Week 38, 2020
14–20 September 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-0230 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache StrutsEPSS 97%
- Critical 10.0 EPSS 5.1%
-
Critical 9.8
CVE-2020-25575 An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has a type confusion fl…EPSS 2.9%
- Critical 9.8 EPSS 2.5%
- Critical 9.8 EPSS 2.1%
- Critical 9.8 EPSS 1.8%
- Critical 9.8 EPSS 1.6%
- Critical 9.3 EPSS 1.4%
-
Critical 9.8
CVE-2020-16098 It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20.…EPSS 1.1%
- Critical 9.9
- Critical 9.0
- Critical 9.3
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-14181 Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the …EPSS 100%
- High 8.9 EPSS 78%
-
High 8.8
CVE-2020-6146 An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.300. When drawing the contents of a page…EPSS 75%
- High 7.5 EPSS 75%
-
Unscored
CVE-2020-11698 An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote attacker to…EPSS 73%
- High 7.5 EPSS 66%
-
High 8.8
CVE-2020-6113 An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-referenc…EPSS 64%
-
High 8.8
CVE-2020-6116 An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. When drawing the contents of a…EPSS 28%
Advisories
- SUSE / openSUSE Security Updates 433 critical
- Ubuntu Security Notices (USN) 292 critical
- Debian Security (DSA / DLA) 5
- Amazon Linux Security Center (ALAS) 5
- BSI CERT-Bund (WID) 4
- Oracle Linux Security Advisories (ELSA) 3
- CISA ICS & IT advisories 2
- AlmaLinux Security Advisories 1
- CERT@VDE 1
- Rocky Linux Security Advisories 1
- SUSE-SU-2020:2650-1 Security update for SUSE Manager Server 4.0 3 CVEs
- SUSE-SU-2020:2648-1 Security update for SUSE Manager 3.2 1 CVEs
- SUSE-SU-2020:2647-1 Security update for for SUSE Manager 4.1 1 CVEs
- USN-4496-1 Apache XML-RPC vulnerability 1 CVEs
- USN-4495-1 Apache Log4j vulnerability 1 CVEs