Vulnerability Trends November 2020

Vulnerability Trends Summary

As part of our monthly vulnerability trends, this report shows the monthly top 10 trends on security vulnerabilities and how hackers, malware, and exploit kits are exploiting those vulnerabilities. To demonstrate, we assign vulnerability trends value as a percentage of how each vulnerability is significantly gaining the attention of cyber security communities, attackers, together with malware. In either case, companies can benefit from the report to have more cyber threat insights and relatively anticipate attacks wave that might target their public assets in the following months.

Subscribe to the monthly vulnerability digest report by clicking here.

Download the full vulnerability digest report by clicking here.

The following chart shows the trends.

In November 2020, for the first time, we don’t see Microsoft related vulnerabilities in our list as the cybersecurity community responded more to the list of wildly-exploited vulnerabilities published by Google Zero Project here.

Other important vulnerabilities have been reported as trends. That includes VMware Workspace One command injection and Oracle Web Logic RCE.

The following table shows the details of the trends.

Subscribe to the monthly vulnerability digest report by clicking here.

Download the full vulnerability digest report by clicking here.

1.CVE-2020-27930

A memory corruption issue exists in iOS and OS X FontParser where causes arbitrary code execution when
processing a maliciously crafted font

2.CVE-2020-4006

A command injection and execution vulnerability exists in VMware Workspace One Access, Identity
Manager, Access Connector and Identity Manager Connector that causes a malicious user with access to
administrative port 8443 can exploit this vulnerability.

3.CVE-2020-14750

Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to
compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle
WebLogic Server.

4.CVE-2020-16013

Missing verification of node value in inappropriate implementation in V8 JavaScript engine in Chrome web
browser that affect the browser’s Windows, macOS and Linux versions.

5.CVE-2020-16017

Use-After-Free vulnerability exists in site isolation functionality in Chrome web browser that affect the
browser’s Windows, macOS and Linux versions.

6.CVE-2020-27950

Information leakage issue exists in iOS and OS X where causes a malicious application to be able to disclose
kernel memory.

7.CVE-2020-25705

A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to
quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port
UDP randomization. This attack is called SAD DNS.

8.CVE-2020-27955

A remote code execution vulnerability exists in GIT-LFS that affects Git, GitHub CLI, GitHub Desktop, Visual
Studio and more.

9.CVE-2020-13671

A remote code execution vulnerability exists in Drupal as Drupal core does not properly sanitize certain
filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served
as the wrong MIME type or executed as PHP for certain hosting configurations.

10.CVE-2020-16009

Inappropriate implementation in V8 Turbofan Type in Google Chrome. This vulnerability allows a remote
attacker to potentially exploit heap corruption via a crafted HTML page.