Week 43, 2020
19–25 October 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-14882 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1…EPSS 100%
-
Critical 9.8
CVE-2020-3992 OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issu…EPSS 83%
-
Critical 10.0
CVE-2020-14871 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11.…EPSS 80%
-
Critical 9.8
CVE-2020-14841 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.…EPSS 50%
-
Critical 9.8
CVE-2020-14825 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.…EPSS 30%
- Critical 9.6 EPSS 6.1%
-
Critical 9.8
CVE-2020-14859 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.…EPSS 3.8%
-
Critical 9.1
CVE-2020-14876 Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1 - …EPSS 2.8%
- Critical 9.8 EPSS 2.3%
-
Critical 9.1
CVE-2020-14875 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1…EPSS 2.2%
-
Critical 9.8
CVE-2020-14855 Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). The supported version that is af…EPSS 2.2%
-
Critical 9.1
CVE-2020-14805 Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite (component: Search Integration Engine). Supported vers…EPSS 1.6%
- Critical 9.1 EPSS 1.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.2
CVE-2020-14883 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1…EPSS 98%
-
High 7.5
CVE-2020-14864 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are…EPSS 97%
-
Medium 6.1
CVE-2020-3580 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 86%
-
Unscored
CVE-2020-5791 Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system comm…EPSS 79%
- Medium 5.3 EPSS 78%
-
High 8.8
CVE-2020-11853 Arbitrary code execution vulnerability on multiple Micro Focus productsEPSS 77%
Micro Focus · Operation Bridge Manager · Hybrid Cloud Management · Application Performance Management
-
Unscored
CVE-2020-5792 Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultima…EPSS 64%
-
Medium 5.3
CVE-2020-6308 SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CM…EPSS 62%
SAP · SAP BusinessObjects Business Intelligence Platform (Web Services)
Advisories
- Amazon Linux Security Center (ALAS) 55
- SUSE / openSUSE Security Updates 428 critical
- Ubuntu Security Notices (USN) 183 critical
- Debian Security (DSA / DLA) 143 critical
- BSI CERT-Bund (WID) 81 critical
- Oracle Linux Security Advisories (ELSA) 6
- CISA ICS & IT advisories 41 critical
- Rocky Linux Security Advisories 1
- AlmaLinux Security Advisories 1
- openSUSE-SU-2020:1737-1 Security update for chromium 5 CVEs
- openSUSE-SU-2020:1731-1 Security update for chromium 5 CVEs
- openSUSE-SU-2020:1718-1 Security update for chromium 5 CVEs
- USN-4600-1 netty-3.9 vulnerabilities 4 CVEs
- DLA-2413-1 phpmyadmin - security update 3 CVEs
- SUSE-SU-2020:2970-1 Security update for libvirt 2 CVEs
- SUSE-SU-2020:2969-1 Security update for libvirt 2 CVEs
- openSUSE-SU-2020:1734-1 Security update for freetype2 1 CVEs
- DLA-2415-1 freetype - security update 1 CVEs
- USN-4593-2 freetype vulnerability 1 CVEs