Week 53, 2020

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2020-10148 SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

  SolarWinds · Orion Platform

  EPSS 92%
• Critical 9.9
  CVE-2020-35951 An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, …
  EPSS 76%
• Critical 9.6
  CVE-2020-35391 Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-…
  EPSS 35%
• Critical 9.9
  CVE-2020-35948 An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary f…
  EPSS 25%
• Critical 10.0
  CVE-2020-35949 An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary …
  EPSS 5.1%
• Critical 9.8
  CVE-2020-28282 Prototype pollution in getobject
  EPSS 4.2%
• Critical 9.8
  CVE-2020-28281 Prototype pollution in set-object-value
  EPSS 3.7%
• Critical 9.8
  CVE-2020-35858 Out of bounds write in prost
  EPSS 3.4%
• Critical 9.8
  CVE-2020-28283 Prototype pollution vulnerability in 'libnested'
  EPSS 3.4%
• Critical 9.8
  CVE-2020-28279 flattenizer vulnerable to prototype pollution
  EPSS 3.1%
• Critical 9.8
  CVE-2020-28280 Prototype pollution vulnerability in 'predefine'
  EPSS 3.1%
• Critical 9.8
  CVE-2020-28278 shvl vulnerable to prototype pollution
  EPSS 3.1%
• Critical 9.8
  CVE-2020-28276 Prototype pollution vulnerability in 'deep-set'
  EPSS 3.1%
• Critical 9.8
  CVE-2020-28277 dset vulnerable to prototype pollution
  EPSS 3.1%
• Critical 9.8
  CVE-2020-35863 HTTP Request Smuggling in hyper
  EPSS 3%

All 45 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2020-35847 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
  EPSS 98%
• Unscored
  CVE-2020-35846 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
  EPSS 93%
• Medium 6.1
  CVE-2020-35774 TwitterServer Cross-site Scripting via /histograms endpoint
  EPSS 86%
• Unscored
  CVE-2020-35848 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
  EPSS 75%
• Unscored
  CVE-2020-5810 A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which a…
  EPSS 62%
• Unscored
  CVE-2020-5802 An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted ConfigureItems message to TC…
  EPSS 45%
• Unscored
  CVE-2020-5807 An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the FactoryTalk Diagnostics event log. The attack…
  EPSS 39%
• Medium 6.1
  CVE-2020-35730 An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message…
  EPSS 33%