Week 1, 2020

30 December 2019 – 5 January 2020

New CVEs: 253
Critical: 6
High: 11
Newly exploited: 0
Advisories: 20
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2019-17621 The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands…
EPSS 91%
Critical 9.8
CVE-2016-1000027 Pivotal Spring Framework contains unsafe Java deserialization methods
EPSS 33%
Critical 9.8
CVE-2019-20330 Deserialization of Untrusted Data in jackson-databind
EPSS 8.6%
Critical 9.8
CVE-2019-10774 php-shellcommand command injection vulnerability
EPSS 4.6%
Critical 9.8
CVE-2020-5311 Buffer Copy without Checking Size of Input in Pillow
EPSS 4%
Critical 9.8
CVE-2020-5312 PCX P mode buffer overflow in Pillow
EPSS 3.7%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories