Week 32, 2020
3–9 August 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 33%
- Critical 9.6 EPSS 32%
- Critical 9.6 EPSS 17%
- Critical 10.0 EPSS 14%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Unscored EPSS 90%
-
Unscored
CVE-2020-9490 Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the serv…EPSS 89%
-
Unscored
CVE-2020-13151 Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database…EPSS 87%
-
Unscored
CVE-2020-11993 Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were m…EPSS 57%
-
Unscored
CVE-2020-15956 ActiveMediaServer.exe in ACTi NVR3 Standard Server 3.0.12.42 allows remote unauthenticated attackers to trigger a buffer overflow and application termination v…EPSS 16%
- Medium 6.5 EPSS 10%
-
Unscored
CVE-2020-16199 Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processi…EPSS 9.5%
-
Unscored
CVE-2020-11985 IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an atta…EPSS 7.1%
Advisories
- SUSE / openSUSE Security Updates 521 critical
- Ubuntu Security Notices (USN) 141 critical
- Debian Security (DSA / DLA) 121 critical
- Oracle Linux Security Advisories (ELSA) 8
- CISA ICS & IT advisories 51 critical
- BSI CERT-Bund (WID) 4
- SICK PSIRT 22 critical
- Rocky Linux Security Advisories 1
- SUSE-RU-2020:2161-1 Security update for ansible1, ardana-ansible, ardana-cobbler, ardana-glance, ardana-input-model, ardana-logging, ardana-manila, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-openstack, grafana, kibana, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-designate, openstack-heat-templates, openstack-ironic, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-neutron, o 24 CVEs
- ICSA-20-219-02 Advantech WebAccess HMI Designer 6 CVEs
- SCA-2020-0002 Vulnerabilities in SICK Package Analytics 3 CVEs
- DLA-2316-1 ruby-kramdown - security update 1 CVEs
- SCA-2020-0003 MEAC affected by Windows SMBv3 vulnerability 1 CVEs
- USN-4452-1 libvirt vulnerability 1 CVEs