Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2019

99 records · 7 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2019-15039
    43Plan

    An issue was discovered in JetBrains TeamCity 2018.2.4.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    jetbrains · teamcityOct 1, 2019

  • CVE-2019-12630
    59Plan

    Cisco Security Manager Java Deserialization Vulnerability

    CriticalCVSS 9.8No exploitEPSS 65%

    cisco · security managerOct 2, 2019

  • CVE-2019-16328
    60This week

    In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes c

    HighCVSS 7.5WeaponizedEPSS 13%

    rpyc project · rpycOct 3, 2019

  • CVE-2019-11932
    48Plan

    A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in W

    HighCVSS 8.8Proof of conceptEPSS 44%

    whatsapp · whatsappOct 3, 2019

  • CVE-2019-17132
    43Plan

    vBulletin through 5.5.4 mishandles custom avatars.

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    vbulletin · vbulletinOct 4, 2019

  • CVE-2019-16891
    52Plan

    Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    liferay · liferay portalOct 4, 2019

  • CVE-2019-17199
    60This week

    www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regula

    HighCVSS 7.5WeaponizedEPSS 9%

    webpagetest · webpagetestOct 5, 2019

  • CVE-2019-17240
    51Plan

    bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    bludit · bluditOct 6, 2019

  • CVE-2019-17187
    33Monitor

    /var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for re

    HighCVSS 7.5No exploitEPSS 10%

    fiberhome · hg2201t firmwareOct 8, 2019

  • CVE-2019-10969
    31Monitor

    Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the

    HighCVSS 7.2Proof of conceptEPSS 10%

    moxa · edr-810 firmwareOct 8, 2019

  • CVE-2019-13051
    39Monitor

    Pi-Hole 4.3 allows Command Injection.

    HighCVSS 8.8Proof of conceptEPSS 12%

    pi-hole · pi-holeOct 9, 2019

  • CVE-2019-17382
    52Plan

    An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4.

    CriticalCVSS 9.1Proof of conceptEPSS 54%

    zabbix · zabbixOct 9, 2019

  • CVE-2019-15226
    49Plan

    Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the head

    HighCVSS 7.5No exploitEPSS 64%

    envoyproxy · envoyOct 9, 2019

  • CVE-2019-15859
    48Plan

    Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a devi

    CriticalCVSS 9.8Proof of conceptEPSS 31%

    socomec · diris a-40 firmwareOct 9, 2019

  • CVE-2019-17124
    46Plan

    Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.

    CriticalCVSS 9.8Proof of conceptEPSS 22%

    kramerav · viawareOct 9, 2019

  • CVE-2019-15715
    37Monitor

    MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.

    HighCVSS 7.2Proof of conceptEPSS 30%

    mantisbt · mantisbtOct 9, 2019

  • CVE-2019-17418
    43Plan

    An issue was discovered in MetInfo 7.0.

    HighCVSS 7.2Proof of conceptEPSS 49%

    metinfo · metinfoOct 9, 2019

  • CVE-2019-1060
    39Monitor

    A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code

    HighCVSS 8.8No exploitEPSS 13%

    microsoft · windows 10Oct 10, 2019

  • CVE-2019-1166
    43Plan

    A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message

    MediumCVSS 5.9No exploitEPSS 68%

    microsoft · windows 10Oct 10, 2019

  • CVE-2019-1307
    33Monitor

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C

    HighCVSS 7.5No exploitEPSS 10%

    microsoft · chakracoreOct 10, 2019

  • CVE-2019-1308
    33Monitor

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C

    HighCVSS 7.5No exploitEPSS 10%

    microsoft · chakracoreOct 10, 2019

  • CVE-2019-1311
    42Plan

    A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory, aka 'Windows Imaging API Rem

    HighCVSS 7.8No exploitEPSS 36%

    microsoft · windows 10Oct 10, 2019

  • CVE-2019-1315
    62This week

    An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Report

    HighCVSS 7.8KEVWeaponizedEPSS 3%

    microsoft · windows 10 1607Oct 10, 2019

  • CVE-2019-1322
    67This week

    An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of

    HighCVSS 7.8KEVWeaponizedEPSS 19%

    microsoft · windows 10 1803Oct 10, 2019

  • CVE-2019-1327
    39Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    HighCVSS 8.8No exploitEPSS 13%

    microsoft · excelOct 10, 2019

  • CVE-2019-1331
    41Plan

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    HighCVSS 8.8No exploitEPSS 19%

    microsoft · excelOct 10, 2019

  • CVE-2019-1333
    40Plan

    A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De

    HighCVSS 8.8No exploitEPSS 15%

    microsoft · windows 10Oct 10, 2019

  • CVE-2019-1343
    29Monitor

    A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.

