Week 47, 2020
16–22 November 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.1 EPSS 66%
- Critical 9.8 EPSS 32%
- Critical 9.8 EPSS 4.8%
- Critical 9.4 EPSS 2.5%
- Critical 9.8 EPSS 2.2%
- Critical 9.1
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.1 EPSS 92%
- Unscored EPSS 90%
- High 8.0 EPSS 85%
-
High 7.8
CVE-2020-28949 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite f…EPSS 85%
-
Unscored
CVE-2020-28578 A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTT…EPSS 73%
Trend Micro · Trend Micro InterScan Web Security Virtual Appliance
- High 7.3 EPSS 70%
-
Unscored
CVE-2020-8277 A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.…EPSS 54%
-
Unscored
CVE-2020-28579 A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP …EPSS 51%
Trend Micro · Trend Micro InterScan Web Security Virtual Appliance
Advisories
- SUSE / openSUSE Security Updates 747 critical
- Debian Security (DSA / DLA) 191 critical
- Ubuntu Security Notices (USN) 71 critical
- BSI CERT-Bund (WID) 7
- Oracle Linux Security Advisories (ELSA) 71 critical
- CISA ICS & IT advisories 62 critical
- CERT@VDE 3
- SUSE-SU-2020:3360-1 Security update for tcpdump 29 CVEs
- openSUSE-SU-2020:1993-1 Security update for rmt-server 16 CVEs
- USN-4639-1 phpmyadmin vulnerabilities 14 CVEs
- SUSE-SU-2020:3458-1 Security update for MozillaFirefox 12 CVEs
- SUSE-SU-2020:14548-1 Security update for MozillaFirefox 12 CVEs
- SUSE-SU-2020:3383-1 Security update for MozillaFirefox 12 CVEs
- openSUSE-SU-2020:1952-1 Security update for opera 12 CVEs
- openSUSE-SU-2020:1943-1 Security update for chromium 3 CVEs
- DLA-2461-1 zabbix - security update 2 CVEs
- ICSA-20-324-02 Paradox IP150 (Update A) 2 CVEs