Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: July 2019

102 records · 14 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2019-13024
    45Plan

    Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands b

    HighCVSS 8.8Proof of conceptEPSS 32%

    centreon · centreonJul 1, 2019

  • CVE-2019-7666
    39Monitor

    Prima Systems FlexAir, Versions 2.3.38 and prior.

    HighCVSS 8.8Proof of conceptEPSS 14%

    primasystems · flexairJul 1, 2019

  • CVE-2019-7669
    44Plan

    Prima Systems FlexAir, Versions 2.3.38 and prior.

    HighCVSS 8.8No exploitEPSS 31%

    primasystems · flexairJul 1, 2019

  • CVE-2019-7670
    33Monitor

    Prima Systems FlexAir, Versions 2.3.38 and prior.

    HighCVSS 7.2Proof of conceptEPSS 18%

    primasystems · flexairJul 1, 2019

  • CVE-2019-7276
    67This week

    Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.

    CriticalCVSS 9.8WeaponizedEPSS 93%

    optergy · enterpriseJul 1, 2019

  • CVE-2019-7272
    24Monitor

    Optergy Proton/Enterprise devices allow Username Disclosure.

    MediumCVSS 5.3Proof of conceptEPSS 10%

    optergy · enterpriseJul 1, 2019

  • CVE-2019-7274
    48Plan

    Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root.

    CriticalCVSS 9.8Proof of conceptEPSS 29%

    optergy · enterpriseJul 1, 2019

  • CVE-2019-7265
    46Plan

    Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    nortekcontrol · linear emerge essential firmwareJul 2, 2019

  • CVE-2019-7267
    45Plan

    Linear eMerge 50P/5000P devices allow Cookie Path Traversal.

    CriticalCVSS 9.8No exploitEPSS 21%

    nortekcontrol · linear emerge 50p firmwareJul 2, 2019

  • CVE-2019-7269
    51Plan

    Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.

    CriticalCVSS 9.8Proof of conceptEPSS 40%

    nortekcontrol · linear emerge 50p firmwareJul 2, 2019

  • CVE-2019-7259
    39Monitor

    Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.

    HighCVSS 8.8No exploitEPSS 13%

    nortekcontrol · linear emerge essential firmwareJul 2, 2019

  • CVE-2019-7262
    40Plan

    Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).

    HighCVSS 8.8Proof of conceptEPSS 16%

    nortekcontrol · linear emerge essential firmwareJul 2, 2019

  • CVE-2019-7254
    55Plan

    Linear eMerge E3-Series devices allow File Inclusion.

    HighCVSS 7.5Proof of conceptEPSS 81%

    nortekcontrol · linear emerge essential firmwareJul 2, 2019

  • CVE-2019-7255
    41Plan

    Linear eMerge E3-Series devices allow XSS.

    MediumCVSS 6.1Proof of conceptEPSS 55%

    nortekcontrol · linear emerge essential firmwareJul 2, 2019

  • CVE-2019-7256
    98Now

    Linear eMerge E3-Series devices allow Command Injections.

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    nortekcontrol · linear emerge essential firmwareJul 2, 2019

  • CVE-2019-7257
    61This week

    Linear eMerge E3-Series devices allow Unrestricted File Upload.

    CriticalCVSS 10.0Proof of conceptEPSS 69%

    nortekcontrol · linear emerge essential firmwareJul 2, 2019

  • CVE-2019-7258
    41Plan

    Linear eMerge E3-Series devices allow Privilege Escalation.

    HighCVSS 8.8No exploitEPSS 19%

    nortekcontrol · linear emerge essential firmwareJul 2, 2019

  • CVE-2017-8413
    38Monitor

    An issue was discovered on D-Link DCS-1100 and DCS-1130 devices.

    HighCVSS 8.8No exploitEPSS 10%

    dlink · dcs-1130 firmwareJul 2, 2019

  • CVE-2017-8416
    38Monitor

    An issue was discovered on D-Link DCS-1100 and DCS-1130 devices.

    HighCVSS 8.8No exploitEPSS 11%

    dlink · dcs-1130 firmwareJul 2, 2019

  • CVE-2018-11686
    55Plan

    The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.

