Week 5, 2020
27 January – 2 February 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-8515 DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without…EPSS 100%
-
Critical 9.8
CVE-2020-7247 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via …EPSS 99%
- Critical 9.8 EPSS 14%
- Critical 9.1 EPSS 8.9%
- Critical 9.8 EPSS 7.5%
-
Critical 9.8
CVE-2020-4207 IBM Watson IoT Message Gateway 2.0.0.x, 5.0.0.0, 5.0.0.1, and 5.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking when handling a fa…EPSS 4.5%
- Critical 9.8 EPSS 2.6%
- Critical 9.0 EPSS 2.1%
- Critical 9.8
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2013-3214 vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.EPSS 85%
-
Unscored
CVE-2012-1495 install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.EPSS 80%
-
Unscored
CVE-2014-8741 Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitra…EPSS 77%
-
Unscored
CVE-2019-20215 D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdoc…EPSS 75%
-
Unscored
CVE-2013-7390 Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to exec…EPSS 75%
-
Unscored
CVE-2013-3215 vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.EPSS 69%
-
Unscored
CVE-2013-2568 A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which could let a remote mali…EPSS 49%
-
Unscored
CVE-2013-2573 A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G, 3171G. an…EPSS 42%
Advisories
- SUSE / openSUSE Security Updates 29
- Debian Security (DSA / DLA) 253 critical
- Ubuntu Security Notices (USN) 163 critical
- Oracle Linux Security Advisories (ELSA) 8
- BSI CERT-Bund (WID) 4
- Rocky Linux Security Advisories 1
- AlmaLinux Security Advisories 1
- USN-4252-2 tcpdump vulnerabilities 28 CVEs
- USN-4252-1 tcpdump vulnerabilities 28 CVEs
- DLA-2091-1 libjackson-json-java - security update 3 CVEs
- USN-4259-1 Apache Solr vulnerability 1 CVEs
- DSA-4611-1 opensmtpd - security update 1 CVEs
- DLA-2078-1 libxmlrpc3-java - security update 1 CVEs