Week 7, 2020

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2020-0618 A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Re…

  Microsoft · Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) · Microsoft SQL Server · Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)

  EPSS 99%
• Critical 9.8
  CVE-2014-9390 JGit Improper Input Validation vulnerability
  EPSS 76%
• Critical 9.8
  CVE-2020-8840 Deserialization of Untrusted Data in jackson-databind
  EPSS 27%
• Critical 9.8
  CVE-2019-5187 An exploitable out-of-bounds write vulnerability exists in the TIFreadstripdata function of the igcore19d.dll library of Accusoft ImageGear 19.5.0. A specially…
  EPSS 3.7%
• Critical 9.8
  CVE-2020-6068 An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG pngread parser of the Accusoft ImageGear 19.5.0 library. A specially crafted P…
  EPSS 3.7%
• Critical 9.8
  CVE-2020-6066 An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll JPEG SOFx parser of the Accusoft ImageGear 19.5.0 library. A specially crafted JPE…
  EPSS 3.7%
• Critical 9.8
  CVE-2020-6067 An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll TIFF tifread parser of the Accusoft ImageGear 19.5.0 library. A specially crafted …
  EPSS 3.7%
• Critical 9.8
  CVE-2020-6063 An exploitable out-of-bounds write vulnerability exists in the uncompress_scan_line function of the igcore19d.dll library of Accusoft ImageGear, version 19.5.0…
  EPSS 3.7%
• Critical 9.8
  CVE-2020-6069 An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll JPEG jpegread precision parser of the Accusoft ImageGear 19.5.0 library. A special…
  EPSS 3.7%
• Critical 9.8
  CVE-2020-6064 An exploitable out-of-bounds write vulnerability exists in the uncompress_scan_line function of the igcore19d.dll library of Accusoft ImageGear, version 19.5.0…
  EPSS 3.7%
• Critical 9.8
  CVE-2020-6065 An exploitable out-of-bounds write vulnerability exists in the bmp_parsing function of the igcore19d.dll library of Accusoft ImageGear, version 19.5.0. A speci…
  EPSS 3.7%
• Critical 9.8
  CVE-2020-8129 Code Injection in script-manager
  EPSS 2.9%
• Critical 9.4
  CVE-2019-17137 This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart…

  NETGEAR · AC1200

  EPSS 2.7%
• Critical 9.8
  CVE-2020-8128 Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport
  EPSS 2.7%
• Critical 9.8
  CVE-2013-7381 Potential Command Injection in libnotify
  EPSS 2.7%

All 18 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2020-0688 A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchan…

  Microsoft · Microsoft Exchange Server 2013 · Microsoft Exchange Server 2019 Cumulative Update 3 · Microsoft Exchange Server 2016 Cumulative Update 14

  EPSS 100%
• Unscored
  CVE-2020-7209 LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
  EPSS 99%
• Unscored
  CVE-2013-1359 An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management …
  EPSS 89%
• High 7.5
  CVE-2020-0674 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory …

  Microsoft · Internet Explorer 11 · Internet Explorer 10 · Internet Explorer 9

  EPSS 87%
• Unscored
  CVE-2013-0803 A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arbitrary code.
  EPSS 75%
• Unscored
  CVE-2013-2010 WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability

  W3 Total Cache Plugin authors · W3 Total Cache Plugin

  EPSS 74%
• Unscored
  CVE-2013-4211 A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user e…

  OpenX · Ad Server

  EPSS 71%
• Unscored
  CVE-2020-0655 A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an authenticated attacker abuses clipb…

  Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems

  EPSS 66%