    CriticalCVSS 9.8Proof of conceptEPSS 52%

    flowpaper · flexpaperJul 3, 2019

  • CVE-2018-15811
    83Now

    DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

    HighCVSS 7.5KEVWeaponizedEPSS 76%

    dnnsoftware · dotnetnukeJul 3, 2019

  • CVE-2018-15812
    60This week

    DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

    HighCVSS 7.5WeaponizedEPSS 47%

    dnnsoftware · dotnetnukeJul 3, 2019

  • CVE-2018-18325
    82Now

    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters.

    HighCVSS 7.5KEVWeaponizedEPSS 74%

    dnnsoftware · dotnetnukeJul 3, 2019

  • CVE-2018-18326
    60This week

    DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy.

    HighCVSS 7.5WeaponizedEPSS 54%

    dnnsoftware · dotnetnukeJul 3, 2019

  • CVE-2017-8229
    61This week

    Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials.

    CriticalCVSS 9.8Proof of conceptEPSS 74%

    amcrest · ipm-721s firmwareJul 3, 2019

  • CVE-2018-14860
    37Monitor

    Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticat

    CriticalCVSS 9.1No exploitEPSS 2%

    odoo · odooJul 3, 2019

  • CVE-2019-9827
    47Plan

    Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitra

    CriticalCVSS 9.8No exploitEPSS 26%

    hawt · hawtioJul 3, 2019

  • CVE-2019-13294
    45Plan

    AROX School-ERP Pro has a command execution vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    arox · school-erpJul 4, 2019

  • CVE-2019-13344
    35Monitor

    An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to

    MediumCVSS 5.3Proof of conceptEPSS 45%

    crudlab · wp like buttonJul 5, 2019

  • CVE-2019-13345
    46Plan

    The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.

    MediumCVSS 6.1No exploitEPSS 74%

    squid-cache · squidJul 5, 2019

  • CVE-2019-13358
    37Monitor

    lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system.

    HighCVSS 7.5Proof of conceptEPSS 24%

    opencats · opencatsJul 5, 2019

  • CVE-2019-13372
    64This week

    /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arb

    CriticalCVSS 9.8WeaponizedEPSS 82%

    dlink · central wifimanagerJul 6, 2019

  • CVE-2019-13373
    60This week

    An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6.

    CriticalCVSS 9.8WeaponizedEPSS 68%

    dlink · central wifimanagerJul 6, 2019

  • CVE-2019-13375
    47Plan

    A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay

    CriticalCVSS 9.8No exploitEPSS 28%

    dlink · central wifimanagerJul 6, 2019

  • CVE-2019-13396
    40Plan

    FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-han

    MediumCVSS 5.3Proof of conceptEPSS 62%

    getflightpath · flightpathJul 10, 2019

  • CVE-2018-19571
    40Plan

    GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability i

    HighCVSS 7.7Proof of conceptEPSS 32%

    gitlab · gitlabJul 10, 2019

  • CVE-2019-13132
    52Plan

    In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq applicati

    CriticalCVSS 9.8Proof of conceptEPSS 42%

    zeromq · libzmqJul 10, 2019

  • CVE-2019-10192
    36Monitor

    A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x

    HighCVSS 7.2No exploitEPSS 26%

    redislabs · redisJul 11, 2019

  • CVE-2019-10193
    35Monitor

    A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.

    HighCVSS 7.2No exploitEPSS 23%

    redislabs · redisJul 11, 2019

  • CVE-2019-12525
    46Plan

    An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7.

    CriticalCVSS 9.8No exploitEPSS 24%

    squid-cache · squidJul 11, 2019

  • CVE-2019-12527
    50Plan

    An issue was discovered in Squid 4.0.23 through 4.7.

    HighCVSS 8.8No exploitEPSS 49%

    squid-cache · squidJul 11, 2019

  • CVE-2019-13597
    43Plan

    _s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution.

