Week 4, 2020
20–26 January 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 49%
-
Critical 9.8
CVE-2014-4172 Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerabilityEPSS 6.1%
-
Critical 10.0
CVE-2019-19897 In IXP EasyInstall 6.2.13723, there is Remote Code Execution via the Agent Service. An unauthenticated attacker can communicate with the Agent Service over TCP…EPSS 5.6%
- Critical 9.8 EPSS 4.5%
-
Critical 9.9
CVE-2019-19896 In IXP EasyInstall 6.2.13723, there is Remote Code Execution via weak permissions on the Engine Service share. The default file permissions of the IXP$ share o…EPSS 3%
- Critical 9.8 EPSS 2.8%
- Critical 9.8 EPSS 2.3%
- Critical 9.8 EPSS 1.8%
- Critical 9.8 EPSS 1.8%
- Critical 9.8 EPSS 1.5%
- Critical 9.8 EPSS 1.4%
- Critical 9.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-7246 A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionalit…EPSS 83%
-
Unscored
CVE-2020-7980 Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a val…EPSS 83%
-
High 8.2
CVE-2019-18426 A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and l…EPSS 68%
-
Unscored
CVE-2013-1595 A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization header field sent to the…EPSS 42%
-
Unscored
CVE-2020-7237 Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS c…EPSS 37%
-
Unscored
CVE-2019-17357 Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id co…EPSS 34%
-
Unscored
CVE-2019-1349 A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerabil…EPSS 34%
Microsoft · Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) · Microsoft Visual Studio 2019 · Microsoft Visual Studio 2017
-
Unscored
CVE-2019-1350 A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerabil…EPSS 26%
Microsoft · Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) · Microsoft Visual Studio 2019 · Microsoft Visual Studio 2017
Advisories
- SUSE / openSUSE Security Updates 352 critical
- Ubuntu Security Notices (USN) 12
- Debian Security (DSA / DLA) 10
- Oracle Linux Security Advisories (ELSA) 81 critical
- BSI CERT-Bund (WID) 2
- CISA ICS & IT advisories 22 critical
- SUSE-SU-2020:0234-1 Security update for python 37 CVEs
- openSUSE-SU-2020:0086-1 Security update for python3 26 CVEs
- ICSMA-20-023-01 GE CARESCAPE, ApexPro, and Clinical Information Center systems 6 CVEs
- ICSA-20-021-01 ICSA-20-021-01_Honeywell Maxpro VMS & NVR 2 CVEs
- ELSA-2020-0130 Critical: .NET Core on Red Hat Enterprise Linux security and bug fix update (Oracle Linux 8) 2 CVEs