Week 34, 2020
17–23 August 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.1
CVE-2020-24589 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.EPSS 26%
-
Critical 10.0
CVE-2020-1467 Windows Hard Link Elevation of Privilege VulnerabilityEPSS 3.5%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
- Critical 9.8 EPSS 3.4%
- Critical 9.8 EPSS 2.8%
- Critical 9.8 EPSS 2.8%
- Critical 9.8 EPSS 2.7%
- Critical 9.9 EPSS 2.4%
- Critical 9.6 EPSS 2.1%
- Critical 9.1 EPSS 2.1%
- Critical 9.8 EPSS 1.9%
- Critical 9.8 EPSS 1.9%
- Critical 9.1 EPSS 1.9%
-
Critical 9.1
CVE-2020-24590 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.EPSS 1.3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Medium 5.5
CVE-2020-1472 Netlogon Elevation of Privilege VulnerabilityEPSS 99%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2016
-
Unscored
CVE-2020-17456 SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.EPSS 74%
- High 7.5 EPSS 44%
-
Unscored
CVE-2020-8209 Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Cit…EPSS 44%
-
High 7.8
CVE-2020-1464 Windows Spoofing VulnerabilityEPSS 39%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
High 7.8
CVE-2020-9715 Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free…EPSS 33%
-
Unscored
CVE-2020-8227 Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedica…EPSS 26%
- High 7.8 EPSS 24%
Advisories
- SUSE / openSUSE Security Updates 27
- Ubuntu Security Notices (USN) 13
- Debian Security (DSA / DLA) 111 critical
- Amazon Linux Security Center (ALAS) 9
- BSI CERT-Bund (WID) 3
- CISA ICS & IT advisories 21 critical
- CERT@VDE 1
- DLA-2337-1 python2.7 - security update 8 CVEs
- ICSA-20-203-01 Wibu-Systems CodeMeter (Update F) 6 CVEs