Week 6, 2020
3–9 February 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-8657 An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.…EPSS 92%
- Critical 9.8 EPSS 86%
- Critical 9.8 EPSS 66%
-
Critical 9.8
CVE-2020-8597 eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.EPSS 20%
- Critical 9.8 EPSS 4.9%
- Critical 9.8 EPSS 4.1%
- Critical 9.8 EPSS 3.8%
-
Critical 10.0
CVE-2020-6770 Deserialization of Untrusted Data in Bosch BVMS Mobile Video ServiceEPSS 3.6%
Bosch · DIVAR IP 3000 · DIVAR IP 7000 · BVMS Mobile Video Service
- Critical 9.8 EPSS 2.4%
- Critical 9.8 EPSS 2.4%
-
Critical 10.0
CVE-2020-6769 Missing Authentication for Critical Function in Bosch Video Streaming GatewayEPSS 2.2%
Bosch · DIVAR IP all-in-one 5000 · DIVAR IP 7000 · DIVAR IP 3000
- Critical 9.8 EPSS 2.1%
- Critical 9.8 EPSS 1.5%
- Critical 9.8
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-6754 dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOM…EPSS 95%
- High EPSS 92%
-
Unscored
CVE-2020-8654 An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS com…EPSS 91%
-
Unscored
CVE-2020-8772 The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the user…EPSS 88%
-
Unscored
CVE-2020-8656 An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various ta…EPSS 85%
-
Unscored
CVE-2014-7863 The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, an…EPSS 83%
-
Unscored
CVE-2020-8450 An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a r…EPSS 72%
- Unscored EPSS 67%
Advisories
- SUSE / openSUSE Security Updates 384 critical
- Ubuntu Security Notices (USN) 144 critical
- Debian Security (DSA / DLA) 72 critical
- Oracle Linux Security Advisories (ELSA) 5
- Amazon Linux Security Center (ALAS) 5
- AlmaLinux Security Advisories 4
- BSI CERT-Bund (WID) 2
- CISA ICS & IT advisories 11 critical
- Rocky Linux Security Advisories 1
- SUSE-SU-2020:0302-1 Security update for python36 10 CVEs
- USN-4272-1 pillow vulnerabilities 5 CVEs
- SUSE-SU-2020:0311-1 Security update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client 2 CVEs
- DLA-2097-1 ppp - security update 1 CVEs
- USN-4273-1 python-reportlab vulnerability 1 CVEs
- DSA-4619-1 libxmlrpc3-java - security update 1 CVEs
- USN-4268-1 OpenSMTPD vulnerability 1 CVEs
- SUSE-SU-2020:0324-1 Security update for python-reportlab 1 CVEs
- openSUSE-SU-2020:0160-1 Security update for python-reportlab 1 CVEs
- USN-4264-1 python-django vulnerability 1 CVEs