CVEs published October 20, 2020
49 CVEs were published on October 20, 2020: 1 critical, 15 high. 1 is now in CISA KEV.
- Published
- 49
- Critical
- 1
- High
- 15
- Medium
- 18
- Low
- 0
- Unrated
- 15
- Now in CISA KEV
- 1
- Fix available
- 11
Most affected products
- Adobe Illustrator
- 7
- IBM Spectrum Scale
- 4
- Nagios XI
- 3
- VMware ESXi, Workstation, Fusion
- 3
- SAP SE SAP NetWeaver
- 2
- UCWeb UC Browser
- 2
- @tsed/core
- 1
- Adobe Marketo
- 1
- Advantech R-SeeNet
- 1
- chocolatey boxstarter
- 1
Critical 1
High 15
- CVE-2020-24412Adobe Illustrator Memory Corruption VulnerabilityAdobe Illustrator
- CVE-2020-24414Adobe Illustrator Memory Corruption VulnerabilityAdobe Illustrator
- CVE-2020-24410Adobe Illustrator PDF File Parsing Out-Of-Bounds Read VulnerabilityAdobe Illustrator
- CVE-2020-24409Adobe Illustrator PDF File Parsing Out-Of-Bounds Read VulnerabilityAdobe Illustrator
- CVE-2020-24415Adobe Illustrator Memory Corruption VulnerabilityAdobe Illustrator
- CVE-2020-24413Adobe Illustrator Memory Corruption VulnerabilityAdobe Illustrator
- CVE-2020-24411Adobe Illustrator PDF File Parsing Out-Of-Bounds Write VulnerabilityAdobe Illustrator
- CVE-2020-24416Blind stored XSS in Marketo Sales insight plugin for SalesForceAdobe Marketo
- CVE-2020-9417TIBCO Foresight SQL InjectionTIBCO Software TIBCO Foresight Archive and Retrieval Sys… +1
- CVE-2020-15264Privilege Escalation in Boxstarterchocolatey boxstarter
- CVE-2020-15269Expired token reuse in Spreespree
- CVE-2020-6367There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31…SAP SE SAP NetWeaver Composite Application Framework
- CVE-2020-6369SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated…SAP SE CA Introscope Enterprise Manager
- CVE-2020-6366SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents.SAP SE SAP NetWeaver
- CVE-2020-7749Server-side Request Forgery (SSRF)osm-static-maps
Medium, low and unrated 33
- CVE-2020-25157The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database…Advantech R-SeeNet
- CVE-2020-5791Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute…Nagios XI
- CVE-2020-5790Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate…Nagios XI
- CVE-2020-5792Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to…Nagios XI
- CVE-2020-15931Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the…
- CVE-2020-24765InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct…
- CVE-2019-9080DomainMOD before 4.14.0 uses MD5 without a salt for password storage.
- CVE-2020-7371Raise IT Solutions RITS Browser Address Bar SpooofingRaise IT Solutions RITS Browser
- CVE-2020-7370Danyil Vasilenko Bolt Browser Address Bar SpooofingDanyil Vasilenko Bolt Browser
- CVE-2020-7369Yandex Browser Address Bar SpooofingYandex Browser
- CVE-2020-7364UCWeb UC Browser Address Bar SpooofingUCWeb UC Browser
- CVE-2020-7363UCWeb UC Browser Address Bar SpooofingUCWeb UC Browser
- CVE-2020-3995In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before…VMware ESXi, Workstation, Fusion
- CVE-2020-3994VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance…vCenter Server
- CVE-2020-3993VMware NSX-T (3.x before 3.0.2, 2.5.x before 2.5.2.2.0) contains a security vulnerability that exists in the way it allows a KVM host to…VMware NSX-T
- CVE-2020-3982VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x)…VMware ESXi, Workstation, Fusion
- CVE-2020-3981VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x)…VMware ESXi, Workstation, Fusion
- CVE-2020-16246GE Reason S20 Ethernet SwitchGeneral Electric Reason S20 Ethernet Switch
- CVE-2020-4756IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0…IBM Elastic Storage Server · IBM Spectrum Scale
- CVE-2020-4755IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting.IBM Spectrum Scale
- CVE-2020-4749IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies.IBM Spectrum Scale
- CVE-2020-4748IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting.IBM Spectrum Scale
- CVE-2020-4564IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 are vulnerable…IBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2020-4491IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial of service by…IBM Spectrum Scale
- CVE-2019-4680IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.2.2 is vulnerable to SQL injection.IBM Sterling B2B Integrator
Show all 33 entriesShow fewer entries
- CVE-2020-6370SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs…SAP SE SAP NetWeaver
- CVE-2020-6362SAP Banking Services version 500, use an incorrect authorization object in some of its reports.SAP SE SAP Banking Services
- CVE-2020-6308SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject…SAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2020-6315SAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which can lead to leakage…SAP SE SAP 3D Visual Enterprise Viewer
- CVE-2020-7748Prototype Pollution@tsed/core
- CVE-2020-7747Cross-site Scripting (XSS)lightning-server
- CVE-2020-5640Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execute arbitrary code…SpiQe Software OneThird CMS
- CVE-2020-25648A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3.nss