Week 21, 2020
18–24 May 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 8.3%
- Critical 9.8 EPSS 7.1%
- Critical 9.8 EPSS 4.5%
-
Critical 9.8
CVE-2020-9409 TIBCO JasperReports Server Fails To Enforce Access RestrictionsEPSS 3.5%
TIBCO Software · TIBCO JasperReports Server · TIBCO JasperReports Server for ActiveMatrix BPM · TIBCO JasperReports Server for AWS Marketplace
-
Critical 9.8
CVE-2020-6091 An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303.…EPSS 2.4%
- Critical 9.8 EPSS 2.1%
-
Critical 9.6
CVE-2020-11551 An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-B…EPSS 1.7%
- Critical 9.9
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.8 EPSS 98%
-
Unscored
CVE-2020-12259 rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting…EPSS 96%
-
Unscored
CVE-2020-12256 rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary Java…EPSS 96%
-
Unscored
CVE-2020-13167 Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command li…EPSS 95%
-
High 7.5
CVE-2020-8617 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.cEPSS 93%
-
Unscored
CVE-2020-13166 The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' install…EPSS 78%
-
Unscored
CVE-2020-12255 rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file upload by chec…EPSS 58%
- High 7.0 EPSS 56%
Advisories
- SUSE / openSUSE Security Updates 484 critical
- Ubuntu Security Notices (USN) 14
- Debian Security (DSA / DLA) 12
- BSI CERT-Bund (WID) 121 critical
- Amazon Linux Security Center (ALAS) 51 critical
- CISA ICS & IT advisories 42 critical
- Oracle Linux Security Advisories (ELSA) 3
- Rocky Linux Security Advisories 1
- Microsoft Security Response Center 1
- ALAS2-2020-1429 Critical: thunderbird security update (Amazon Linux 2) 10 CVEs
- WID-SEC-2023-1093 Ruby on Rails: Mehrere Schwachstellen 5 CVEs
- ICSA-20-140-02 Emerson OpenEnterprise 3 CVEs
- SUSE-SU-2020:1392-1 Security update for salt 2 CVEs
- SUSE-SU-2020:1295-1 Security update for git 2 CVEs
- SUSE-SU-2020:1383-1 Security update for dom4j 1 CVEs
- SUSE-SU-2020:1382-1 Security update for dom4j 1 CVEs
- ICSA-20-142-01 Johnson Controls Software House C-CURE 9000 and American Dynamics victor VMS 1 CVEs