Week 11, 2020
9–15 March 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 10.0
CVE-2020-0796 A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows S…EPSS 100%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
Critical 10.0
CVE-2020-6207 SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resultin…EPSS 98%
-
Critical 9.8
CVE-2020-1947 Deserialization of Untrusted Data in Apache ShardingSphereEPSS 34%
Apache Software Foundation · Apache ShardingSphere(incubator)
-
Critical 9.8
CVE-2020-10181 goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a devic…EPSS 15%
-
Critical 9.8
CVE-2020-10257 The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functio…EPSS 8.9%
- Critical 10.0 EPSS 6.3%
- Critical 9.8 EPSS 4%
- Critical 9.8 EPSS 3.3%
- Critical 9.8 EPSS 2.7%
- Critical 9.8 EPSS 2.7%
- Critical 9.8 EPSS 2.7%
- Critical 9.8 EPSS 2.6%
- Critical 9.8 EPSS 2.6%
- Critical 9.8 EPSS 2.6%
- Critical 9.8 EPSS 2.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 6.1 EPSS 76%
-
High 7.2
CVE-2016-11021 setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.EPSS 70%
-
High 7.8
CVE-2020-0787 An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows …EPSS 43%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
Unscored
CVE-2020-0883 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E…EPSS 22%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
Unscored
CVE-2020-10567 An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validati…EPSS 20%
-
Unscored
CVE-2020-0881 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E…EPSS 17%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
High 7.5
CVE-2020-0827 Out-of-bounds write in ChakraCoreEPSS 13%
Microsoft · ChakraCore · Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for ARM64-based Systems · Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for 32-bit Systems
-
High 7.5
CVE-2020-0825 Out-of-bounds write in ChakraCoreEPSS 13%
Microsoft · ChakraCore · Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for 32-bit Systems · Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for ARM64-based Systems
Advisories
- SUSE / openSUSE Security Updates 388 critical
- Debian Security (DSA / DLA) 11
- CISA ICS & IT advisories 82 critical
- CERT@VDE 82 critical
- BSI CERT-Bund (WID) 4
- Schneider Electric CPCERT 4
- Ubuntu Security Notices (USN) 3
- Oracle Linux Security Advisories (ELSA) 2
- Amazon Linux Security Center (ALAS) 1
- Siemens ProductCERT 1
- SUSE-SU-2020:0640-1 Security update for ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, mariadb, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, opens 14 CVEs
- SUSE-SU-2020:0632-1 Security update for tomcat 6 CVEs
- ICSA-20-070-06 Rockwell Automation MicroLogix Controllers and RSLogix 500 Software 4 CVEs
- VDE-2020-008 WAGO: Cloud Connectivity Multiple Vulnerabilities 4 CVEs
- openSUSE-SU-2020:0345-1 Security update for tomcat 3 CVEs
- SUSE-SU-2020:0642-1 Security update for ardana-ansible, ardana-cinder, ardana-cobbler, ardana-db, ardana-horizon, ardana-input-model, ardana-monasca, ardana-mq, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-designate, openstack-heat, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-ir 3 CVEs
- SUSE-SU-2020:0631-1 Security update for tomcat 3 CVEs
- SUSE-RU-2020:0685-1 Recommended update for Salt 2 CVEs
- SUSE-SU-2020:0684-1 Security update for salt 2 CVEs
- SUSE-RU-2020:0625-1 Recommended update for Salt 2 CVEs