    MediumCVSS 6.5Proof of conceptEPSS 10%

    microsoft · windows 10Oct 10, 2019

  • CVE-2019-1346
    29Monitor

    A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.

    MediumCVSS 6.5Proof of conceptEPSS 10%

    microsoft · windows 10Oct 10, 2019

  • CVE-2019-1347
    30Monitor

    A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.

    MediumCVSS 6.5Proof of conceptEPSS 14%

    microsoft · windows 10Oct 10, 2019

  • CVE-2019-1358
    54Plan

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 75%

    microsoft · windows 10Oct 10, 2019

  • CVE-2019-1359
    37Monitor

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 19%

    microsoft · windows 10Oct 10, 2019

  • CVE-2019-1372
    46Plan

    An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to

    CriticalCVSS 10.0No exploitEPSS 18%

    microsoft · azure app service on azure stackOct 10, 2019

  • CVE-2015-9480
    34Monitor

    The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.

    HighCVSS 7.5Proof of conceptEPSS 12%

    robot-cpa · robotcpaOct 10, 2019

  • CVE-2019-17503
    35Monitor

    An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5.

    MediumCVSS 5.3Proof of conceptEPSS 48%

    kirona · dynamic resource schedulingOct 11, 2019

  • CVE-2019-2215
    83Now

    A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel.

    HighCVSS 7.8KEVWeaponizedEPSS 72%

    google · androidOct 11, 2019

  • CVE-2019-17506
    56Plan

    There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers.

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    dlink · dir-868l b1 firmwareOct 11, 2019

  • CVE-2019-17508
    60This week

    On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable.

    CriticalCVSS 9.8WeaponizedEPSS 15%

    dlink · dir-859 a3 firmwareOct 11, 2019

  • CVE-2017-18638
    35Monitor

    send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF.

    HighCVSS 7.5Proof of conceptEPSS 15%

    graphite project · graphiteOct 11, 2019

  • CVE-2019-17538
    33Monitor

    Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring

    HighCVSS 7.5Proof of conceptEPSS 11%

    jnoj · jiangnan online judgeOct 13, 2019

  • CVE-2019-16278
    99Now

    Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a c

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    nazgul · nostromo nhttpdOct 14, 2019

  • CVE-2019-16279
    36Monitor

    A memory error in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of service via a crafted H

    HighCVSS 7.5Proof of conceptEPSS 19%

    nazgul · nostromo nhttpdOct 14, 2019

  • CVE-2019-17195
    42Plan

    Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    connect2id · nimbus jose\+jwtOct 15, 2019

  • CVE-2019-17602
    63This week

    An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089.

    CriticalCVSS 9.8No exploitEPSS 81%

    zohocorp · manageengine opmanagerOct 15, 2019

  • CVE-2019-17626
    42Plan

    ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document

    CriticalCVSS 9.8No exploitEPSS 10%

    reportlab · reportlabOct 16, 2019

  • CVE-2019-17662
    68This week

    ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server.

    CriticalCVSS 9.8WeaponizedEPSS 96%

    cybelsoft · thinvncOct 16, 2019

  • CVE-2019-2890
    39Monitor

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services).

    HighCVSS 7.2Proof of conceptEPSS 36%

    oracle · weblogic serverOct 16, 2019

  • CVE-2019-2904
    43Plan

    Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces).

    CriticalCVSS 9.8No exploitEPSS 14%

    oracle · application testing suiteOct 16, 2019

  • CVE-2019-3010
    69This week

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver).

    HighCVSS 8.8KEVWeaponizedEPSS 13%

    oracle · solarisOct 16, 2019

  • CVE-2019-3025
    40Plan

    Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications.

    CriticalCVSS 9.0Proof of conceptEPSS 14%

    oracle · hospitality res 3700Oct 16, 2019

  • CVE-2019-17671
    32Monitor

    In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.

    MediumCVSS 5.3Proof of conceptEPSS 36%

    wordpress · wordpressOct 17, 2019

  • CVE-2019-14423
    41Plan

    A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote auth

    HighCVSS 8.8No exploitEPSS 19%

    eq-3 · cux-daemonOct 17, 2019

  • CVE-2019-15850
    40Plan

    eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method.

