Week 16, 2020

13–19 April 2020

New CVEs: 875
Critical: 35
High: 196
Newly exploited: 0
Advisories: 72
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2020-2883 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.…
Oracle · WebLogic Server

EPSS 95%
Critical 9.8
CVE-2020-3243 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Cisco · Cisco UCS Director

EPSS 88%
Critical 9.8
CVE-2020-3161 Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability
Cisco · Cisco IP phone

EPSS 84%
Critical 9.8
CVE-2020-3247 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Cisco · Cisco UCS Director

EPSS 76%
Critical 9.8
CVE-2020-3248 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Cisco · Cisco UCS Director

EPSS 74%
Critical 9.8
CVE-2020-3239 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Cisco · Cisco UCS Director

EPSS 74%
Critical 9.8
CVE-2020-2950 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions…
Oracle · Oracle Business Intelligence Enterprise Edition

EPSS 71%
Critical 9.8
CVE-2020-3251 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Cisco · Cisco UCS Director

EPSS 62%
Critical 9.8
CVE-2020-3250 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Cisco · Cisco UCS Director

EPSS 61%
Critical 9.8
CVE-2020-3240 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Cisco · Cisco UCS Director

EPSS 39%
Critical 9.8
CVE-2020-3249 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Cisco · Cisco UCS Director

EPSS 24%
Critical 9.8
CVE-2020-2733 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that is affecte…
Oracle · JD Edwards EnterpriseOne Tools

EPSS 19%
Critical 9.3
CVE-2020-5260 malicious URLs may cause Git to present stored credentials to the wrong server
git · git

EPSS 15%
Critical 9.8
CVE-2020-3252 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Cisco · Cisco UCS Director

EPSS 5.3%
Critical 9.8
CVE-2020-1964 Deserialization of Untrusted Data in Apache Heron
EPSS 4.8%

All 35 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

ICSA-20-105-03 Triangle MicroWorks SCADA Data Gateway 3 CVEs
DLA-2181-1 shiro - security update 1 CVEs
openSUSE-SU-2020:0524-1 Security update for git 1 CVEs
SUSE-SU-2020:1009-1 Security update for quartz 1 CVEs
DLA-2177-1 git - security update 1 CVEs
USN-4329-1 git vulnerability 1 CVEs
SUSE-SU-2020:0992-1 Security update for git 1 CVEs
SUSE-SU-2020:0991-1 Security update for git 1 CVEs
SUSE-SU-2020:0984-1 Security update for quartz 1 CVEs
DSA-4657-1 git - security update 1 CVEs