Week 24, 2020
8–14 June 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 2.6%
- Critical 9.8 EPSS 2.6%
- Critical 9.8 EPSS 2.6%
-
Critical 10.0
CVE-2020-9412 TIBCO Managed File Transfer Platform Server for IBM i Arbitrary Command ExecutionEPSS 2.3%
TIBCO Software · TIBCO Managed File Transfer Platform Server for IBM i
- Critical 9.8 EPSS 1.6%
-
Critical 10.0
CVE-2020-9411 TIBCO Managed File Transfer Platform Server for IBM i Authentication BypassEPSS 1.4%
TIBCO Software · TIBCO Managed File Transfer Platform Server for IBM i
-
Critical 9.8
CVE-2020-6265 SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication …EPSS 1.4%
- Critical 9.6 EPSS 1.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Unscored EPSS 91%
-
Unscored
CVE-2020-13160 AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.EPSS 81%
-
Unscored
CVE-2020-12800 The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting …EPSS 79%
-
Unscored
CVE-2020-9850 A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.1…EPSS 77%
-
Medium 6.3
CVE-2020-13965 An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the al…EPSS 77%
-
Unscored
CVE-2020-1181 A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Mic…EPSS 69%
Microsoft · Microsoft SharePoint Server · Microsoft SharePoint Enterprise Server · Microsoft SharePoint Foundation
-
Unscored
CVE-2020-1300 A remote code execution vulnerability exists when Microsoft Windows fails to properly handle cabinet files.To exploit the vulnerability, an attacker would have…EPSS 60%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
Unscored
CVE-2020-11798 A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access…EPSS 49%
Advisories
- SUSE / openSUSE Security Updates 651 critical
- Debian Security (DSA / DLA) 19
- Oracle Linux Security Advisories (ELSA) 18
- Ubuntu Security Notices (USN) 11
- CISA ICS & IT advisories 94 critical
- BSI CERT-Bund (WID) 5
- Schneider Electric CPCERT 41 critical
- Siemens ProductCERT 2
- AlmaLinux Security Advisories 2
- CERT@VDE 22 critical
- SUSE-SU-2020:1570-1 Security update for ruby2.1 42 CVEs
- ICSA-20-161-06 Siemens SINUMERIK 22 CVEs
- SEVD-2020-161-04 Easergy T300 11 CVEs
- ICSA-20-163-02 Rockwell Automation FactoryTalk Linx Software (Update A) 3 CVEs
- VDE-2020-020 WAGO: PPPD in PFC100 and PFC200 Series is vulnerable to CVE-2020-8597 1 CVEs
- VDE-2020-015 WAGO: Web Based Management - Code Execution Vulnerability 1 CVEs
- ICSA-20-161-03 Siemens LOGO! (Update A) 1 CVEs
- ICSA-20-161-01 Advantech WebAccess Node 1 CVEs