue was discovered on TP-Link TL-WR1043ND V2 devices.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    tp-link · tl-wr1043nd firmwareJun 19, 2019

  • CVE-2018-18472
    48Plan

    Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in

    CriticalCVSS 9.8No exploitEPSS 30%

    westerndigital · my book live firmwareJun 19, 2019

  • CVE-2019-2729
    66This week

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

    CriticalCVSS 9.8Proof of conceptEPSS 88%

    oracle · communications diameter signaling routerJun 19, 2019

  • CVE-2019-1898
    33Monitor

    Cisco RV110W, RV130W, and RV215W Routers Unauthenticated syslog File Access Vulnerability

    MediumCVSS 5.3Proof of conceptEPSS 41%

    cisco · rv110w firmwareJun 19, 2019

  • CVE-2018-16119
    38Monitor

    Stack-based buffer overflow in the httpd server of TP-Link WR1043nd (Firmware Version 3) allows remote attackers to execute arbitrary code v

    HighCVSS 7.2Proof of conceptEPSS 33%

    tp-link · tl-wr1043nd firmwareJun 20, 2019

  • CVE-2018-16117
    48Plan

    A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attacker

    HighCVSS 8.8No exploitEPSS 43%

    sophos · sfosJun 20, 2019

  • CVE-2019-12744
    33Monitor

    SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability tha

    HighCVSS 7.5Proof of conceptEPSS 11%

    seeddms · seeddmsJun 20, 2019

  • CVE-2019-10072
    52Plan

    The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1

    HighCVSS 7.5No exploitEPSS 72%

    apache · tomcatJun 21, 2019

  • CVE-2019-12928
    60This week

    The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve

    CriticalCVSS 9.8WeaponizedEPSS 23%

    qemu · qemuJun 24, 2019

  • CVE-2019-7232
    51Plan

    The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request.

    HighCVSS 8.8No exploitEPSS 52%

    abb · pb610 panel builder 600 firmwareJun 24, 2019

  • CVE-2019-12384
    37Monitor

    FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-

    MediumCVSS 5.9Proof of conceptEPSS 45%

    fasterxml · jackson-databindJun 24, 2019

  • CVE-2019-1619
    64This week

    Cisco Data Center Network Manager Authentication Bypass Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 82%

    cisco · data center network managerJun 26, 2019

  • CVE-2019-1620
    64This week

    Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 83%

    cisco · data center network managerJun 26, 2019

  • CVE-2019-1621
    60This week

    Cisco Data Center Network Manager Arbitrary File Download Vulnerability

    HighCVSS 7.5WeaponizedEPSS 29%

    cisco · data center network managerJun 26, 2019

  • CVE-2019-1622
    60This week

    Cisco Data Center Network Manager Information Disclosure Vulnerability

    MediumCVSS 5.3WeaponizedEPSS 78%

    cisco · data center network managerJun 26, 2019

  • CVE-2019-12583
    49Plan

    Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest

    CriticalCVSS 9.1Proof of conceptEPSS 43%

    zyxel · uag2100 firmwareJun 27, 2019

  • CVE-2019-5786
    74This week

    Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory

    MediumCVSS 6.5KEVWeaponizedEPSS 61%

    google · chromeJun 27, 2019

  • CVE-2018-14916
    41Plan

    LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion.

    CriticalCVSS 9.1Proof of conceptEPSS 17%

    loytec · lgate-902 firmwareJun 28, 2019

  • CVE-2018-14918
    36Monitor

    LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.

    HighCVSS 7.5Proof of conceptEPSS 18%

    loytec · lgate-902 firmwareJun 28, 2019

  • CVE-2019-10993
    42Plan

    In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute a

    CriticalCVSS 9.8No exploitEPSS 10%

    advantech · webaccessJun 28, 2019

  • CVE-2019-13068
    37Monitor

    public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).

    MediumCVSS 5.4Proof of conceptEPSS 51%

    grafana · grafanaJun 29, 2019

  • CVE-2019-13086
    49Plan

    core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and

    CriticalCVSS 9.8Proof of conceptEPSS 31%

    cszcms · csz cmsJun 30, 2019