Week 31, 2020
27 July – 2 August 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.1
CVE-2020-5377 Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker coul…EPSS 49%
-
Critical 9.8
CVE-2020-15612 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.4%
-
Critical 9.8
CVE-2020-15435 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.4%
-
Critical 9.8
CVE-2020-15434 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.4%
-
Critical 9.8
CVE-2020-15429 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.4%
-
Critical 9.8
CVE-2020-15422 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.4%
-
Critical 9.8
CVE-2020-15623 This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not requ…EPSS 8.3%
-
Critical 9.8
CVE-2020-15611 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.3%
-
Critical 9.8
CVE-2020-15614 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.1%
-
Critical 9.8
CVE-2020-15615 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.1%
-
Critical 9.8
CVE-2020-15613 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.1%
-
Critical 9.8
CVE-2020-15610 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.1%
-
Critical 9.8
CVE-2020-15609 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.1%
-
Critical 9.8
CVE-2020-15608 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.1%
-
Critical 9.8
CVE-2020-15606 This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…EPSS 8.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.8
CVE-2020-10924 This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Although au…EPSS 87%
-
Medium 6.5
CVE-2020-10923 This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authenticat…EPSS 85%
-
High 7.5
CVE-2020-15419 This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not …EPSS 60%
-
High 7.2
CVE-2020-8218 A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the ad…EPSS 32%
-
High 8.2
CVE-2020-4463 IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker coul…EPSS 32%
-
Unscored
CVE-2020-13699 TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parame…EPSS 26%
-
Unscored
CVE-2020-16157 A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.EPSS 14%
-
Unscored
CVE-2020-15588 An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in In…EPSS 13%
Advisories
- SUSE / openSUSE Security Updates 352 critical
- Debian Security (DSA / DLA) 263 critical
- Ubuntu Security Notices (USN) 16
- Oracle Linux Security Advisories (ELSA) 13
- CISA ICS & IT advisories 83 critical
- BSI CERT-Bund (WID) 6
- Amazon Linux Security Center (ALAS) 3
- Rocky Linux Security Advisories 2
- AlmaLinux Security Advisories 1
- SUSE-RU-2020:2072-1 Security update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper 31 CVEs
- SUSE-SU-2020:2057-1 Security update for python-Pillow 8 CVEs
- DLA-2293-1 mercurial - security update 6 CVEs
- ICSA-20-210-01 Secomea GateManager 4 CVEs
- DLA-2294-1 salt - security update 2 CVEs
- ICSA-20-210-02 Softing Industrial Automation OPC 2 CVEs
- DLA-2307-1 ruby-zip - security update 1 CVEs
- ICSA-20-210-03 HMS Industrial Networks eCatcher 1 CVEs