Week 51, 2020
14–20 December 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 85%
- Critical 9.8 EPSS 8.1%
- Critical 9.8 EPSS 6.6%
- Critical 9.8 EPSS 3.7%
-
Critical 10.0
CVE-2020-12522 Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10EPSS 3.1%
WAGO · Series Wago Touch Panel 600 Standard Line (762-4xxx) · Series Wago Touch Panel 600 Marine Line (762-6xxx) · Series PFC 200 (750-82xx/xxx-xxx)
- Critical 10.0 EPSS 2.2%
- Critical 9.8 EPSS 2.1%
-
Critical 9.8
CVE-2020-29510 The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows …EPSS 2.1%
- Critical 9.8 EPSS 2%
-
Critical 9.8
CVE-2020-29511 The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which al…EPSS 2%
- Critical 9.8 EPSS 1.5%
- Critical 9.3
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-35489 The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may cont…EPSS 89%
-
Medium 6.8
CVE-2020-26259 XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshallingEPSS 82%
-
Unscored
CVE-2020-7200 A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. The vulnerability could be exploited to allow remote c…EPSS 82%
- Medium 6.3 EPSS 82%
- Medium 5.3 EPSS 70%
-
Unscored
CVE-2020-8466 A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could all…EPSS 64%
Trend Micro · Trend Micro InterScan Web Security Virtual Appliance
-
Unscored
CVE-2020-35234 The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list th…EPSS 60%
-
Unscored
CVE-2020-25494 Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-…EPSS 39%
Advisories
- SUSE / openSUSE Security Updates 393 critical
- Debian Security (DSA / DLA) 201 critical
- Oracle Linux Security Advisories (ELSA) 19
- AlmaLinux Security Advisories 13
- Rocky Linux Security Advisories 5
- CISA ICS & IT advisories 43 critical
- Ubuntu Security Notices (USN) 3
- CERT@VDE 33 critical
- BSI CERT-Bund (WID) 2
- Schneider Electric CPCERT 11 critical
- openSUSE-SU-2020:2276-1 Security update for clamav 14 CVEs
- openSUSE-SU-2020:2268-1 Security update for clamav 14 CVEs
- SUSE-SU-2020:3790-1 Security update for clamav 14 CVEs
- ICSA-20-353-01 Treck TCP/IP Stack (Update A) 4 CVEs
- VDE-2020-049 Phoenix Contact: Multiple vulnerabilities in PLCnext Control devices < 2021.0 LTS 4 CVEs
- ICSA-20-352-02 PTC Kepware KEPServerEX (Update A) 3 CVEs
- DLA-2501-1 influxdb - security update 1 CVEs
- SEVD-2020-353-02 Treck HTTP Server Vulnerability on TM3 Bus Coupler Modules (V2.0) 1 CVEs
- VDE-2020-045 WAGO: Command Injection Vulnerability in I/O-Check Service of multiple products 1 CVEs
- VDE-2020-046 PHOENIX CONTACT: mGuard <8.8.3 products missing initialization of resource 1 CVEs