Week 19, 2020

4–10 May 2020

New CVEs: 297
Critical: 16
High: 64
Newly exploited: 0
Advisories: 152
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.1
CVE-2020-3187 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability
Cisco · Cisco Adaptive Security Appliance (ASA) Software

EPSS 97%
Critical 9.8
CVE-2020-12641 rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert…
EPSS 84%
Critical 10.0
CVE-2020-4429 IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could expl…
IBM · Data Risk Manager

EPSS 72%
Critical 9.0
CVE-2020-4427 IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML auth…
IBM · Data Risk Manager

EPSS 70%
Critical 9.1
CVE-2020-4428 IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 1…
IBM · Data Risk Manager

EPSS 62%
Critical 10.0
CVE-2020-8899 Memory corruption in Quram library when decoding qmg can lead to RCE
Samsung · Android OS

EPSS 6.1%
Critical 9.8
CVE-2020-1959 Expression Language Injection in Apache Syncope
EPSS 5%
Critical 9.8
CVE-2020-1961 Injection in Apache Syncope
EPSS 4.8%
Critical 9.8
CVE-2020-6075 An exploitable out-of-bounds write vulnerability exists in the store_data_buffer function of the igcore19d.dll library of Accusoft ImageGear 19.5.0. A speciall…
EPSS 3.7%
Critical 9.8
CVE-2020-6076 An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll ICO icoread parser of the Accusoft ImageGear 19.5.0 library. A specially crafted I…
EPSS 3.7%
Critical 9.8
CVE-2020-6082 An exploitable out-of-bounds write vulnerability exists in the ico_read function of the igcore19d.dll library of Accusoft ImageGear 19.6.0. A specially crafted…
EPSS 3.7%
Critical 9.8
CVE-2020-6094 An exploitable code execution vulnerability exists in the TIFF fillinraster function of the igcore19d.dll library of Accusoft ImageGear 19.4, 19.5 and 19.6. A …
EPSS 3.7%
Critical 9.8
CVE-2020-7646 curlrequest allows execution of arbitrary commands
EPSS 1.9%
Critical 9.9
CVE-2020-6081 An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially cra…
EPSS 1.8%
Critical 9.0
CVE-2020-11050 Improper Validation of Certificate with Host Mismatch in Java-WebSocket
TooTallNate · Java-WebSocket

All 16 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

ICSA-20-128-01 Advantech WebAccess Node 8 CVEs
DSA-4680-1 tomcat9 - security update 6 CVEs
ELSA-2020-2031 Critical: firefox security update (Oracle Linux 8) 4 CVEs
ELSA-2020-2037 Critical: firefox security update (Oracle Linux 7) 4 CVEs
DSA-4676-1 salt - security update 3 CVEs
DSA-4676-2 salt - security update 2 CVEs
SUSE-SU-2020:1194-1 Security update for python-Pillow 2 CVEs
ICSA-20-126-02 SAE IT-systems FW-50 Remote Telemetry Unit (RTU) 2 CVEs
WID-SEC-2024-1449 SaltStack Salt: Mehrere Schwachstellen ermöglichen Erlangen von Administratorrechten 2 CVEs
openSUSE-SU-2020:0630-1 Security update for python-PyYAML 1 CVEs