Week 39, 2020
21–27 September 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-25223 A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11EPSS 97%
-
Critical 9.8
CVE-2019-16028 Cisco Firepower Management Center Lightweight Directory Access Protocol Authentication Bypass VulnerabilityEPSS 3.4%
-
Critical 9.8
CVE-2020-13501 An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SO…EPSS 2.9%
-
Critical 9.8
CVE-2020-13500 SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP …EPSS 2.9%
-
Critical 9.8
CVE-2020-13499 An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SO…EPSS 2.9%
- Critical 9.9 EPSS 2.1%
- Critical 9.0 EPSS 1.3%
- Critical 9.0 EPSS 1%
- Critical 9.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-14179 Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Infor…EPSS 76%
-
Unscored
CVE-2020-6551 Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 28%
-
Unscored
CVE-2020-6549 Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 28%
-
Unscored
CVE-2020-6550 Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 28%
-
Unscored
CVE-2020-6541 Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.EPSS 22%
-
Unscored
CVE-2020-11857 An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow remote attac…EPSS 16%
-
Unscored
CVE-2020-24365 An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated att…EPSS 11%
- Unscored EPSS 11%
Advisories
- SUSE / openSUSE Security Updates 691 critical
- Ubuntu Security Notices (USN) 241 critical
- Debian Security (DSA / DLA) 121 critical
- BSI CERT-Bund (WID) 3
- Oracle Linux Security Advisories (ELSA) 2
- CISA ICS & IT advisories 2
- openSUSE-SU-2020:1516-1 Security update for roundcubemail 6 CVEs
- DSA-4766-1 rails - security update 6 CVEs
- USN-4532-1 netty-3.9 vulnerabilities 3 CVEs