Week 28, 2020
6–12 July 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-15505 A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 …EPSS 100%
- Critical 9.4 EPSS 11%
- Critical 9.8 EPSS 2.8%
-
Critical 9.8
CVE-2020-5368 Dell EMC VxRail versions 4.7.410 and 4.7.411 contain an improper authentication vulnerability. A remote unauthenticated attacker may exploit this vulnerability…EPSS 2%
- Critical 9.8 EPSS 1.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Medium 6.5
CVE-2020-8193 Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP …EPSS 88%
-
Unscored
CVE-2020-15299 A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into subm…EPSS 47%
-
Unscored
CVE-2020-7457 In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchro…EPSS 33%
-
Medium 6.5
CVE-2020-8195 Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-O…EPSS 33%
-
Medium 4.3
CVE-2020-8196 Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP …EPSS 26%
-
Unscored
CVE-2020-8191 Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-O…EPSS 23%
-
High 8.8
CVE-2020-9377 D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer s…EPSS 22%
-
Unscored
CVE-2020-9376 D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects produ…EPSS 18%
Advisories
- SUSE / openSUSE Security Updates 51
- Debian Security (DSA / DLA) 121 critical
- Ubuntu Security Notices (USN) 12
- Oracle Linux Security Advisories (ELSA) 6
- CISA ICS & IT advisories 41 critical
- Rocky Linux Security Advisories 2
- AlmaLinux Security Advisories 2
- CERT@VDE 11 critical
- BSI CERT-Bund (WID) 1
- VDE-2020-024 Miele: Treck TCP/IP Vulnerabilities (Ripple20) affecting Communication Module XKM3000 L MED 19 CVEs
- ICSA-20-189-02 Mitsubishi Electric GOT2000 Series 6 CVEs
- DLA-2273-1 shiro - security update 2 CVEs