Het CSIRT-DSP maakt op wekelijkse basis een selectie van kwetsbaarheden, waarbij het CSIRT-DSP de inschatting heeft gemaakt dat deze relevant zijn voor digitale dienstverleners. Deze selectie wordt gezamenlijk met relevant nieuws verspreid in de Mid of Week.
De inschatting van low/medium/high wordt gemaakt op basis van de CVSS 3.1 base score van de kwetsbaarheid. 0.0-3.9 is low, 4.0-6.9 is medium, 7.0-10.0 is high.
Kwetsbaarheden die als low worden geclassificeerd komen niet in dit overzicht terug.
High
Dell Wyse ThinOS
https://www.dell.com/support/kbdoc/nl-nl/000180768/dsa-2020-281 (10.0)
HPE Systems Insight Manager
https://nvd.nist.gov/vuln/detail/CVE-2020-7200 (9.8)
HPE iLO Amplifier Pack
https://nvd.nist.gov/vuln/detail/CVE-2020-7203 (9.8)
Docker Images
Kong: https://nvd.nist.gov/vuln/detail/CVE-2020-35189 (9.8)
Telegraf: https://nvd.nist.gov/vuln/detail/CVE-2020-35187 (9.8)
Ghost: https://nvd.nist.gov/vuln/detail/CVE-2020-35185 (9.8)
Adminer: https://nvd.nist.gov/vuln/detail/CVE-2020-35186 (9.8)
Composer: https://nvd.nist.gov/vuln/detail/CVE-2020-35184 (9.8)
Memcached: https://nvd.nist.gov/vuln/detail/CVE-2020-35197 (9.8)
Rabbitmq: https://nvd.nist.gov/vuln/detail/CVE-2020-35196 (9.8)
Haproxy: https://nvd.nist.gov/vuln/detail/CVE-2020-35195 (9.8)
Influxdb: https://nvd.nist.gov/vuln/detail/CVE-2020-35194 (9.8)
Vault: https://nvd.nist.gov/vuln/detail/CVE-2020-35192 (9.8)
Drupal: https://nvd.nist.gov/vuln/detail/CVE-2020-35191 (9.8)
Plone: https://nvd.nist.gov/vuln/detail/CVE-2020-35190 (9.8)
Chronograf: https://nvd.nist.gov/vuln/detail/CVE-2020-35190 (9.8)
Docker Docs: https://nvd.nist.gov/vuln/detail/CVE-2020-35467 (9.8)
Blackfire: https://nvd.nist.gov/vuln/detail/CVE-2020-35466 (9.8)
FullArmor HAPI File Share Mount: https://nvd.nist.gov/vuln/detail/CVE-2020-35465 (9.8)
Weave Cloud Agent: https://nvd.nist.gov/vuln/detail/CVE-2020-35464 (9.8)
Instana Dynamic APM: https://nvd.nist.gov/vuln/detail/CVE-2020-35463 (9.8)
Software AG Terracotta Server OSS: https://nvd.nist.gov/vuln/detail/CVE-2020-35469 (9.8)
Appbase streams: https://nvd.nist.gov/vuln/detail/CVE-2020-35468 (9.8)
Sonarqube: https://nvd.nist.gov/vuln/detail/CVE-2020-35193 (9.8)
Solarwinds N-Central
https://nvd.nist.gov/vuln/detail/CVE-2020-25617 (8.8)
https://nvd.nist.gov/vuln/detail/CVE-2020-25618 (8.8)
https://nvd.nist.gov/vuln/detail/CVE-2020-25622 (8.8)
https://nvd.nist.gov/vuln/detail/CVE-2020-25621 (8.4)
https://nvd.nist.gov/vuln/detail/CVE-2020-25620 (7.8)
Xen Hypervisor
https://nvd.nist.gov/vuln/detail/CVE-2020-29479 (8.8)
https://nvd.nist.gov/vuln/detail/CVE-2020-29481 (8.8)
https://nvd.nist.gov/vuln/detail/CVE-2020-29569 (8.8)
Red Hat Cloudforms
https://nvd.nist.gov/vuln/detail/CVE-2020-25716 (8.3)
F5 BIG-IP
https://support.f5.com/csp/article/K60344652 (7.5)
https://support.f5.com/csp/article/K25691186 (7.5)
https://support.f5.com/csp/article/K43850230 (7.5)
https://support.f5.com/csp/article/K58102101 (7.5)
https://support.f5.com/csp/article/K19166530 (7.5)
https://support.f5.com/csp/article/K04048104 (7.5)
https://support.f5.com/csp/article/K42933418 (7.5)
Microsoft Azure Sphere
https://nvd.nist.gov/vuln/detail/CVE-2020-35609 (7.1)
Medium
Xen Hypervisor
https://nvd.nist.gov/vuln/detail/CVE-2020-29568 (6.5)
https://nvd.nist.gov/vuln/detail/CVE-2020-29570 (6.2)
https://nvd.nist.gov/vuln/detail/CVE-2020-29482 (6.0)
https://nvd.nist.gov/vuln/detail/CVE-2020-29486 (6.0)
https://nvd.nist.gov/vuln/detail/CVE-2020-29485 (5.5)
https://nvd.nist.gov/vuln/detail/CVE-2020-29487 (n/a)
Kubernetes
https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8 (6.3)
F5 BIG-IP
https://support.f5.com/csp/article/K15310332 (6.1)
https://support.f5.com/csp/article/K52035247 (5.9)
https://support.f5.com/csp/article/K45143221 (5.9)
https://support.f5.com/csp/article/K04518313 (5.3)
https://support.f5.com/csp/article/K50343630 (4.9)
https://support.f5.com/csp/article/K73657294 (4.8)
https://support.f5.com/csp/article/K25595031 (4.3)
https://support.f5.com/csp/article/K30343902 (4.2)
Microsoft Azure Sphere
https://nvd.nist.gov/vuln/detail/CVE-2020-35608 (5.5)
Oracle Cloud Infrastructure IaM
https://nvd.nist.gov/vuln/detail/CVE-2020-14874 (4.7)
Solarwinds N-Central
https://nvd.nist.gov/vuln/detail/CVE-2020-25619 (4.4)
Bent u een digitale dienstverlener en wenst u onze complete Mid of Week te ontvangen? Dan kunt u per e-mail uw aanmelding doorgeven. Vermeld hierbij het e-mailadres waar u de Mid of Week op wenst te ontvangen.