    HighCVSS 8.8No exploitEPSS 15%

    eq-3 · homematic ccu3 firmwareOct 17, 2019

  • CVE-2019-11253
    38Monitor

    Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

    HighCVSS 7.5Proof of conceptEPSS 25%

    kubernetes · kubernetesOct 17, 2019

  • CVE-2019-14287
    54Plan

    In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, a

    HighCVSS 8.8Proof of conceptEPSS 63%

    sudo project · sudoOct 17, 2019

  • CVE-2019-17120
    39Monitor

    A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to

    MediumCVSS 6.1No exploitEPSS 48%

    wikidsystems · 2fa enterprise serverOct 17, 2019

  • CVE-2019-8183
    39Monitor

    Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and e

    HighCVSS 8.8No exploitEPSS 13%

    adobe · acrobat dcOct 17, 2019

  • CVE-2019-8195
    46Plan

    Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and e

    CriticalCVSS 9.8Proof of conceptEPSS 22%

    adobe · acrobat dcOct 17, 2019

  • CVE-2019-8196
    46Plan

    Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and e

    CriticalCVSS 9.8Proof of conceptEPSS 22%

    adobe · acrobat dcOct 17, 2019

  • CVE-2019-8197
    44Plan

    Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and e

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    adobe · acrobat dcOct 17, 2019

  • CVE-2019-18217
    36Monitor

    ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long c

    HighCVSS 7.5Proof of conceptEPSS 20%

    proftpd · proftpdOct 21, 2019

  • CVE-2019-9491
    35Monitor

    Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious fil

    HighCVSS 7.8Proof of conceptEPSS 12%

    trendmicro · anti-threat toolkitOct 21, 2019

  • CVE-2019-17424
    35Monitor

    A stack-based buffer overflow in the processPrivilage() function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers (serv

    HighCVSS 7.8Proof of conceptEPSS 13%

    nipper-ng project · nipper-ngOct 22, 2019

  • CVE-2015-9499
    44Plan

    The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    themepunch · showbiz proOct 22, 2019

  • CVE-2019-10475
    41Plan

    A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into

    MediumCVSS 6.1Proof of conceptEPSS 57%

    jenkins · build-metricsOct 23, 2019

  • CVE-2019-18277
    33Monitor

    A flaw was found in HAProxy before 2.0.6.

    HighCVSS 7.5No exploitEPSS 10%

    haproxy · haproxyOct 23, 2019

  • CVE-2019-18370
    51Plan

    An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable.

    CriticalCVSS 9.8Proof of conceptEPSS 40%

    mi · millet router 3g firmwareOct 23, 2019

  • CVE-2019-18371
    47Plan

    An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable.

    HighCVSS 7.5Proof of conceptEPSS 55%

    mi · millet router 3g firmwareOct 23, 2019

  • CVE-2019-18393
    25Monitor

    PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home direct

    MediumCVSS 5.3Proof of conceptEPSS 13%

    igniterealtime · openfireOct 24, 2019

  • CVE-2019-18394
    49Plan

    A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send

    CriticalCVSS 9.8Proof of conceptEPSS 32%

    igniterealtime · openfireOct 24, 2019

  • CVE-2019-8086
    37Monitor

    Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability.

    HighCVSS 7.5Proof of conceptEPSS 22%

    adobe · experience managerOct 25, 2019

  • CVE-2019-5127
    53Plan

    A command injection have been found in YouPHPTube Encoder.

    CriticalCVSS 9.8Proof of conceptEPSS 45%

    youphptube · youphptube encoderOct 25, 2019

  • CVE-2019-5128
    48Plan

    A command injection have been found in YouPHPTube Encoder.

    CriticalCVSS 9.8Proof of conceptEPSS 30%

    youphptube · youphptube encoderOct 25, 2019

  • CVE-2019-5129
    51Plan

    A command injection have been found in YouPHPTube Encoder.

    CriticalCVSS 9.8Proof of conceptEPSS 38%

    youphptube · youphptube encoderOct 25, 2019

  • CVE-2019-16662
    68This week

    An issue was discovered in rConfig 3.9.2.

    CriticalCVSS 9.8WeaponizedEPSS 97%

    rconfig · rconfigOct 28, 2019

  • CVE-2019-16663
    60This week

    An issue was discovered in rConfig 3.9.2.

