Week 33, 2020
10–16 August 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-17463 FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.EPSS 90%
-
Critical 9.8
CVE-2020-17496 vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: thi…EPSS 87%
-
Critical 10.0
CVE-2020-6932 An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0 …EPSS 3.6%
- Critical 9.8 EPSS 2.5%
- Critical 9.8 EPSS 2.4%
- Critical 9.8 EPSS 2%
- Critical 9.8 EPSS 1.9%
-
Critical 9.0
CVE-2020-6284 SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate fi…EPSS 1.8%
- Critical 10.0 EPSS 1.2%
- Critical 9.6
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-17506 Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the …EPSS 94%
- High 8.0 EPSS 83%
-
Unscored
CVE-2020-17505 Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are execute…EPSS 82%
-
Unscored
CVE-2020-16139 A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the device remotely through sending specially…EPSS 80%
-
Unscored
CVE-2020-16205 Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior …EPSS 61%
-
Unscored
CVE-2020-16138 A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is powe…EPSS 21%
-
Unscored
CVE-2020-16137 A privilege escalation issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to reset the credentials for the SSH adminis…EPSS 19%
-
Medium 6.5
CVE-2019-5591 A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating t…EPSS 19%
Advisories
- SUSE / openSUSE Security Updates 451 critical
- Debian Security (DSA / DLA) 161 critical
- CISA ICS & IT advisories 83 critical
- Schneider Electric CPCERT 81 critical
- Ubuntu Security Notices (USN) 71 critical
- BSI CERT-Bund (WID) 6
- Oracle Linux Security Advisories (ELSA) 4
- AlmaLinux Security Advisories 1
- USN-4459-1 salt vulnerabilities 5 CVEs
- SUSE-SU-2020:2200-1 Security update for google-compute-engine 3 CVEs
- ICSA-20-224-02 Schneider Electric APC Easy UPS On-Line 2 CVEs
- SEVD-2020-224-04 APC Easy UPS On-Line Software 2 CVEs
- ICSA-20-224-06 Siemens Desigo CC 1 CVEs
- ICSA-20-224-04 Siemens SCALANCE, RUGGEDCOM 1 CVEs
- DSA-4743-1 ruby-kramdown - security update 1 CVEs