Week 12, 2020
16–22 March 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 100%
- Critical 9.8 EPSS 96%
- Critical 9.8 EPSS 19%
-
Critical 9.8
CVE-2020-8599 Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary p…EPSS 12%
-
Critical 9.8
CVE-2020-6990 Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw…EPSS 5.9%
-
Critical 9.1
CVE-2019-18582 Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template in…EPSS 4.6%
- Critical 9.8 EPSS 4.3%
-
Critical 9.1
CVE-2019-18581 Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authoriz…EPSS 3.9%
- Critical 9.8 EPSS 3.9%
-
Critical 9.8
CVE-2020-6984 Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw…EPSS 3.9%
- Critical 9.8 EPSS 2.3%
- Critical 9.3 EPSS 1.6%
- Critical 9.8 EPSS 1.5%
- Critical 9.8 EPSS 1.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.5 EPSS 93%
-
Unscored
CVE-2020-10808 Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a …EPSS 78%
- Unscored EPSS 71%
-
Unscored
CVE-2020-10819 Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.EPSS 71%
- Medium 5.4 EPSS 54%
-
Unscored
CVE-2020-5844 index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and exe…EPSS 30%
-
Unscored
CVE-2019-16072 An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code …EPSS 26%
-
Unscored
CVE-2020-10820 Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.EPSS 19%
Advisories
- Debian Security (DSA / DLA) 181 critical
- SUSE / openSUSE Security Updates 182 critical
- Oracle Linux Security Advisories (ELSA) 12
- Ubuntu Security Notices (USN) 81 critical
- BSI CERT-Bund (WID) 4
- CISA ICS & IT advisories 3
- Rocky Linux Security Advisories 2
- AlmaLinux Security Advisories 2
- Amazon Linux Security Center (ALAS) 2
- Schneider Electric CPCERT 1
- USN-4308-1 twisted vulnerabilities 7 CVEs
- openSUSE-SU-2020:0357-1 Security update for salt 2 CVEs
- DLA-2145-1 twisted - security update 2 CVEs
- SUSE-SU-2020:0725-1 Security update for tomcat 1 CVEs