Week 22, 2020
25–31 May 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.1
CVE-2020-8816 Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.EPSS 78%
- Critical 9.8 EPSS 44%
- Critical 9.8 EPSS 2.2%
-
Critical 10.0
CVE-2020-11844 Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.EPSS 2.1%
Micro Focus · Hybrid Cloud Management · ArcSight Interset · Service Management Automation (SMA)
- Critical 10.0 EPSS 1.4%
- Critical 9.1 EPSS 1.4%
- Critical 9.6 EPSS 1.1%
- Critical 9.3
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-8604 A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installati…EPSS 90%
Trend Micro · Trend Micro InterScan Web Security Virtual Appliance
-
Unscored
CVE-2020-8605 A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Aut…EPSS 88%
Trend Micro · Trend Micro InterScan Web Security Virtual Appliance
-
Unscored
CVE-2020-8606 A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Tr…EPSS 73%
Trend Micro · Trend Micro InterScan Web Security Virtual Appliance
-
Unscored
CVE-2020-6831 A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. …EPSS 5.8%
Mozilla · Firefox · Thunderbird · Firefox ESR
-
Unscored
CVE-2020-8171 We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prio…EPSS 3.9%
-
Unscored
CVE-2020-12388 The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi…EPSS 3.5%
-
Unscored
CVE-2020-5537 Cybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors.EPSS 2.9%
-
Unscored
CVE-2020-12675 The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation…EPSS 2.8%
Advisories
- SUSE / openSUSE Security Updates 301 critical
- Debian Security (DSA / DLA) 141 critical
- Ubuntu Security Notices (USN) 9
- BSI CERT-Bund (WID) 5
- CERT@VDE 21 critical
- CISA ICS & IT advisories 21 critical
- Oracle Linux Security Advisories (ELSA) 1
- SICK PSIRT 1
- ICSA-20-147-01 Inductive Automation Ignition (Update B) 4 CVEs
- DLA-2223-1 salt - security update 2 CVEs
- VDE-2020-016 SWARCO: Critical Vulnerability in CPU LS4000 1 CVEs
- openSUSE-SU-2020:0719-1 Security update for dom4j 1 CVEs