Week 35, 2020
24–30 August 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 10.0
CVE-2020-24186 A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any …EPSS 95%
-
Critical 9.8
CVE-2020-15639 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not requ…EPSS 12%
- Critical 9.6 EPSS 4%
- Critical 9.8 EPSS 2.6%
-
Critical 9.8
CVE-2020-14524 Softing Industrial Automation OPCEPSS 2.5%
Softing Industrial Automation all versions prior to the latest build of version 4.47.0 · OPC
- Critical 9.8 EPSS 2.5%
-
Critical 10.0
CVE-2020-14500 IMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-158EPSS 1.7%
Secomea GateManager all versions prior to 9.2c · Secomea GateManager all versions prior to 9.2c
- Critical 9.1 EPSS 1.6%
-
Critical 9.8
CVE-2020-3446 Cisco vWAAS for Cisco ENCS 5400-W Series and CSP 5000-W Series Default Credentials VulnerabilityEPSS 1.4%
- Critical 9.3 EPSS 1.3%
- Critical 10.0 EPSS 1.2%
- Critical 9.8
- Critical 9.8
- Critical
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.8
CVE-2020-15643 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is…EPSS 59%
-
Unscored
CVE-2020-23972 In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload …EPSS 31%
-
Unscored
CVE-2020-6637 openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.EPSS 18%
-
Unscored
CVE-2020-24312 mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability fo…EPSS 16%
-
Unscored
CVE-2020-24223 Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.EPSS 15%
-
High 8.8
CVE-2020-15645 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is…EPSS 11%
-
High 8.8
CVE-2020-17389 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is…EPSS 10%
-
High 8.8
CVE-2020-17387 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is…EPSS 10%
Advisories
- SUSE / openSUSE Security Updates 521 critical
- Debian Security (DSA / DLA) 291 critical
- Ubuntu Security Notices (USN) 11
- CISA ICS & IT advisories 42 critical
- Oracle Linux Security Advisories (ELSA) 3
- BSI CERT-Bund (WID) 1
- SUSE-SU-2020:14460-1 Security update for squid3 21 CVEs
- ICSA-20-240-01 Red Lion N-Tron 702-W, 702M12-W 5 CVEs
- DLA-2342-1 libjackson-json-java - security update 3 CVEs
- ICSA-20-238-01 Advantech iView 1 CVEs