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    sahipro · sahi proJul 14, 2019

  • CVE-2019-0785
    54Plan

    A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP failo

    CriticalCVSS 9.8Proof of conceptEPSS 49%

    microsoft · windows server 2012Jul 15, 2019

  • CVE-2019-0880
    62This week

    A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privileg

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    microsoft · windows 10 1507Jul 15, 2019

  • CVE-2019-0887
    53Plan

    A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attack

    HighCVSS 8.0Proof of conceptEPSS 70%

    microsoft · remote desktop clientJul 15, 2019

  • CVE-2019-1068
    82Now

    A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Micr

    HighCVSS 8.8KEVWeaponizedEPSS 57%

    microsoft · sql serverJul 15, 2019

  • CVE-2019-1072
    43Plan

    A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Az

    CriticalCVSS 9.8No exploitEPSS 13%

    microsoft · team foundation serverJul 15, 2019

  • CVE-2019-1102
    38Monitor

    A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka

    HighCVSS 8.8No exploitEPSS 11%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1108
    29Monitor

    An information disclosure vulnerability exists when the Windows RDP client improperly discloses the contents of its memory, aka 'Remote Desk

    MediumCVSS 6.5Proof of conceptEPSS 10%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1110
    39Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    HighCVSS 8.8No exploitEPSS 13%

    microsoft · excelJul 15, 2019

  • CVE-2019-1111
    39Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    HighCVSS 8.8No exploitEPSS 13%

    microsoft · excelJul 15, 2019

  • CVE-2019-1117
    42Plan

    A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V

    HighCVSS 8.8Proof of conceptEPSS 23%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1118
    42Plan

    A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V

    HighCVSS 8.8Proof of conceptEPSS 23%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1119
    41Plan

    A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V

    HighCVSS 8.8Proof of conceptEPSS 19%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1120
    40Plan

    A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V

    HighCVSS 8.8Proof of conceptEPSS 16%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1121
    40Plan

    A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V

    HighCVSS 8.8Proof of conceptEPSS 16%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1122
    40Plan

    A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V

    HighCVSS 8.8Proof of conceptEPSS 16%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1123
    40Plan

    A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V

    HighCVSS 8.8Proof of conceptEPSS 16%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1124
    41Plan

    A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V

    HighCVSS 8.8Proof of conceptEPSS 18%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1127
    41Plan

    A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V

    HighCVSS 8.8Proof of conceptEPSS 20%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1128
    40Plan

    A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V

    HighCVSS 8.8Proof of conceptEPSS 16%

    microsoft · windows 10Jul 15, 2019

  • CVE-2019-1129
    62This week

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows El

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    microsoft · windows 10 1703Jul 15, 2019

  • CVE-2019-1130
    62This week

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows El

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    microsoft · windows 10 1507Jul 15, 2019

  • CVE-2019-1132
    64This week

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k

    HighCVSS 7.8KEVWeaponizedEPSS 9%

    microsoft · windows 7Jul 15, 2019

  • CVE-2019-13360
    46Plan

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging k

    CriticalCVSS 9.8Proof of conceptEPSS 24%

    control-webpanel · webpanelJul 16, 2019

  • CVE-2019-13383
    25Monitor

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by read

    MediumCVSS 5.3Proof of conceptEPSS 14%

    control-webpanel · webpanelJul 16, 2019

  • CVE-2019-13605
    40Plan

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by

    HighCVSS 8.8Proof of conceptEPSS 15%

    control-webpanel · webpanelJul 16, 2019

  • CVE-2019-12985
    51Plan

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6).

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    citrix · netscaler sd-wanJul 16, 2019

  • CVE-2019-12986
    51Plan

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6).

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    citrix · netscaler sd-wanJul 16, 2019

  • CVE-2019-12987
    52Plan

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6).

    CriticalCVSS 9.8Proof of conceptEPSS 42%

    citrix · netscaler sd-wanJul 16, 2019

  • CVE-2019-12988
    52Plan

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6).

    CriticalCVSS 9.8Proof of conceptEPSS 42%

    citrix · netscaler sd-wanJul 16, 2019

  • CVE-2019-12989
    97Now

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    citrix · netscaler sd-wanJul 16, 2019

  • CVE-2019-12990
    51Plan

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    citrix · netscaler sd-wanJul 16, 2019

  • CVE-2019-12991
    87Now

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).

    HighCVSS 8.8KEVWeaponizedEPSS 74%

    citrix · netscaler sd-wanJul 16, 2019

  • CVE-2019-12992
    50Plan

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 6 of 6).

