Week 23, 2020
1–7 June 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 50%
-
Critical 9.8
CVE-2020-4450 IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequenc…EPSS 35%
- Critical 9.8 EPSS 31%
-
Critical 9.8
CVE-2020-4448 IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a special…EPSS 13%
- Critical 9.1 EPSS 5%
-
Critical 9.8
CVE-2020-3258 Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution VulnerabilitiesEPSS 4.8%
-
Critical 9.8
CVE-2020-3198 Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution VulnerabilitiesEPSS 4.6%
- Critical 9.8 EPSS 3.5%
- Critical 9.0 EPSS 3.4%
- Critical 9.0 EPSS 2.9%
- Critical 9.0 EPSS 2.9%
- Critical 9.8 EPSS 1.5%
- Critical 10.0 EPSS 1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 5.8 EPSS 100%
- High 7.5 EPSS 96%
-
Unscored
CVE-2020-10546 rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext…EPSS 87%
-
Unscored
CVE-2020-7115 The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then ex…EPSS 65%
-
Unscored
CVE-2020-13818 In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.EPSS 38%
-
Unscored
CVE-2020-10547 rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cle…EPSS 37%
-
Unscored
CVE-2020-10548 rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vuln…EPSS 37%
-
Unscored
CVE-2020-10549 rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vul…EPSS 32%
Advisories
- SUSE / openSUSE Security Updates 25
- Oracle Linux Security Advisories (ELSA) 10
- Debian Security (DSA / DLA) 9
- Ubuntu Security Notices (USN) 9
- BSI CERT-Bund (WID) 8
- CISA ICS & IT advisories 63 critical
- Amazon Linux Security Center (ALAS) 4
- CERT@VDE 11 critical
- ICSA-20-154-04 ABB Central Licensing System 5 CVEs
- VDE-2020-018 PHOENIX CONTACT: FL MGUARD, TC MGUARD, TC ROUTER and TC CLOUD CLIENT: PPPD vulnerable to CVE-2020-8597 1 CVEs
- ICSA-20-154-06 SWARCO CPU LS4000 1 CVEs
- ICSA-20-154-05 GE Grid Solutions Reason RT Clocks 1 CVEs