Week 40, 2020
28 September – 4 October 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.1
CVE-2020-12506 WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW03EPSS 1.5%
- Critical 9.3 EPSS 1.3%
- Critical 9.8 EPSS 1%
- Critical 9.3
- Critical
- Critical
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.2
CVE-2020-8243 A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitra…EPSS 91%
-
Unscored
CVE-2020-12124 A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arb…EPSS 75%
- High 7.5 EPSS 69%
-
Unscored
CVE-2020-26124 openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_e…EPSS 65%
- High 8.7 EPSS 34%
-
Unscored
CVE-2020-26525 Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connect…EPSS 25%
-
Unscored
CVE-2020-24397 An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in…EPSS 15%
-
Unscored
CVE-2020-25762 An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input validation on the username and password …EPSS 11%
Advisories
- SUSE / openSUSE Security Updates 501 critical
- Ubuntu Security Notices (USN) 193 critical
- Debian Security (DSA / DLA) 141 critical
- BSI CERT-Bund (WID) 5
- Oracle Linux Security Advisories (ELSA) 4
- CISA ICS & IT advisories 3
- CERT@VDE 31 critical
- Amazon Linux Security Center (ALAS) 3
- Rocky Linux Security Advisories 1
- AlmaLinux Security Advisories 1
- USN-4557-1 tomcat6 vulnerabilities 7 CVEs
- DLA-2394-1 squid3 - security update 4 CVEs
- USN-4551-1 squid3 vulnerabilities 4 CVEs
- openSUSE-SU-2020:1604-1 Security update for zabbix 2 CVEs
- USN-4562-1 ruby-kramdown vulnerability 1 CVEs
- VDE-2020-028 WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Version <= FW03 1 CVEs