Week 52, 2020
21–27 December 2020
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2020-29583 Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found i…EPSS 90%
- Critical 9.8 EPSS 4.9%
- Critical 10.0 EPSS 4.8%
-
Critical 10.0
CVE-2020-25066 A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denial of service (crash/reset) or to possib…EPSS 3.5%
-
Critical 9.9
CVE-2020-29396 A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticate…EPSS 3.1%
- Critical 9.8 EPSS 1.8%
- Critical 9.8 EPSS 1.6%
- Critical 9.8 EPSS 1.5%
-
Critical 9.8
CVE-2020-24675 Weak Authentication in Symphony PlusEPSS 1.2%
ABB · ABB Ability™ Symphony® Plus Operations · ABB Ability™ Symphony® Plus Historian
-
Critical 9.8
CVE-2020-24673 SQL Injection in Symphony PlusEPSS 1.1%
ABB · ABB Ability™ Symphony® Plus Operations · ABB Ability™ Symphony® Plus Historian
- Critical 9.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2020-28188 Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php…EPSS 96%
-
Unscored
CVE-2020-35729 KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.EPSS 88%
-
Unscored
CVE-2020-35665 An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.…EPSS 78%
-
High 8.8
CVE-2020-13557 A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can…EPSS 70%
-
Unscored
CVE-2020-35713 Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the gof…EPSS 33%
-
Unscored
CVE-2020-35606 Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root priv…EPSS 28%
- High 7.7 EPSS 24%
-
Unscored
CVE-2020-28070 SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in view_event.php via the 'id' …EPSS 23%
Advisories
- SUSE / openSUSE Security Updates 463 critical
- Debian Security (DSA / DLA) 11
- Oracle Linux Security Advisories (ELSA) 3
- BSI CERT-Bund (WID) 2
- openSUSE-SU-2020:2315-1 Security update for MozillaFirefox 12 CVEs
- SUSE-SU-2020:3918-1 Security update for clamav 7 CVEs
- SUSE-SU-2020:3897-1 Security update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark 7 CVEs