Week 41, 2020

5–11 October 2020

New CVEs: 225
Critical: 24
High: 30
Newly exploited: 0
Advisories: 120
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2020-26935 phpMyAdmin SQL injection vulnerability
EPSS 64%
Critical 9.8
CVE-2020-26919 NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
EPSS 57%
Critical 9.0
CVE-2020-11800 Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code.
EPSS 9.2%
Critical 9.6
CVE-2020-26902 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750…
EPSS 3.5%
Critical 9.8
CVE-2020-4493 IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow an attacker to bypass authentication and issue commands using a specially crafted HTTP command. IBM X-F…
IBM · Maximo Asset Management

EPSS 2.7%
Critical 9.8
CVE-2020-1914 Always-Incorrect Control Flow Implementation in Facebook Hermes
Facebook · Hermes

EPSS 2.5%
Critical 9.6
CVE-2020-26907 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS8…
EPSS 2.4%
Critical 9.1
CVE-2020-13347 A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows syste…
GitLab · GitLab Runner

EPSS 2.3%
Critical 9.4
CVE-2020-26908 Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.36, D7000 before 1.0.1.74, PR2000 before 1.0.0.30, R6020 before…
EPSS 2.1%
Critical 9.9
CVE-2020-7741 Cross-site Scripting (XSS)
EPSS 1.5%
Critical 9.1
CVE-2020-15243 WebApi Authentication attribute missing in Smartstore
smartstore · SmartStoreNET

EPSS 1.2%
Critical 9.4
CVE-2020-26927 Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.42, R6080 before …
EPSS 1.1%
Critical 9.0
CVE-2020-5389 Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an information disclosure vulnerabilit…
Dell · OMIMSSC (OpenManage Integration for Microsoft System Center)
Critical 9.6
CVE-2020-26905 Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.…
Critical 9.6
CVE-2020-26899 Certain NETGEAR devices are affected by disclosure of sensitive information. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.…

All 24 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

SUSE-SU-2020:2876-1 Security update for ardana-ansible, ardana-cinder, ardana-cobbler, ardana-installer-ui, ardana-opsconsole-ui, ardana-osconfig, crowbar-core, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-dashboard, openstack-ironic, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-infoblox, openstack-nova, python-Flask-Cors, rubygem-crowbar-client, storm, storm-kit, venv-openstack-cinder, venv-openstack-horizon 9 CVEs
ICSA-20-280-01 Rockwell Automation ISaGRAF5 Runtime (Update A) 5 CVEs
VDE-2020-040 Pepperl+Fuchs: Multiple Products prone to multiple vulnerabilities in Comtrol RocketLinux 5 CVEs