# CVEs published 2020-09-10

43 CVEs were published on September 10, 2020: 5 critical, 13 high. Days are UTC.

- [CVE-2014-1420](https://cve.now/CVE-2014-1420.md): Insecure temp file usage in Ubuntu UI toolkit (CVSS 3.8, Canonical ubuntu-ui-toolkit)
- [CVE-2020-15171](https://cve.now/CVE-2020-15171.md): Users with SCRIPT rights can execute arbitrary code in XWiki (CVSS 6.6, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2020-15170](https://cve.now/CVE-2020-15170.md): Missing access control in apollo-adminservice (CVSS 7.0, ctripcorp apollo · com.ctrip.framework.apollo:apollo-core)
- [CVE-2020-9726](https://cve.now/CVE-2020-9726.md): FrameMaker File Parsing Out-Of-Bounds Read Vulnerability (CVSS 6.1, Adobe FrameMaker)
- [CVE-2020-9725](https://cve.now/CVE-2020-9725.md): FrameMaker File Parsing Stack-based Buffer Overflow (CVSS 7.8, Adobe FrameMaker)
- [CVE-2020-9727](https://cve.now/CVE-2020-9727.md): Out-of-bounds memory access could lead to code execution (CVSS 7.8, Adobe InDesign)
- [CVE-2020-9729](https://cve.now/CVE-2020-9729.md): Out-of-bounds memory access could lead to code execution (CVSS 7.8, Adobe InDesign)
- [CVE-2020-9730](https://cve.now/CVE-2020-9730.md): Out-of-bounds memory access could lead to code execution (CVSS 7.8, Adobe InDesign)
- [CVE-2020-9731](https://cve.now/CVE-2020-9731.md): Out-of-bounds memory access could lead to code execution (CVSS 7.8, Adobe InDesign)
- [CVE-2020-9728](https://cve.now/CVE-2020-9728.md): Out-of-bounds memory access could lead to code execution (CVSS 7.8, Adobe InDesign)
- [CVE-2020-15168](https://cve.now/CVE-2020-15168.md): File size limit bypass in node-fetch (CVSS 2.6, node-fetch)
- [CVE-2020-11998](https://cve.now/CVE-2020-11998.md): A regression has been introduced in the commit preventing JMX re-bind. (no CVSS, Apache ActiveMQ · org.apache.activemq:activemq-parent)
- [CVE-2020-15024](https://cve.now/CVE-2020-15024.md): An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. (no CVSS)
- [CVE-2020-4578](https://cve.now/CVE-2020-4578.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2020-14198](https://cve.now/CVE-2020-14198.md): Bitcoin Core 0.20.0 allows remote denial of service. (no CVSS)
- [CVE-2020-9743](https://cve.now/CVE-2020-9743.md): HTML injection in AEM's content editor component (CVSS 5.3, Adobe Experience Manager)
- [CVE-2020-9734](https://cve.now/CVE-2020-9734.md): Stored XSS in AEM Forms component (CVSS 9.0, Adobe Experience Manager)
- [CVE-2020-9742](https://cve.now/CVE-2020-9742.md): Reflected XSS in AEM Inbox module (CVSS 9.0, Adobe Experience Manager)
- [CVE-2020-9741](https://cve.now/CVE-2020-9741.md): Stored XSS in AEM Forms Components (CVSS 9.0, Adobe Experience Manager)
- [CVE-2020-9736](https://cve.now/CVE-2020-9736.md): Stored XSS in AEM's Content Repository Development Environment (CVSS 6.8, Adobe Experience Manager)
- [CVE-2020-17408](https://cve.now/CVE-2020-17408.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. (CVSS 7.5, NEC ExpressCluster)
- [CVE-2020-9735](https://cve.now/CVE-2020-9735.md): Stored XSS in AEM's Content Repository Development Environment (CVSS 6.8, Adobe Experience Manager)
- [CVE-2020-9732](https://cve.now/CVE-2020-9732.md): Stored XSS in AEM Sites Components (CVSS 9.0, Adobe Experience Manager)
- [CVE-2020-9738](https://cve.now/CVE-2020-9738.md): Stored XSS in AEM's Content Repository Development Environment (CVSS 6.8, Adobe Experience Manager)
- [CVE-2020-9737](https://cve.now/CVE-2020-9737.md): Stored XSS in AEM's Content Repository Development Environment (CVSS 6.8, Adobe Experience Manager)
- [CVE-2020-9733](https://cve.now/CVE-2020-9733.md): Sensitive information disclosure possible in AEM (CVSS 7.5, Adobe Experience Manager)
- [CVE-2020-9740](https://cve.now/CVE-2020-9740.md): Stored XSS in AEM Design Importer Component (CVSS 9.0, Adobe Experience Manager)
- [CVE-2018-17145](https://cve.now/CVE-2018-17145.md): Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction (no CVSS, bcoin)
- [CVE-2020-24582](https://cve.now/CVE-2020-24582.md): Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface. (no CVSS)
- [CVE-2020-10773](https://cve.now/CVE-2020-10773.md): A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the (CVSS 4.4, \[UNKNOWN\] kernel)
- [CVE-2020-8758](https://cve.now/CVE-2020-8758.md): Improper buffer restrictions in network subsystem in provisioned Intel(R) AMT and Intel(R) ISM versions before 11.8.79, 11.12.79, 11.22.79, (no CVSS, Intel(R) AMT and Intel(R) ISM)
- [CVE-2020-6097](https://cve.now/CVE-2020-6097.md): An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1. (CVSS 7.5, atftpd)
- [CVE-2020-5780](https://cve.now/CVE-2020-5780.md): Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a (no CVSS, Icegram Email Subscribers & Newsletters Plugin for WordPress)
- [CVE-2020-25221](https://cve.now/CVE-2020-25221.md): get\_gate\_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counti (no CVSS)
- [CVE-2020-24739](https://cve.now/CVE-2020-24739.md): A CSRF vulnerability was found in iCMS v7.0.0 in the background deletion administrator account. (no CVSS)
- [CVE-2020-7315](https://cve.now/CVE-2020-7315.md): DLL Injection vulnerability in MA for Windows (CVSS 6.0, McAfee MA for Windows)
- [CVE-2020-7314](https://cve.now/CVE-2020-7314.md): Privilege Escalation vulnerability in McAfee DXL for Mac (CVSS 8.2, McAfee DXL for Mac shipped with MA)
- [CVE-2020-7311](https://cve.now/CVE-2020-7311.md): Privilege Escalation vulnerability in MA for Windows (CVSS 7.8, McAfee MA for Windows)
- [CVE-2020-7312](https://cve.now/CVE-2020-7312.md): DLL Search Order Hijacking in MA for Windows (CVSS 7.8, McAfee MA for Windows)
- [CVE-2020-24552](https://cve.now/CVE-2020-24552.md): Atop Technology 3G/4G LTE Cellular to Ethernet and Serial Secure Industrial Gateway - Command Injection (CVSS 5.5, Atop Technology 3G/4G LTE Cellular to Ethernet and Seria… +5)
- [CVE-2020-24655](https://cve.now/CVE-2020-24655.md): A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny (no CVSS)
- [CVE-2020-25220](https://cve.now/CVE-2020-25220.md): The Linux kernel 4.9.x before 4.9.233, 4.14.x before 4.14.194, and 4.19.x before 4.19.140 has a use-after-free because skcd-\>no\_refcnt was n (no CVSS)
- [CVE-2020-13920](https://cve.now/CVE-2020-13920.md): Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. (no CVSS, Apache ActiveMQ · org.apache.activemq:activemq-parent)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.