Week 2, 2020
6–12 January 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 96%
- Critical 9.8 EPSS 93%
- Critical 9.8 EPSS 38%
-
Critical 9.8
CVE-2020-6756 languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code via the lang parame…EPSS 11%
- Critical 9.8 EPSS 3.5%
- Critical 9.8 EPSS 2.1%
- Critical 9.8 EPSS 2.1%
- Critical 9.1 EPSS 1.7%
- Critical 9.8 EPSS 1.6%
- Critical 9.6
- Critical 9.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.3
CVE-2019-20361 There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash pa…EPSS 85%
-
Unscored
CVE-2019-19509 An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php bec…EPSS 72%
-
Unscored
CVE-2012-4284 A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which …EPSS 70%
-
Unscored
CVE-2015-4553 A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.EPSS 57%
- High 7.2 EPSS 50%
-
Unscored
CVE-2019-20224 netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in …EPSS 50%
- High 7.2 EPSS 47%
-
Unscored
CVE-2020-5514 Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.EPSS 44%
Advisories
- SUSE / openSUSE Security Updates 323 critical
- Debian Security (DSA / DLA) 133 critical
- Ubuntu Security Notices (USN) 12
- BSI CERT-Bund (WID) 6
- Amazon Linux Security Center (ALAS) 2
- Oracle Linux Security Advisories (ELSA) 1
- DLA-2057-1 pillow - security update 3 CVEs
- DLA-2065-1 apache-log4j1.2 - security update 1 CVEs
- SUSE-SU-2020:14267-1 Security update for log4j 1 CVEs
- SUSE-SU-2020:0054-1 Security update for log4j 1 CVEs
- SUSE-SU-2020:0053-1 Security update for log4j 1 CVEs
- DSA-4598-1 python-django - security update 1 CVEs