# CVEs published 2020-09-14

60 CVEs were published on September 14, 2020: 1 critical, 3 high. Days are UTC.

- [CVE-2020-13298](https://cve.now/CVE-2020-13298.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 7.2, GitLab)
- [CVE-2020-13305](https://cve.now/CVE-2020-13305.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 3.5, GitLab)
- [CVE-2020-13309](https://cve.now/CVE-2020-13309.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 5.4, GitLab)
- [CVE-2020-13310](https://cve.now/CVE-2020-13310.md): A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. (CVSS 6.5, GitLab)
- [CVE-2020-13315](https://cve.now/CVE-2020-13315.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 3.7, GitLab)
- [CVE-2020-13306](https://cve.now/CVE-2020-13306.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 3.7, GitLab)
- [CVE-2020-13301](https://cve.now/CVE-2020-13301.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 5.5, GitLab)
- [CVE-2020-13302](https://cve.now/CVE-2020-13302.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 3.8, GitLab)
- [CVE-2020-13297](https://cve.now/CVE-2020-13297.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 3.8, GitLab)
- [CVE-2020-13304](https://cve.now/CVE-2020-13304.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 3.8, GitLab)
- [CVE-2020-15590](https://cve.now/CVE-2020-15590.md): A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN (no CVSS)
- [CVE-2020-11881](https://cve.now/CVE-2020-11881.md): An array index error in MikroTik RouterOS 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5, allows an unauthenticated remote attacker to cra (no CVSS)
- [CVE-2020-10227](https://cve.now/CVE-2020-10227.md): A cross-site scripting (XSS) vulnerability in the messages module of vtecrm vtenext 19 CE allows attackers to inject arbitrary JavaScript co (no CVSS)
- [CVE-2020-10228](https://cve.now/CVE-2020-10228.md): A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload files with a .pht extension, resulting in remote co (no CVSS)
- [CVE-2020-10229](https://cve.now/CVE-2020-10229.md): A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, a (no CVSS)
- [CVE-2020-13314](https://cve.now/CVE-2020-13314.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 3.7, GitLab)
- [CVE-2020-13311](https://cve.now/CVE-2020-13311.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 4.3, GitLab)
- [CVE-2020-13312](https://cve.now/CVE-2020-13312.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 6.5, GitLab)
- [CVE-2020-13313](https://cve.now/CVE-2020-13313.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 4.3, GitLab)
- [CVE-2020-13317](https://cve.now/CVE-2020-13317.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. (CVSS 6.5, GitLab)
- [CVE-2019-14761](https://cve.now/CVE-2019-14761.md): An issue was discovered in KaiOS 2.5. (no CVSS)
- [CVE-2019-14760](https://cve.now/CVE-2019-14760.md): An issue was discovered in KaiOS 2.5. (no CVSS)
- [CVE-2019-14759](https://cve.now/CVE-2019-14759.md): An issue was discovered in KaiOS 1.0, 2.5, and 2.5.1. (no CVSS)
- [CVE-2019-14758](https://cve.now/CVE-2019-14758.md): An issue was discovered in KaiOS 2.5 and 2.5.1. (no CVSS)
- [CVE-2019-14757](https://cve.now/CVE-2019-14757.md): An issue was discovered in KaiOS 2.5 and 2.5.1. (no CVSS)
- [CVE-2020-13318](https://cve.now/CVE-2020-13318.md): A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. (CVSS 6.4, GitLab)
- [CVE-2020-13284](https://cve.now/CVE-2020-13284.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 6.5, GitLab)
- [CVE-2020-13289](https://cve.now/CVE-2020-13289.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 5.4, GitLab)
- [CVE-2020-13287](https://cve.now/CVE-2020-13287.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 4.3, GitLab)
- [CVE-2020-13316](https://cve.now/CVE-2020-13316.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 5.4, GitLab)
- [CVE-2020-13299](https://cve.now/CVE-2020-13299.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 8.1, GitLab)
- [CVE-2020-13300](https://cve.now/CVE-2020-13300.md): GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the au (CVSS 8.0, GitLab)