    HighCVSS 8.8Proof of conceptEPSS 84%

    rconfig · rconfigOct 28, 2019

  • CVE-2019-14927
    42Plan

    An issue was discovered on Mitsubishi Electric Europe B.V.

    HighCVSS 7.5Proof of conceptEPSS 40%

    mitsubishielectric · smartrtu firmwareOct 28, 2019

  • CVE-2019-14928
    34Monitor

    An issue was discovered on Mitsubishi Electric Europe B.V.

    MediumCVSS 5.4No exploitEPSS 43%

    mitsubishielectric · smartrtu firmwareOct 28, 2019

  • CVE-2019-14931
    56Plan

    An issue was discovered on Mitsubishi Electric Europe B.V.

    CriticalCVSS 9.8Proof of conceptEPSS 57%

    mitsubishielectric · smartrtu firmwareOct 28, 2019

  • CVE-2010-4239
    43Plan

    Tiki Wiki CMS Groupware 5.2 has Local File Inclusion

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    tiki · tikiwiki cms\/groupwareOct 28, 2019

  • CVE-2019-11043
    99Now

    Underflow in PHP-FPM can lead to RCE

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    php · phpOct 28, 2019

  • CVE-2019-14450
    42Plan

    A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    repetier-server · repetier-serverOct 28, 2019

  • CVE-2019-17181
    60This week

    A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03).

    CriticalCVSS 9.8WeaponizedEPSS 47%

    intrasrv project · intrasrvOct 28, 2019

  • CVE-2019-18187
    68This week

    Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extrac

    HighCVSS 7.5KEVWeaponizedEPSS 25%

    trendmicro · officescanOct 28, 2019

  • CVE-2019-15678
    43Plan

    TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution..

    CriticalCVSS 9.8No exploitEPSS 12%

    tightvnc · tightvncOct 29, 2019

  • CVE-2019-15679
    43Plan

    TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution.

    CriticalCVSS 9.8No exploitEPSS 11%

    tightvnc · tightvncOct 29, 2019

  • CVE-2019-15683
    45Plan

    TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e.

    CriticalCVSS 9.8No exploitEPSS 19%

    turbovnc · turbovncOct 29, 2019

  • CVE-2019-3978
    33Monitor

    RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291.

    HighCVSS 7.5Proof of conceptEPSS 10%

    mikrotik · routerosOct 29, 2019

  • CVE-2019-5533
    22Monitor

    In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterp

    MediumCVSS 4.3No exploitEPSS 17%

    vmware · sd-wan by velocloudOct 29, 2019

  • CVE-2019-6841
    26Monitor

    A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon

    MediumCVSS 4.9No exploitEPSS 23%

    schneider-electric · modicon m580 firmwareOct 29, 2019

  • CVE-2019-6848
    44Plan

    A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication mod

    HighCVSS 8.6No exploitEPSS 32%

    schneider-electric · modicon m580 firmwareOct 29, 2019

  • CVE-2019-6851
    39Monitor

    A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (al

    HighCVSS 7.5No exploitEPSS 29%

    schneider-electric · modicon m580 firmwareOct 29, 2019

  • CVE-2019-8287
    45Plan

    TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution.

    CriticalCVSS 9.8No exploitEPSS 19%

    tightvnc · tightvncOct 29, 2019

  • CVE-2019-9757
    41Plan

    An issue was discovered in LabKey Server 19.1.0.

    HighCVSS 7.5Proof of conceptEPSS 37%

    labkey · labkey serverOct 29, 2019

  • CVE-2012-0694
    60This week

    SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary

    CriticalCVSS 9.8WeaponizedEPSS 67%

    sugarcrm · sugarcrmOct 29, 2019

  • CVE-2013-1391
    60This week

    Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR sys

    HighCVSS 7.5WeaponizedEPSS 76%

    hachi · hv-04rd pro firmwareOct 30, 2019

  • CVE-2019-18396
    33Monitor

    An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices.

    HighCVSS 7.2Proof of conceptEPSS 16%

    technicolor · td5130v2 firmwareOct 31, 2019

  • CVE-2018-4064
    32Monitor

    An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 F

    HighCVSS 7.1No exploitEPSS 14%

    sierrawireless · airlink es450 firmwareOct 31, 2019

  • CVE-2019-5010
    36Monitor

    An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6.

    HighCVSS 7.5Proof of conceptEPSS 20%

    python · pythonOct 31, 2019