Week 18, 2020

27 April – 3 May 2020

New CVEs: 333
Critical: 11
High: 54
Newly exploited: 0
Advisories: 210
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2020-11651 SaltStack Salt Unauthenticated Remote Code Execution
EPSS 97%
Critical 10.0
CVE-2020-12271 A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. Thi…
EPSS 43%
Critical 9.8
CVE-2020-10683 dom4j allows External Entities by default which might enable XXE attacks
EPSS 7.3%
Critical 9.8
CVE-2020-1952 Improper Certificate Validation in Apache IoTDB
Apache · IoTDB

EPSS 2.7%
Critical 9.1
CVE-2020-11016 Remote code execution in Message sending functionality in IntelMQ Manager
certtools · IntelMQ Manager

EPSS 2.3%
Critical 9.4
CVE-2020-8479 ABB Central Licensing System - XML External Entity Injection
ABB · Symphony Plus S+ Operations · Symphony Plus S+ Engineering · Control Builder Safe

EPSS 2.3%
Critical 9.8
CVE-2020-7640 OS Command Injection in pixl-class
EPSS 2.1%
Critical 9.8
CVE-2020-8481 ABB Central Licensing System - Information disclosure
ABB · Symphony Plus S+ Operations · Control Builder Safe · Symphony Plus S+ Engineering

EPSS 1.9%
Critical 9.8
CVE-2020-7609 Code Injection in node-rules
EPSS 1.6%
Critical 9.6
CVE-2017-18853 Certain NETGEAR devices are affected by password recovery and file access. This affects D8500 1.0.3.27 and earlier, DGN2200v4 1.0.0.82 and earlier, R6300v2 1.0…
EPSS 1.1%
Critical 9.8
CVE-2020-7645 chrome-launcher subject to OS Command Injection
EPSS 1%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Medium 6.9
CVE-2020-11022 jQuery has a potential XSS vulnerability
jquery · jQuery

EPSS 99%
Medium 6.5
CVE-2020-11652 SaltStack Salt is vulnerable Arbitrary Directory Access
EPSS 86%
Medium 6.9
CVE-2020-11023 Potential XSS vulnerability in jQuery
jquery · jQuery

EPSS 85%
Unscored
CVE-2020-9294 An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthentica…
Fortinet · FortiMail · FortiVoiceEnterprise

EPSS 82%
Unscored
CVE-2020-7136 A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. Hewlett Packard Enterprise has provid…
Hewlett Packard Enterprise · Smart Update Manager (SUM)

EPSS 81%
Unscored
CVE-2019-5620 ABB MicroSCADA Pro SYS600 Missing Authentication for Critical Function
ABB · MicroSCADA Pro SYS600

EPSS 71%
High 7.3
CVE-2020-7351 Fonality Trixbox CE Post-Authentication Command Injection
Fonality · Trixbox Community Edition

EPSS 64%
Unscored
CVE-2020-6010 LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection
EPSS 49%

Advisories

openSUSE-SU-2020:0598-1 Security update for git 15 CVEs
SUSE-SU-2020:1121-1 Security update for git 15 CVEs
DSA-4671-1 vlc - security update 8 CVEs
DSA-4673-1 tomcat8 - security update 3 CVEs
openSUSE-SU-2020:0597-1 Security update for apache2 3 CVEs
SUSE-SU-2020:1126-1 Security update for apache2 3 CVEs
openSUSE-SU-2020:0607-1 Security update for bouncycastle 2 CVEs
openSUSE-SU-2020:0564-1 Security update for salt 2 CVEs
SUSE-SU-2020:1151-1 Security update for salt 2 CVEs
SUSE-SU-2020:1150-1 Security update for salt 2 CVEs