- [CVE-2019-14756](https://cve.now/CVE-2019-14756.md): An issue was discovered in KaiOS 1.0, 2.5, and 2.5.12.5. (no CVSS)
- [CVE-2020-24457](https://cve.now/CVE-2020-24457.md): Logic error in BIOS firmware for 8th, 9th and 10th Generation Intel(R) Core(TM) Processors may allow an unauthenticated user to potentially (no CVSS, Intel BIOS)
- [CVE-2020-0570](https://cve.now/CVE-2020-0570.md): Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation (no CVSS, QT Library)
- [CVE-2020-25573](https://cve.now/CVE-2020-25573.md): An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust. (no CVSS, linked-hash-map)
- [CVE-2020-25574](https://cve.now/CVE-2020-25574.md): An issue was discovered in the http crate before 0.1.20 for Rust. (no CVSS, http)
- [CVE-2020-25576](https://cve.now/CVE-2020-25576.md): An issue was discovered in the rand\_core crate before 0.4.2 for Rust. (no CVSS, rand\_core)
- [CVE-2020-25575](https://cve.now/CVE-2020-25575.md): An issue was discovered in the failure crate through 0.1.5 for Rust. (CVSS 9.8, failure)
- [CVE-2020-21845](https://cve.now/CVE-2020-21845.md): Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.' (no CVSS)
- [CVE-2019-0233](https://cve.now/CVE-2019-0233.md): An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload. (no CVSS, Apache Struts · org.apache.struts:struts2-core)
- [CVE-2019-0230](https://cve.now/CVE-2019-0230.md): Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code exe (no CVSS, Apache Struts · org.apache.struts:struts2-core)
- [CVE-2020-25380](https://cve.now/CVE-2020-25380.md): Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in (no CVSS)
- [CVE-2020-25379](https://cve.now/CVE-2020-25379.md): Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer\[\]' parameter which allows an a (no CVSS)
- [CVE-2020-25378](https://cve.now/CVE-2020-25378.md): Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter. (no CVSS)
- [CVE-2020-22158](https://cve.now/CVE-2020-22158.md): MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. (no CVSS)
- [CVE-2020-25375](https://cve.now/CVE-2020-25375.md): Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code fiel (no CVSS)
- [CVE-2020-8817](https://cve.now/CVE-2020-8817.md): Dataiku DSS before 6.0.5 allows attackers write access to the project to modify the "Created by" metadata. (no CVSS)
- [CVE-2018-20432](https://cve.now/CVE-2018-20432.md): D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use hardcoded credentials for telnet connection, which allows unauthenticated attac (no CVSS)
- [CVE-2020-11684](https://cve.now/CVE-2020-11684.md): AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged (no CVSS)
- [CVE-2020-11683](https://cve.now/CVE-2020-11683.md): A timing side channel was discovered in AT91bootstrap before 3.9.2. (no CVSS)
- [CVE-2020-12789](https://cve.now/CVE-2020-12789.md): The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets. (no CVSS)
- [CVE-2020-12788](https://cve.now/CVE-2020-12788.md): CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks. (no CVSS)
- [CVE-2020-12787](https://cve.now/CVE-2020-12787.md): Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling. (no CVSS)
- [CVE-2020-24660](https://cve.now/CVE-2020-24660.md): An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. (no CVSS, lemonldap-ng-handler)
- [CVE-2020-25540](https://cve.now/CVE-2020-25540.md): ThinkAdmin v6 is affected by a directory traversal vulnerability. (no CVSS, zoujingli/thinkadmin)
- [CVE-2020-7807](https://cve.now/CVE-2020-7807.md): DLL Hijacking Vulnerabilities During Installation of LG Electronics Software (CVSS 5.6, LG Electronics (LGPCSuite\_Setup),)
- [CVE-2020-21733](https://cve.now/CVE-2020-21733.md): Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp. (no CVSS)
- [CVE-2020-21732](https://cve.now/CVE-2020-21732.md): Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). (no CVSS)
- [CVE-2020-21731](https://cve.now/CVE-2020-21731.md): Gazie 7.29 is affected by: Cross Site Scripting (XSS) via http://192.168.100.7/gazie/modules/config/admin\_utente.php?user\_name=amministrator (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.