Week 42, 2020

12–18 October 2020

New CVEs: 390
Critical: 14
High: 129
Newly exploited: 0
Advisories: 87
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2020-13957 Incorrect Authorization in Apache Solr
EPSS 79%
Critical 9.8
CVE-2019-17444 JFrog Artifactory does not enforce default admin password change
jfrog · artifactory

EPSS 69%
Critical 9.8
CVE-2020-5135 A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malici…
SonicWall · SonicOS

EPSS 27%
Critical 9.8
CVE-2020-17407 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112. Authentication is…
Microhard · Bullet-LTE

EPSS 6.8%
Critical 10.0
CVE-2020-6364 SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that …
SAP · SAP Solution Manager (CA Introscope Enterprise Manager) and SAP Focused Run (CA Introscope Enterprise Manager)

EPSS 6.4%
Critical 9.8
CVE-2020-26867 ARC Informatique PcVue Deserialization of Untrusted Data
ARC Informatique · PcVue

EPSS 3.8%
Critical 9.8
CVE-2020-12501 Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Pepperl+Fuchs · Westermo · Korenix · P+F Comtrol RocketLinx

EPSS 3.3%
Critical 9.9
CVE-2020-26943 Arbitrary Code Execution in blazar-dashboard
EPSS 3.3%
Critical 9.8
CVE-2020-12504 Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Pepperl+Fuchs · Westermo · Korenix · JetNet

EPSS 3%
Critical 9.8
CVE-2020-12500 Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Pepperl+Fuchs · Westermo · Korenix · P+F Comtrol RocketLinx

EPSS 2.9%
Critical 9.8
CVE-2020-27197 libtaxii Server-Side Request Forgery vulnerability
EPSS 2.3%
Critical 9.8
CVE-2020-8349 An internal security review has identified an unauthenticated remote code execution vulnerability in Cloud Networking Operating System (CNOS)’ optional REST AP…
Lenovo · Cloud Networking Operating System (CNOS)

EPSS 2.2%
Critical 9.8
CVE-2020-27156 Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. This vulnerability could allow for remote code execution by an unauthentic…
EPSS 2.2%
Critical 9.8
CVE-2019-17640 Path Traversal in Eclipse Vert
The Eclipse Foundation · Eclipse Vert.x

EPSS 2%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.2
CVE-2020-14144 Arbitrary Code Execution in Gitea
EPSS 95%
Unscored
CVE-2020-15867 The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook fe…
EPSS 87%
Unscored
CVE-2020-8821 An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML code into the Command …
EPSS 79%
High 8.6
CVE-2020-16952 Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Foundation 2013 Service Pack 1

EPSS 71%
Medium 4.3
CVE-2020-13943 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
EPSS 53%
High 7.5
CVE-2020-16947 Microsoft Outlook Remote Code Execution Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Outlook 2016

EPSS 34%
High 7.2
CVE-2020-12503 Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Pepperl+Fuchs · Westermo · Korenix · PMI-110-F2G

EPSS 23%
High 7.5
CVE-2020-16899 Windows TCP/IP Denial of Service Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 14%

Advisories

SUSE-SU-2020:2911-1 Security update for ansible, crowbar-core, crowbar-openstack, grafana, grafana-natel-discrete-panel, openstack-aodh, openstack-barbican, openstack-cinder, openstack-gnocchi, openstack-heat, openstack-ironic, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-murano, openstack-neutron, openstack-neutron-vpnaas, openstack-nova, openstack-sahara, python-Pillow, rubygem-crowbar-client 15 CVEs
ICSA-20-287-01 MOXA NPort IAW5000A-I/O Series 6 CVEs
SEVD-2020-287-02 Wibu-Systems CodeMeter Vulnerabilities 6 CVEs
VDE-2020-041 Weidmueller: u-create studio < 1.20.2 affected by WIBU-SYSTEMS CodeMeter vulnerabilities 5 CVEs
openSUSE-SU-2020:1675-1 Security update for phpMyAdmin 2 CVEs
openSUSE-SU-2020:1679-1 Security update for rubygem-activesupport-5_1 1 CVEs
openSUSE-SU-2020:1677-1 Security update for rubygem-activesupport-5_1 1 CVEs
VDE-2020-043 Bender: COMTRAXX < 4.2.0 affected by inadquate credentials check vulnerability 1 CVEs
SUSE-SU-2020:2929-1 Security update for rubygem-activesupport-4_2 1 CVEs
USN-4575-1 dom4j vulnerability 1 CVEs