CVEs published September 16, 2020
82 CVEs were published on September 16, 2020: 0 critical, 2 high. Browse them by severity, product and exploitation status.
- Published
- 82
- Critical
- 0
- High
- 2
- Medium
- 5
- Low
- 1
- Unrated
- 74
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- CodeMeter
- 6
- VMware Workstation and Horizon Client for Windows
- 5
- SCADAPack 7x Remote Connect V3.6.3.574 and prior.
- 4
- Jenkins project Jenkins ElasTest Plugin · org.jenkins-ci.pl…
- 3
- github.com/sylabs/singularity
- 2
- Jenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…
- 2
- Jenkins project Jenkins MongoDB Plugin · org.jenkins-ci.plu…
- 2
- Jenkins project Jenkins Perfecto Plugin · io.jenkins.plugin…
- 2
- Jenkins project Jenkins Storable Configs Plugin · org.jvnet…
- 2
- keycloak · org.keycloak:keycloak-parent
- 2
High 2
Medium, low and unrated 80
- CVE-2020-24377A DNS rebinding vulnerability in the Freebox OS web interface in Freebox Server before 4.2.3.
- CVE-2020-24376A DNS rebinding vulnerability in the UPnP IGD implementations in Freebox v5 before 1.5.29 and Freebox Server before 4.2.3.
- CVE-2020-24373A CSRF vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3.
- CVE-2020-24374A DNS rebinding vulnerability in Freebox v5 before 1.5.29.
- CVE-2020-20406A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier…
- CVE-2020-16233An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data…CodeMeter
- CVE-2020-14513CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to…CodeMeter
- CVE-2020-14515CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file…CodeMeter
- CVE-2020-14519This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including…CodeMeter
- CVE-2020-14517Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if…CodeMeter
- CVE-2020-14509Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not…CodeMeter
- CVE-2020-13259A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauthenticated, remote…
- CVE-2020-6781Improper Certificate Validation in Bosch Smart Home System App for iOSBosch Smart Home
- CVE-2020-10718A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the…Wildfly
- CVE-2020-1694A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience.keycloak · org.keycloak:keycloak-parent
- CVE-2020-10715A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x.openshift/console
- CVE-2020-10748A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances.keycloak · org.keycloak:keycloak-parent
- CVE-2020-25040Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build…github.com/sylabs/singularity
- CVE-2020-14348It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the user namespace puts…AMQ
- CVE-2020-25039Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container…github.com/sylabs/singularity
- CVE-2020-13928Apache Atlas before 2.1.0 contain a XSS vulnerability.Apache Atlas · org.apache.atlas:apache-atlas
- CVE-2020-25015A specific router allows changing the Wi-Fi password remotely.
- CVE-2020-3990VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an information disclosure vulnerability due to an…VMware Workstation and Horizon Client for Windows
- CVE-2020-3989VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain a denial of service vulnerability due to an…VMware Workstation and Horizon Client for Windows
- CVE-2020-3988VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado…VMware Workstation and Horizon Client for Windows
Show all 80 entriesShow fewer entries
- CVE-2020-3987VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado…VMware Workstation and Horizon Client for Windows
- CVE-2020-3986VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado…VMware Workstation and Horizon Client for Windows
- CVE-2020-3980VMware Fusion (11.x) contains a privilege escalation vulnerability due to the way it allows configuring the system wide path.VMware Fusion
- CVE-2014-10402An issue was discovered in the DBI module through 1.643 for Perl.
- CVE-2020-4708IBM Security Trusteer Pinpoint Detect 11.6.5 could disclose some information due to using a wildcard in the Access-Control-Allow-Origin…IBM Security Trusteer Pinpoint Detect
- CVE-2020-4409IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack.IBM Maximo Asset Management
- CVE-2020-7532A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator (V1.2.0 and prior) which could…SCADAPack x70 Security Administrator V1.2.0 and prior.
- CVE-2020-7531A CWE-284 Improper Access Control vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows an attacker to…SCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-7530A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows improper access…SCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-7529A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Transversal') vulnerability exists in SCADAPack 7x Remote…SCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-7528A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which could allow…SCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-1748A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were…Wildfly · org.wildfly.security:wildfly-elytron
- CVE-2020-10758A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the…Keycloak · org.keycloak:keycloak-parent
- CVE-2020-10733The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths.PostgreSQL
- CVE-2020-24889A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to…
- CVE-2020-25614xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of…github.com/antchfx/xmlquery
- CVE-2020-24890libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent…
- CVE-2020-14382A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively…cryptsetup
- CVE-2020-1710The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a…JBoss Enterprise Application Platform
- CVE-2020-25412com_line() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution.
