Week 29, 2020
13–19 July 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 10.0
CVE-2020-1350 A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote C…EPSS 97%
Microsoft · Windows Server, version 1903 (Server Core installation) · Windows Server, version 1909 (Server Core installation) · Windows Server
-
Critical 10.0
CVE-2020-6287 SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without p…EPSS 95%
-
Critical 9.8
CVE-2020-14644 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.…EPSS 95%
-
Critical 9.8
CVE-2020-10987 The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST …EPSS 80%
-
Critical 9.8
CVE-2020-14645 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.…EPSS 47%
- Critical 9.8 EPSS 42%
- Critical 9.8 EPSS 37%
- Critical 9.8 EPSS 20%
- Critical 9.8 EPSS 16%
-
Critical 9.8
CVE-2020-14625 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.…EPSS 9.9%
-
Critical 9.0
CVE-2020-1040 A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest…EPSS 7.6%
- Critical 9.8 EPSS 7.2%
-
Critical 9.8
CVE-2020-3323 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution VulnerabilityEPSS 5.7%
- Critical 9.8 EPSS 4.6%
-
Critical 9.8
CVE-2020-3357 Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers SSL Remote Code Execution and Denial of Service VulnerabilityEPSS 4.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.8 EPSS 99%
-
Unscored
CVE-2020-9496 XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03EPSS 99%
-
High 7.8
CVE-2020-1147 .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution VulnerabilityEPSS 96%
Microsoft · Microsoft SharePoint Server · Microsoft SharePoint Enterprise Server · Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- High 7.5 EPSS 87%
-
Unscored
CVE-2020-1421 A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successful…EPSS 75%
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems
-
High 7.5
CVE-2020-13934 Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache TomcatEPSS 64%
-
Unscored
CVE-2020-15050 An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Trave…EPSS 51%
-
Unscored
CVE-2020-8958 Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allow remote attackers to execute arbitrary …EPSS 46%
Advisories
- SUSE / openSUSE Security Updates 675 critical
- Oracle Linux Security Advisories (ELSA) 152 critical
- Amazon Linux Security Center (ALAS) 15
- Debian Security (DSA / DLA) 111 critical
- CISA ICS & IT advisories 94 critical
- BSI CERT-Bund (WID) 61 critical
- Ubuntu Security Notices (USN) 4
- Siemens ProductCERT 1
- Schneider Electric CPCERT 1
- WID-SEC-2024-2181 Oracle Fusion Middleware: Mehrere Schwachstellen 70 CVEs
- SUSE-SU-2020:1901-1 Security update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-im 23 CVEs
- DLA-2280-1 python3.5 - security update 13 CVEs
- ICSA-20-196-03 Siemens SICAM MMU, SICAM T, and SICAM SGU 9 CVEs
- ICSA-20-196-01 Advantech iView 6 CVEs
- openSUSE-SU-2020:1014-1 Security update for google-compute-engine 3 CVEs
- openSUSE-SU-2020:0996-1 Security update for google-compute-engine 3 CVEs
- SUSE-SU-2020:1934-1 Security update for google-compute-engine 3 CVEs
- SUSE-SU-2020:1946-1 Security update for squid 1 CVEs
- ELSA-2020-2954 Critical: .NET Core 3.1 security and bugfix update (Oracle Linux 8) 1 CVEs