Week 17, 2020
20–26 April 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-10915 This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to…EPSS 88%
-
Critical 9.8
CVE-2020-10914 This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to…EPSS 48%
-
Critical 9.8
CVE-2020-4415 IBM Spectrum Protect 7.1 and 8.1 server is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker …EPSS 8.1%
- Critical 9.8 EPSS 2.1%
- Critical 9.3 EPSS 1.9%
- Critical 9.9 EPSS 1.9%
- Critical 9.4 EPSS 1.6%
-
Critical 9.8
CVE-2020-7489 A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert…EPSS 1.6%
-
Critical 9.1
CVE-2020-12073 The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.EPSS 1.6%
-
Critical 9.1
CVE-2019-19104 ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Improper Authentication and Access ControlEPSS 1.4%
ABB · Busch-Jaeger · TG/S 3.2 Telephone Gateway · 6186/11 Telefon-Gateway
-
Critical 9.1
CVE-2019-19106 ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Access Control issuesEPSS 1.3%
ABB · Busch-Jaeger · TG/S 3.2 Telephone Gateway · 6186/11 Telefon-Gateway
- Critical 9.6
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.5 EPSS 53%
-
Unscored
CVE-2020-11946 Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.EPSS 52%
-
Unscored
CVE-2020-11945 An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwis…EPSS 27%
-
High 8.1
CVE-2020-6820 Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing thi…EPSS 7.1%
Mozilla · Firefox · Thunderbird · Firefox ESR
-
High 7.8
CVE-2020-10902 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to…EPSS 6.8%
-
High 7.8
CVE-2020-10898 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to…EPSS 6.8%
-
High 7.8
CVE-2020-10897 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to…EPSS 6.8%
-
High 7.8
CVE-2020-10895 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to…EPSS 6.8%
Advisories
- SUSE / openSUSE Security Updates 303 critical
- Debian Security (DSA / DLA) 141 critical
- Oracle Linux Security Advisories (ELSA) 8
- Ubuntu Security Notices (USN) 7
- BSI CERT-Bund (WID) 6
- Amazon Linux Security Center (ALAS) 5
- AlmaLinux Security Advisories 1
- CISA ICS & IT advisories 11 critical
- openSUSE-SU-2020:0554-1 Security update for kubernetes 7 CVEs
- SUSE-SU-2020:1111-1 Security update for apache2 3 CVEs
- SUSE-SU-2020:14342-1 Security update for apache2 2 CVEs
- DSA-4663-1 python-reportlab - security update 1 CVEs
- ICSA-20-112-01 Inductive Automation Ignition 1 CVEs