- CVE-2020-14315A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3.bsdiff
- CVE-2020-14393A buffer overflow was found in perl-DBI < 1.643 in DBI.xs.perl-dbi
- CVE-2020-2278Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure…Jenkins project Jenkins Storable Configs Plugin · org.jvnet…
- CVE-2020-2276Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with…Jenkins project Jenkins Selection tasks Plugin · org.jvnet.…
- CVE-2020-2277Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller.Jenkins project Jenkins Storable Configs Plugin · org.jvnet…
- CVE-2020-2273A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an…Jenkins project Jenkins ElasTest Plugin · org.jenkins-ci.pl…
- CVE-2020-2274Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins…Jenkins project Jenkins ElasTest Plugin · org.jenkins-ci.pl…
- CVE-2020-2275Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job…Jenkins project Jenkins Copy data to workspace Plugin · org…
- CVE-2020-2271Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site…Jenkins project Jenkins Locked Files Report Plugin · org.jv…
- CVE-2020-2272A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an…Jenkins project Jenkins ElasTest Plugin · org.jenkins-ci.pl…
- CVE-2020-2269Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored…Jenkins project Jenkins chosen-views-tabbar Plugin · org.je…
- CVE-2020-2270Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site…Jenkins project Jenkins ClearCase Release Plugin · org.jvne…
- CVE-2020-2266Jenkins Description Column Plugin 1.3 and earlier does not escape the job description in the column tooltip, resulting in a stored…Jenkins project Jenkins Description Column Plugin · org.jen…
- CVE-2020-2267A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some…Jenkins project Jenkins MongoDB Plugin · org.jenkins-ci.plu…
- CVE-2020-2268A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some…Jenkins project Jenkins MongoDB Plugin · org.jenkins-ci.plu…
- CVE-2020-2264Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored cross-site…Jenkins project Jenkins Custom Job Icon Plugin · org.jenkin…
- CVE-2020-2265Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a…Jenkins project Jenkins Coverage/Complexity Scatter Plot Pl…
- CVE-2020-2262Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting…Jenkins project Jenkins Android Lint Plugin · org.jvnet.hud…
- CVE-2020-2263Jenkins Radiator View Plugin 1.29 and earlier does not escape the full name of the jobs in tooltips, resulting in a stored cross-site…Jenkins project Jenkins Radiator View Plugin · org.jenkins-…
- CVE-2020-2260A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an…Jenkins project Jenkins Perfecto Plugin · io.jenkins.plugin…
- CVE-2020-2261Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to…Jenkins project Jenkins Perfecto Plugin · io.jenkins.plugin…
- CVE-2020-2257Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored…Jenkins project Jenkins Validating String Parameter Plugin…
- CVE-2020-2258Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing…Jenkins project Jenkins Health Advisor by CloudBees Plugin…
- CVE-2020-2259Jenkins computer-queue-plugin Plugin 1.5 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site…Jenkins project Jenkins computer-queue-plugin Plugin · jenk…
- CVE-2020-2255A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an…Jenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…
- CVE-2020-2256Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build…Jenkins project Jenkins Pipeline Maven Integration Plugin ·…
- CVE-2020-2253Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.Jenkins project Jenkins Email Extension Plugin · org.jenkin…
- CVE-2020-2254Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with…Jenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…
- CVE-2020-2252Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server.Jenkins project Jenkins Mailer Plugin · org.jenkins-ci.plug…
- CVE-2020-14392An untrusted pointer dereference flaw was found in Perl-DBI < 1.643.perl-dbi
- CVE-2020-14386A flaw was found in the Linux kernel before 5.9-rc4.Linux Kernel kernel
- CVE-2020-25559gnuplot 5.5 is affected by double free when executing print_set_output.
- CVE-2020-7268McAfee Email Gateway (MEG) - Path Traversal vulnerabilityMcAfee Email Gateway
- CVE-2020-10781A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read theLinux Kernel kernel
- CVE-2020-14306An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3.openshift-service-mesh/istio-rhel8-operator