Week 46, 2020
9–15 November 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 100%
-
Critical 9.8
CVE-2020-17051 Windows Network File System Remote Code Execution VulnerabilityEPSS 11%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2016
- Critical 9.1 EPSS 5.3%
- Critical 9.8 EPSS 4.2%
-
Critical 9.1
CVE-2020-26820 SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, t…EPSS 3.9%
- Critical 9.8 EPSS 3.8%
- Critical 9.8 EPSS 3.4%
-
Critical 9.1
CVE-2020-26808 SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 1…EPSS 3.1%
- Critical 9.8 EPSS 2.9%
-
Critical 10.0
CVE-2020-26821 SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the S…EPSS 1.4%
-
Critical 10.0
CVE-2020-26823 SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the U…EPSS 1.3%
-
Critical 10.0
CVE-2020-26824 SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the U…EPSS 1.3%
-
Critical 10.0
CVE-2020-26822 SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the O…EPSS 1.3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-13638 lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.…EPSS 77%
-
Unscored
CVE-2020-27386 An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the Fil…EPSS 72%
- Medium 6.1 EPSS 41%
-
High 7.5
CVE-2020-17047 Windows Network File System Denial of Service VulnerabilityEPSS 27%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Unscored
CVE-2020-24719 Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic…EPSS 23%
-
Medium 5.5
CVE-2020-1599 Windows Spoofing VulnerabilityEPSS 19%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Unscored
CVE-2020-27019 Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulnerability which could allow an attacker t…EPSS 18%
Trend Micro · Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
-
Unscored
CVE-2020-28351 The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) att…EPSS 16%
Advisories
- Oracle Linux Security Advisories (ELSA) 861 critical
- SUSE / openSUSE Security Updates 512 critical
- Debian Security (DSA / DLA) 16
- Ubuntu Security Notices (USN) 14
- Amazon Linux Security Center (ALAS) 11
- CISA ICS & IT advisories 71 critical
- Schneider Electric CPCERT 72 critical
- BSI CERT-Bund (WID) 4
- AlmaLinux Security Advisories 2
- Siemens ProductCERT 1
- SUSE-SU-2020:3309-1 Security update for ansible, ardana-ansible, ardana-cinder, ardana-glance, ardana-mq, ardana-nova, ardana-osconfig, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-monasca-installer, openstack-neutron, openstack-nova, python-Django, python-Flask-Cors, python-Pillow, python-ardana-packager, python-keystoneclient, python-keystonemiddleware, python-kombu, python-straight-plugin, python-urllib3, release-notes-sus 53 CVEs
- SEVD-2020-315-07 PLC Simulator on EcoStruxure™ Control Expert and Process Expert 5 CVEs
- SEVD-2020-315-06 Easergy T300 5 CVEs
- openSUSE-SU-2020:1929-1 Security update for chromium 3 CVEs
- ELSA-2020-5099 Critical: firefox security update (Oracle Linux 7) 1 CVEs
- ICSA-20-315-05 Siemens SCALANCE W 1750D 1 CVEs