Week 27, 2020
29 June – 5 July 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-5902 In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also …EPSS 100%
-
Critical 9.8
CVE-2020-15415 On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharac…EPSS 84%
-
Critical 9.8
CVE-2020-15069 Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF…EPSS 11%
-
Critical 9.9
CVE-2020-15049 An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed aga…EPSS 5.3%
- Critical 10.0 EPSS 4.4%
- Critical 9.8 EPSS 2.9%
- Critical 9.8 EPSS 2.5%
- Critical 9.8 EPSS 1.8%
- Critical 9.8
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-14092 The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.EPSS 95%
- High 8.8 EPSS 82%
- Unscored EPSS 67%
- Unscored EPSS 58%
- Unscored EPSS 53%
-
Unscored
CVE-2020-9483 **Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which al…EPSS 34%
-
Unscored
CVE-2020-14947 OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/…EPSS 19%
-
Unscored
CVE-2020-13896 The web interface of Maipu MP1800X-50 7.5.3.14(R) devices allows remote attackers to obtain sensitive information via the form/formDeviceVerGet URI, such as sy…EPSS 15%
Advisories
- SUSE / openSUSE Security Updates 32
- Debian Security (DSA / DLA) 20
- BSI CERT-Bund (WID) 111 critical
- Ubuntu Security Notices (USN) 7
- CISA ICS & IT advisories 52 critical
- Rocky Linux Security Advisories 1
- AlmaLinux Security Advisories 1
- CERT@VDE 1
- ICSMA-20-184-01 OpenClinic GA (Update B) 11 CVEs
- ICSA-20-184-01 Nortek Linear eMerge 50P/5000P 5 CVEs
- WID-SEC-2025-0288 Sophos XG Firewall: Schwachstelle ermöglicht Codeausführung 1 CVEs