Week 8, 2020
17–23 February 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-7796 Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.EPSS 94%
-
Critical 9.8
CVE-2020-3765 Adobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.EPSS 5.6%
- Critical 9.8 EPSS 5.3%
- Critical 9.8 EPSS 5.1%
- Critical 9.8 EPSS 5%
- Critical 9.8 EPSS 4.5%
- Critical 9.8 EPSS 3.5%
- Critical 9.8 EPSS 3.5%
- Critical 9.8 EPSS 2.6%
- Critical 9.8 EPSS 2.6%
- Critical 9.8 EPSS 2%
-
Critical 9.3
CVE-2020-9265 phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmc_username.EPSS 1.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2015-6922 Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authe…EPSS 82%
-
Unscored
CVE-2020-8012 CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) componen…EPSS 77%
CA Technologies, A Broadcom Company · CA Unified Infrastructure Management (Nimsoft/UIM)
-
Unscored
CVE-2020-8813 graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph …EPSS 74%
-
Unscored
CVE-2020-8518 Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.EPSS 72%
-
Unscored
CVE-2014-9614 The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain acce…EPSS 69%
-
Unscored
CVE-2014-7236 Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins pa…EPSS 56%
-
Unscored
CVE-2020-8010 CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) c…EPSS 51%
CA Technologies, A Broadcom Company · CA Unified Infrastructure Management (Nimsoft/UIM)
-
Medium 6.5
CVE-2020-3153 Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path VulnerabilityEPSS 29%
Advisories
- SUSE / openSUSE Security Updates 31
- Debian Security (DSA / DLA) 207 critical
- Ubuntu Security Notices (USN) 151 critical
- Oracle Linux Security Advisories (ELSA) 10
- CISA ICS & IT advisories 85 critical
- Amazon Linux Security Center (ALAS) 3
- BSI CERT-Bund (WID) 2
- CERT@VDE 11 critical
- ICSA-20-051-04 Auto-Maskin RP210E, DCU210E, and Marine Observer Pro (Android App) 6 CVEs
- DLA-2110-1 netty-3.9 - security update 6 CVEs
- DSA-4631-1 pillow - security update 3 CVEs
- DLA-2109-1 netty - security update 3 CVEs
- DLA-2111-1 jackson-databind - security update 2 CVEs
- ICSA-20-051-03 Honeywell NOTI-FIRE-NET Web Server (NWS-3) 2 CVEs
- DSA-4632-1 ppp - security update 1 CVEs
- USN-4288-1 ppp vulnerability 1 CVEs
- DLA-2112-1 python-reportlab - security update 1 CVEs
- ICSA-20-051-02 Rockwell Automation FactoryTalk Diagnostics 1 CVEs