Week 26, 2020

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2020-9480 Improper Authentication in Apache Spark

  Apache Software Foundation · Apache Spark

  EPSS 30%
• Critical 9.8
  CVE-2020-11989 Improper Authentication in Apache Shiro

  Apache Software Foundation · Apache Shiro

  EPSS 24%
• Critical 9.8
  CVE-2020-9631 Magento security mitigation bypass vulnerability

  Adobe · Magento

  EPSS 7.6%
• Critical 9.8
  CVE-2020-9632 Magento security mitigation bypass vulnerability

  Adobe · Magento

  EPSS 7.6%
• Critical 9.8
  CVE-2020-9576 Magento command injection vulnerability

  Adobe · Magento

  EPSS 5.9%
• Critical 9.8
  CVE-2020-9578 Magento command injection vulnerability

  Adobe · Magento

  EPSS 5.9%
• Critical 9.8
  CVE-2020-9582 Magento command injection vulnerability

  Adobe · Magento

  EPSS 5.9%
• Critical 9.8
  CVE-2020-9583 Magento command injection vulnerability

  Adobe · Magento

  EPSS 5.9%
• Critical 9.8
  CVE-2020-9580 Magento Security mitigation bypass vulnerability

  Adobe · Magento

  EPSS 5.2%
• Critical 9.8
  CVE-2020-9579 Magento Security mitigation bypass vulnerability

  Adobe · Magento

  EPSS 5.2%
• Critical 9.8
  CVE-2020-9585 Magento Defense-in-depth security mitigation vulnerability

  Adobe · Magento

  EPSS 5.1%
• Critical 10.0
  CVE-2018-21268 Node-Traceroute RCE Vulnerability
  EPSS 4.3%
• Critical 9.8
  CVE-2020-9630 Magento business logic error vulnerability

  Adobe · Magento

  EPSS 4.1%
• Critical 9.8
  CVE-2020-14968 RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign
  EPSS 2.9%
• Critical 10.0
  CVE-2020-10272 RVD#2554: MiR ROS computational graph presents no authentication mechanisms

  Mobile Industrial Robots A/S · MiR100

  EPSS 2.5%

All 25 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2020-13158 Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter.
  EPSS 52%
• Unscored
  CVE-2020-9590 Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code exec…

  Adobe · Adobe DNG Software Development Kit (SDK)

  EPSS 40%
• High 7.5
  CVE-2020-11996 Uncontrolled Resource Consumption in Apache Tomcat

  Apache · Apache Tomcat

  EPSS 27%
• Unscored
  CVE-2020-14005 Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined even…
  EPSS 14%
• High 7.5
  CVE-2020-13700 acf-to-rest-api plugin insecure direct object reference (IDOR) via permalink manipulation
  EPSS 13%
• Unscored
  CVE-2020-14945 A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privileged user to escal…
  EPSS 11%
• Unscored
  CVE-2020-9597 Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an ou…

  Adobe · Adobe Acrobat and Reader

  EPSS 10%
• Unscored
  CVE-2020-14461 Zyxel Armor X1 WAP6806 1.00(ABAL.6)C0 devices allow Directory Traversal via the images/eaZy/ URI.
  EPSS 9.5%