Week 15, 2020
6–12 April 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-3952 Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctl…EPSS 90%
- Critical 9.8 EPSS 4.4%
- Critical 9.8 EPSS 4.4%
- Critical 9.8 EPSS 4.4%
- Critical 9.8 EPSS 4.4%
- Critical 9.8 EPSS 3.9%
- Critical 9.8 EPSS 3.6%
- Critical 9.8 EPSS 2.8%
- Critical 9.8 EPSS 1.8%
-
Critical 9.4
CVE-2020-10265 RVD#1443: UR dashboard server enables unauthenticated remote control of core robot functionsEPSS 1.5%
Universal Robots · Universal Robots Robot Controllers CB 2, CB3, e-series
-
Critical 10.0
CVE-2020-1614 NFX250 Series: Hardcoded credentials in the vSRX VNF instance.EPSS 1.4%
Juniper Networks · Juniper Networks NFX Series Network Services Platform
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-10977 GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.EPSS 43%
-
High 8.8
CVE-2020-5735 Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the dev…EPSS 36%
-
Unscored
CVE-2020-11710 An issue was discovered in docker-kong (for Kong) through 2.0.3. The admin API port may be accessible on interfaces other than 127.0.0.1. NOTE: The vendor argu…EPSS 33%
-
Unscored
CVE-2019-19699 There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compr…EPSS 26%
-
Unscored
CVE-2020-5734 Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'SigPubkeyLen' during …EPSS 25%
-
Unscored
CVE-2020-10619 An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control.EPSS 14%
-
High 8.1
CVE-2020-5330 Dell EMC Networking X-Series firmware versions 3.0.1.2 and older, Dell EMC Networking PC5500 firmware versions 4.1.0.22 and older and Dell EMC PowerEdge VRTX S…EPSS 13%
-
Unscored
CVE-2020-11514 The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to es…EPSS 11%
Advisories
- Oracle Linux Security Advisories (ELSA) 572 critical
- SUSE / openSUSE Security Updates 382 critical
- Ubuntu Security Notices (USN) 10
- CISA ICS & IT advisories 61 critical
- AlmaLinux Security Advisories 6
- Debian Security (DSA / DLA) 4
- Rocky Linux Security Advisories 4
- BSI CERT-Bund (WID) 3
- ICSA-20-098-01 Advantech WebAccess/NMS 8 CVEs
- ELSA-2020-1338 Critical: firefox security update (Oracle Linux 7) 2 CVEs
- ELSA-2020-1341 Critical: firefox security update (Oracle Linux 8) 2 CVEs
- openSUSE-SU-2020:0507-1 Security update for python-PyYAML 1 CVEs
- SUSE-SU-2020:0959-1 Security update for python-PyYAML 1 CVEs