CVEs published September 14, 2020
60 CVEs were published on September 14, 2020: 1 critical, 3 high.
- Published
- 60
- Critical
- 1
- High
- 3
- Medium
- 13
- Low
- 7
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- GitLab
- 22
- Apache Struts · org.apache.struts:struts2-core
- 2
- failure
- 1
- http
- 1
- Intel BIOS
- 1
- lemonldap-ng-handler
- 1
- LG Electronics (LGPCSuite_Setup),
- 1
- linked-hash-map
- 1
- QT Library
- 1
- rand_core
- 1
Critical 1
High 3
- CVE-2020-13298A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13299A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13300GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the auGitLab
Medium, low and unrated 56
- CVE-2020-13305A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13309A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13310A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1.GitLab
- CVE-2020-13315A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13306A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13301A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13302A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13297A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13304A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-15590A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN
- CVE-2020-11881An array index error in MikroTik RouterOS 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5, allows an unauthenticated remote attacker to cra
- CVE-2020-10227A cross-site scripting (XSS) vulnerability in the messages module of vtecrm vtenext 19 CE allows attackers to inject arbitrary JavaScript co
- CVE-2020-10228A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload files with a .pht extension, resulting in remote co
- CVE-2020-10229A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, a
- CVE-2020-13314A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13311A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13312A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13313A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13317A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4.GitLab
- CVE-2019-14761An issue was discovered in KaiOS 2.5.
- CVE-2019-14760An issue was discovered in KaiOS 2.5.
- CVE-2019-14759An issue was discovered in KaiOS 1.0, 2.5, and 2.5.1.
- CVE-2019-14758An issue was discovered in KaiOS 2.5 and 2.5.1.
- CVE-2019-14757An issue was discovered in KaiOS 2.5 and 2.5.1.
- CVE-2020-13318A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13284A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13289A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13287A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13316A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2019-14756An issue was discovered in KaiOS 1.0, 2.5, and 2.5.12.5.
- CVE-2020-24457Logic error in BIOS firmware for 8th, 9th and 10th Generation Intel(R) Core(TM) Processors may allow an unauthenticated user to potentially Intel BIOS
- CVE-2020-0570Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation QT Library
- CVE-2020-25573An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust.linked-hash-map
- CVE-2020-25574An issue was discovered in the http crate before 0.1.20 for Rust.http
- CVE-2020-25576An issue was discovered in the rand_core crate before 0.4.2 for Rust.rand_core
- CVE-2020-21845Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.'
- CVE-2019-0233An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.Apache Struts · org.apache.struts:struts2-core
- CVE-2019-0230Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code exeApache Struts · org.apache.struts:struts2-core
- CVE-2020-25380Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in
- CVE-2020-25379Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an a
- CVE-2020-25378Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter.
- CVE-2020-22158MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS.
- CVE-2020-25375Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code fiel
- CVE-2020-8817Dataiku DSS before 6.0.5 allows attackers write access to the project to modify the "Created by" metadata.
- CVE-2018-20432D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use hardcoded credentials for telnet connection, which allows unauthenticated attac
- CVE-2020-11684AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged
- CVE-2020-11683A timing side channel was discovered in AT91bootstrap before 3.9.2.
- CVE-2020-12789The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.
- CVE-2020-12788CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.
- CVE-2020-12787Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.
- CVE-2020-24660An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used.lemonldap-ng-handler
- CVE-2020-25540ThinkAdmin v6 is affected by a directory traversal vulnerability.zoujingli/thinkadmin
- CVE-2020-7807DLL Hijacking Vulnerabilities During Installation of LG Electronics SoftwareLG Electronics (LGPCSuite_Setup),
- CVE-2020-21733Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp.
- CVE-2020-21732Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS).
- CVE-2020-21731Gazie 7.29 is affected by: Cross Site Scripting (XSS) via http://192.168.100.7/gazie/modules/config/admin_utente.php?user_name=amministrator