Week 30, 2020
20–26 July 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.0 EPSS 47%
- Critical 9.8 EPSS 8.4%
-
Critical 9.8
CVE-2020-10917 This vulnerability allows remote attackers to execute arbitrary code on affected installations of NEC ESMPRO Manager 6.42. Authentication is not required to ex…EPSS 5.6%
-
Critical 9.8
CVE-2020-10920 This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Aut…EPSS 4.9%
- Critical 9.3 EPSS 3.8%
-
Critical 9.8
CVE-2020-10921 This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authenticat…EPSS 2.8%
- Critical 9.8 EPSS 2.7%
- Critical 9.6 EPSS 1.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2020-3452 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal VulnerabilityEPSS 100%
-
Unscored
CVE-2020-15920 There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) pri…EPSS 98%
-
Unscored
CVE-2020-15922 There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges.…EPSS 57%
- High 7.3 EPSS 53%
- Medium 4.3 EPSS 53%
-
High 7.5
CVE-2020-12812 An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully wi…EPSS 45%
- Unscored EPSS 35%
-
Unscored
CVE-2020-15901 In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.EPSS 22%
Advisories
- SUSE / openSUSE Security Updates 644 critical
- Debian Security (DSA / DLA) 122 critical
- Oracle Linux Security Advisories (ELSA) 7
- Ubuntu Security Notices (USN) 7
- BSI CERT-Bund (WID) 6
- AlmaLinux Security Advisories 5
- Amazon Linux Security Center (ALAS) 3
- Rocky Linux Security Advisories 2
- CERT@VDE 1
- CISA ICS & IT advisories 11 critical
- ICSA-20-205-01 Schneider Electric Triconex TriStation and Tricon Communication Module 5 CVEs
- openSUSE-SU-2020:1074-1 Security update for salt 4 CVEs
- SUSE-SU-2020:1974-1 Security update for salt 4 CVEs
- SUSE-SU-2020:1973-1 Security update for Salt 3 CVEs
- SUSE-SU-2020:1971-1 Security update for Salt 3 CVEs
- DLA-2282-1 rails - security update 3 CVEs
- DSA-4732-1 squid - security update 2 CVEs