Week 49, 2020
30 November – 6 December 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.6
CVE-2020-27660 SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commands via the domain pa…EPSS 4.6%
- Critical 9.8 EPSS 4%
- Critical 9.8 EPSS 3.4%
- Critical 9.8
- Critical 9.3
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-29279 PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code e…EPSS 53%
-
Unscored
CVE-2020-29390 Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker t…EPSS 40%
-
Unscored
CVE-2020-28976 The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external…EPSS 28%
- High 7.5 EPSS 25%
- High 7.5 EPSS 18%
-
Unscored
CVE-2020-28977 The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external s…EPSS 15%
-
Unscored
CVE-2020-28978 The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external s…EPSS 15%
-
Unscored
CVE-2020-28926 ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to the miniDLNA service using HTTP chunked …EPSS 13%
Advisories
- SUSE / openSUSE Security Updates 572 critical
- Debian Security (DSA / DLA) 181 critical
- Ubuntu Security Notices (USN) 11
- Oracle Linux Security Advisories (ELSA) 9
- BSI CERT-Bund (WID) 7
- CISA ICS & IT advisories 2
- CERT@VDE 1
- SUSE-SU-2020:3624-1 Security update for crowbar-openstack, grafana, influxdb, python-urllib3 5 CVEs
- DLA-2480-1 salt - security update 3 CVEs
- openSUSE-SU-2020:2178-1 Security update for opera 2 CVEs