Week 3, 2020
13–19 January 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-0646 A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Inje…EPSS 99%
Microsoft · Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 · Microsoft .NET Framework 3.5.1
-
Critical 9.8
CVE-2020-2555 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are …EPSS 97%
-
Critical 9.8
CVE-2020-2551 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3…EPSS 93%
-
Critical 9.1
CVE-2020-7048 The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial Wo…EPSS 23%
- Critical 9.8 EPSS 15%
- Critical 9.8 EPSS 7.8%
-
Critical 9.8
CVE-2020-2546 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Application Container - JavaEE). Supported versions that are affect…EPSS 5.2%
- Critical 9.8 EPSS 2.8%
-
Critical 9.9
CVE-2020-7047 The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-…EPSS 2.5%
-
Critical 9.9
CVE-2020-2586 Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Supported versions that are affected are 12.…EPSS 1.5%
-
Critical 9.9
CVE-2020-2587 Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Supported versions that are affected are 12.…EPSS 1.5%
- Critical 9.8 EPSS 1.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 6.1 EPSS 93%
-
High 8.1
CVE-2020-0601 Certificate validation bypass on Windows in crypto/x509EPSS 89%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
High 8.0
CVE-2020-5398 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux ApplicationEPSS 88%
-
Unscored
CVE-2020-0609 A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system usin…EPSS 78%
-
Unscored
CVE-2014-6038 Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Bui…EPSS 73%
-
Unscored
CVE-2014-6039 ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed version 10 Build 10000.EPSS 69%
-
Unscored
CVE-2020-0610 A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system usin…EPSS 68%
-
Unscored
CVE-2020-5505 Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"application/x-php"} to th…EPSS 44%
Advisories
- SUSE / openSUSE Security Updates 424 critical
- Ubuntu Security Notices (USN) 12
- Debian Security (DSA / DLA) 9
- CISA ICS & IT advisories 71 critical
- Oracle Linux Security Advisories (ELSA) 72 critical
- Amazon Linux Security Center (ALAS) 6
- BSI CERT-Bund (WID) 51 critical
- Siemens ProductCERT 2
- Schneider Electric CPCERT 1
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox 118 CVEs
- WID-SEC-2023-2946 Oracle Fusion Middleware: Mehrere Schwachstellen 36 CVEs
- SUSE-SU-2020:0114-1 Security update for python3 26 CVEs
- ELSA-2020-0111 Critical: firefox security update (Oracle Linux 8) 5 CVEs
- ELSA-2020-0085 Critical: firefox security update (Oracle Linux 7) 5 CVEs
- openSUSE-SU-2020:0056-1 Security update for phpMyAdmin 3 CVEs
- openSUSE-SU-2020:0051-1 Security update for log4j 1 CVEs
- ICSA-20-014-02 Siemens SINEMA Server 1 CVEs