Week 48, 2020
23–29 November 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 69%
-
Critical 9.1
CVE-2020-4006 VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.EPSS 17%
- Critical 9.8 EPSS 3.1%
- Critical 9.1 EPSS 2.6%
-
Critical 9.8
CVE-2020-4854 IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound aut…EPSS 2.4%
- Critical 9.8 EPSS 2.3%
- Critical 9.8 EPSS 2%
- Critical 9.8 EPSS 1.7%
- Critical
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-4000 The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 allows for executing files through directory traversal. An auth…EPSS 43%
-
Unscored
CVE-2020-3984 The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 does not apply correct input validation which allows for SQL-injection. An authenticat…EPSS 22%
- Medium 4.8 EPSS 8.3%
-
Unscored
CVE-2020-12351 Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.EPSS 7.8%
-
Unscored
CVE-2020-27251 A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send …EPSS 6.8%
-
Unscored
CVE-2020-12352 Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.EPSS 5.8%
-
Unscored
CVE-2020-13886 Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow cgi-bin/cgiServer.exx?page=../ Directory Traversal.EPSS 5.2%
-
Unscored
CVE-2020-28334 Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent W…EPSS 4.8%
Advisories
- SUSE / openSUSE Security Updates 858 critical
- Ubuntu Security Notices (USN) 12
- Debian Security (DSA / DLA) 11
- BSI CERT-Bund (WID) 6
- Oracle Linux Security Advisories (ELSA) 2
- CISA ICS & IT advisories 21 critical
- openSUSE-SU-2020:2000-1 Security update for rmt-server 16 CVEs
- openSUSE-SU-2020:2096-1 Security update for MozillaThunderbird 12 CVEs
- SUSE-SU-2020:3548-1 Security update for MozillaFirefox 12 CVEs
- openSUSE-SU-2020:2031-1 Security update for MozillaFirefox 12 CVEs
- SUSE-SU-2020:3528-1 Security update for MozillaThunderbird 12 CVEs
- openSUSE-SU-2020:2020-1 Security update for MozillaFirefox 12 CVEs
- openSUSE-SU-2020:2016-1 Security update for chromium 3 CVEs
- openSUSE-SU-2020:2013-1 Security update for chromium 3 CVEs
- ICSA-20-329-01 Rockwell Automation FactoryTalk Linx 3 CVEs