Week 50, 2020

7–13 December 2020

New CVEs: 432
Critical: 19
High: 66
Newly exploited: 0
Advisories: 142
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2020-17530 Remote code execution in Apache Struts
Apache Software Foundation · Apache Struts

EPSS 96%
Critical 9.1
CVE-2020-17132 Microsoft Exchange Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2016 Cumulative Update 18 · Microsoft Exchange Server 2019 Cumulative Update 7

EPSS 89%
Critical 9.8
CVE-2020-17531 Deserialization flaw in EOL Tapestry 4.
Apache Software Foundation · Apache Tapestry

EPSS 10%
Critical 10.0
CVE-2020-26829 SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missin…
SAP · SAP NetWeaver AS JAVA (P2P Cluster Communication)

EPSS 4.8%
Critical 9.8
CVE-2020-13556 An out-of-bounds write vulnerability exists in the Ethernet/IP server functionality of EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A specially c…
EPSS 4.7%
Critical 9.8
CVE-2020-29574 An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
EPSS 4.7%
Critical 9.1
CVE-2020-17142 Microsoft Exchange Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 7 · Microsoft Exchange Server 2016 Cumulative Update 18

EPSS 3.4%
Critical 9.0
CVE-2020-24445 Cross-site Scripting Vulnerability in Commenting Function of Adobe Experience Manager (AEM)
Adobe · Experience Manager

EPSS 2.6%
Critical 9.8
CVE-2020-28274 Prototype pollution vulnerability in 'deepref'
EPSS 2.3%
Critical 9.1
CVE-2020-26838 SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenti…
SAP · SAP Business Warehouse · SAP BW4HANA

EPSS 2.2%
Critical 9.8
CVE-2020-28440 Command Injection
EPSS 2%
Critical 9.9
CVE-2020-27134 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Cisco · Cisco Jabber

EPSS 1.7%
Critical 9.8
CVE-2020-28439 Command Injection
EPSS 1.6%
Critical 9.9
CVE-2020-27132 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Cisco · Cisco Jabber

EPSS 1.4%
Critical 9.9
CVE-2020-27127 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Cisco · Cisco Jabber

EPSS 1.4%

All 19 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

WID-SEC-2022-1044 TCP/IP Stack: Mehrere Schwachstellen 33 CVEs
ICSA-20-343-01 Multiple Embedded TCP/IP Stacks 33 CVEs
openSUSE-SU-2020:2187-1 Security update for MozillaThunderbird 12 CVEs
SUSE-SU-2020:3729-1 Security update for clamav 8 CVEs
ICSA-20-343-10 Siemens LOGO! 8 BM 8 CVEs
ALAS2-2020-1572 Critical: thunderbird security update (Amazon Linux 2) 7 CVEs
ICSA-20-343-03 Schneider Electric Easergy T300 5 CVEs
ICSA-20-343-08 Siemens Products using TightVNC (Update A) 4 CVEs
SSA-478893 SSA-478893: TightVNC Vulnerabilities in Industrial Products (Revoked) 4 CVEs
ICSMA-20-343-01 GE Healthcare Imaging and Ultrasound Products 2 CVEs