Week 44, 2020
26 October – 1 November 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-14750 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1…EPSS 99%
-
Critical 9.8
CVE-2020-11854 Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products.EPSS 74%
Micro Focus · Operation Bridge Manager · Application Performance Management · Operation Bridge (containerized)
-
Critical 9.8
CVE-2018-19949 If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QT…EPSS 30%
-
Critical 9.8
CVE-2020-27654 Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port …EPSS 4.7%
- Critical 9.8 EPSS 2.4%
- Critical 9.3 EPSS 2.3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.2
CVE-2020-8260 A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using unco…EPSS 96%
-
Unscored
CVE-2020-7373 vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: thi…EPSS 45%
-
Unscored
CVE-2020-26879 Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by …EPSS 44%
-
Medium 6.1
CVE-2018-19953 If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following …EPSS 31%
- High 7.0 EPSS 30%
-
High 8.0
CVE-2018-19943 If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the followi…EPSS 23%
-
High 7.5
CVE-2020-27986 SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the ve…EPSS 16%
-
Unscored
CVE-2020-28032 WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.EPSS 16%
Advisories
- SUSE / openSUSE Security Updates 7610 critical
- Debian Security (DSA / DLA) 15
- Ubuntu Security Notices (USN) 131 critical
- Oracle Linux Security Advisories (ELSA) 4
- CERT@VDE 32 critical
- CISA ICS & IT advisories 31 critical
- BSI CERT-Bund (WID) 2
- SICK PSIRT 2
- openSUSE-SU-2020:1766-1 Security update for tensorflow2 16 CVEs
- SUSE-SU-2020:3036-1 Security update for rmt-server 16 CVEs
- ICSA-20-303-02 Mitsubishi Electric MELSEC iQ-R 6 CVEs
- VDE-2020-031 Endress+Hauser: Multiple products prone to WIBU CodeMeter vulnerabilities 6 CVEs
- VDE-2020-039 TRUMPF: Multiple products prone to WIBU CodeMeter vulnerabilities 6 CVEs
- openSUSE-SU-2020:1806-1 Security update for phpMyAdmin 5 CVEs
- USN-4600-2 netty vulnerabilities 3 CVEs
- openSUSE-SU-2020:1778-1 Security update for libvirt 2 CVEs
- openSUSE-SU-2020:1777-1 Security update for libvirt 2 CVEs
- SUSE-SU-2020:3095-1 Security update for libvirt 2 CVEs