    HighCVSS 8.8No exploitEPSS 48%

    citrix · netscaler sd-wanJul 16, 2019

  • CVE-2019-13115
    35Monitor

    In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an

    HighCVSS 8.1Proof of conceptEPSS 11%

    libssh2 · libssh2Jul 16, 2019

  • CVE-2019-13359
    38Monitor

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to

    HighCVSS 7.5Proof of conceptEPSS 25%

    control-webpanel · webpanelJul 16, 2019

  • CVE-2019-9848
    48Plan

    LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-ov

    CriticalCVSS 9.8No exploitEPSS 28%

    libreoffice · libreofficeJul 17, 2019

  • CVE-2019-13272
    77This week

    In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to cre

    HighCVSS 7.8KEVWeaponizedEPSS 52%

    linux · linux kernelJul 17, 2019

  • CVE-2019-10352
    29Monitor

    A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.j

    MediumCVSS 6.5No exploitEPSS 10%

    jenkins · jenkinsJul 17, 2019

  • CVE-2019-13585
    43Plan

    The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 has a Buffer Overflow via a forged HTTP request.

    CriticalCVSS 9.8No exploitEPSS 14%

    fanucamerica · robotics virtual robot controllerJul 17, 2019

  • CVE-2019-13577
    46Plan

    SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote fea

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    computerlab · maple computer wbt snmp administratorJul 17, 2019

  • CVE-2019-12725
    66This week

    Zeroshell 3.9.0 is prone to a remote command execution vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 89%

    zeroshell · zeroshellJul 19, 2019

  • CVE-2019-12815
    56Plan

    An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without

    CriticalCVSS 9.8Proof of conceptEPSS 57%

    proftpd · proftpdJul 19, 2019

  • CVE-2019-1579
    76This week

    Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or

    HighCVSS 8.1KEVWeaponizedEPSS 46%

    paloaltonetworks · pan-osJul 19, 2019

  • CVE-2019-14205
    49Plan

    A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arb

    HighCVSS 7.5Proof of conceptEPSS 63%

    nevma · adaptive imagesJul 21, 2019

  • CVE-2019-10173
    68This week

    It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw.

    CriticalCVSS 9.8No exploitEPSS 95%

    xstream · xstreamJul 23, 2019

  • CVE-2019-14241
    51Plan

    HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in prot

    HighCVSS 7.5No exploitEPSS 70%

    haproxy · haproxyJul 23, 2019

  • CVE-2019-11703
    42Plan

    A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages,

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    mozilla · thunderbirdJul 23, 2019

  • CVE-2019-11704
    42Plan

    A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    mozilla · thunderbirdJul 23, 2019

  • CVE-2019-11707
    76This week

    A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop.

    HighCVSS 8.8KEVWeaponizedEPSS 37%

    mozilla · firefoxJul 23, 2019

  • CVE-2019-11708
    87Now

    Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxe

    CriticalCVSS 10.0KEVWeaponizedEPSS 55%

    mozilla · firefoxJul 23, 2019

  • CVE-2019-11730
    32Monitor

    A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same direc

    MediumCVSS 6.5Proof of conceptEPSS 20%

    mozilla · firefoxJul 23, 2019

  • CVE-2019-13990
    44Plan

    initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job descript

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    softwareag · quartzJul 26, 2019

  • CVE-2019-10266
    34Monitor

    An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.

    HighCVSS 7.5Proof of conceptEPSS 13%

    ahsay · cloud backup suiteJul 26, 2019

  • CVE-2019-10267
    58Plan

    An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50.

    HighCVSS 8.8WeaponizedEPSS 75%

    ahsay · cloud backup suiteJul 26, 2019

  • CVE-2019-14322
    47Plan

    In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

    HighCVSS 7.5Proof of conceptEPSS 55%

    palletsprojects · werkzeugJul 28, 2019

  • CVE-2019-14378
    40Plan

    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the firs

    HighCVSS 8.8Proof of conceptEPSS 16%

    libslirp project · libslirpJul 29, 2019

  • CVE-2019-14271
    45Plan

    In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamical

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    docker · dockerJul 29, 2019

  • CVE-2019-3948
    38Monitor

    The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX8

    HighCVSS 7.5Proof of conceptEPSS 25%

    amcrest · ip2m-841b firmwareJul 29, 2019