CVEs published September 15, 2020
53 CVEs were published on September 15, 2020: 3 critical, 12 high.
- Published
- 53
- Critical
- 3
- High
- 12
- Medium
- 19
- Low
- 3
- Unrated
- 16
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- Gallagher Command Centre
- 6
- Linux Kernel kernel
- 6
- McAfee Web Gateway
- 5
- xorg-x11-server
- 4
- GitLab
- 3
- IBM Maximo Asset Management
- 3
- IBM Spectrum Protect Plus
- 2
- Apache Syncope · org.apache.syncope:syncope
- 1
- fwupd
- 1
- Google Brotli · brotli +119
- 1
Critical 3
- CVE-2020-7293Web Gateway (MWG) - Privilege Escalation vulnerabilityMcAfee Web Gateway
- CVE-2020-16096In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior to Gallagher Command Centre
- CVE-2020-16098It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8Gallagher Command Centre
High 12
- CVE-2020-9416TIBCO Spotfire Stored Cross Site Scripting VulnerabilityTIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2
- CVE-2020-15172Remote Code Execution in Act modulezephyrkul FluffyCogs
- CVE-2020-15148Unsafe deserialization in Yii 2yiisoft yii2 · yiisoft/yii2
- CVE-2020-15179HTML Injection in ScratchSigInternationalScratchWiki wiki-scratchsig
- CVE-2020-15178Potential XSS in PrestaShop contactformPrestaShop contactform · prestashop/contactform
- CVE-2020-8342A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege.Lenovo System Update
- CVE-2020-4703IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files whichIBM Spectrum Protect Plus
- CVE-2020-4521IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by aIBM Maximo Asset Management
- CVE-2020-16101It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer acGallagher Command Centre
- CVE-2020-16100It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to imGallagher Command Centre
- CVE-2020-16097On controllers running versions of v8.20 prior to vCR8.20.200221b (distributed in v8.20.1093(MR2)), v8.10 prior to vGR8.10.179 (distributed Gallagher Command Centre
- CVE-2020-13303A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
Medium, low and unrated 38
- CVE-2020-7297Web Gateway (MWG) - Privilege Escalation vulnerabilityMcAfee Web Gateway
- CVE-2020-10768A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation afteLinux Kernel kernel
- CVE-2020-7296Web Gateway (MWG) - Privilege Escalation vulnerabilityMcAfee Web Gateway
- CVE-2020-7295Web Gateway (MWG) - Privilege Escalation vulnerabilityMcAfee Web Gateway
- CVE-2020-7294Web Gateway (MWG) - Privilege Escalation vulnerabilityMcAfee Web Gateway
- CVE-2020-10767A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier).Linux Kernel kernel
- CVE-2020-10766A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD.Linux Kernel kernel
- CVE-2020-25453An issue was discovered in BlackCat CMS before 1.4.
- CVE-2020-14385A flaw was found in the Linux kernel before 5.9-rc4.Linux Kernel kernel
- CVE-2020-23833Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers to execute arbitrary
- CVE-2020-23828A File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote attackers to achieve Remote Code Execution (RCE)
- CVE-2020-24561A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affecteTrend Micro ServerProtect for Linux
- CVE-2020-14304A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device.Linux Kernel kernel
- CVE-2020-11977In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can useApache Syncope · org.apache.syncope:syncope
- CVE-2020-14331A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the Linux Kernel
- CVE-2020-10759A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware.fwupd
- CVE-2020-25071Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visit.
- CVE-2020-8346A denial of service vulnerability was reported in the Lenovo Vantage component called Lenovo System Interface Foundation prior to version 1.Lenovo System Interface Foundation
- CVE-2020-8340A cross-site scripting (XSS) vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 (Integrated Management Module 2), priorLenovo System x IMM2 firmware for: x240, Machine Types:… +1
- CVE-2020-8339A cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module (AMM) web interfIBM BladeCenter AMM firmware
- CVE-2020-14345A flaw was found in X.Org Server before xorg-x11-server 1.20.9.xorg-x11-server
- CVE-2020-4711IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system.IBM Spectrum Protect Plus
- CVE-2020-4530IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting.IBM Business Process Manager · IBM Business Automation Work…
- CVE-2020-4526IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious aIBM Maximo Asset Management
- CVE-2020-4344IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the syIBM Tivoli Business Service Manager
- CVE-2019-4671IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to SQL injection.IBM Maximo Asset Management
- CVE-2020-23512VR CAM P1 Model P1 v1 has an incorrect access control vulnerability where an attacker can obtain complete access of the device from web (rem
- CVE-2020-16099In Gallagher Command Centre v8.20 prior to v8.20.1093(MR2) it is possible to create Guard Tour events that when accessed via things like repGallagher Command Centre
- CVE-2020-23451Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function.
- CVE-2020-24925A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3.
- CVE-2020-24924A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using th
- CVE-2020-13307A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-13308A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4.GitLab
- CVE-2020-8927Buffer overflow in Brotli libraryGoogle Brotli · brotli +119
- CVE-2020-14314A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a direcLinux Kernel kernel
- CVE-2020-14346A flaw was found in xorg-x11-server before 1.20.9.xorg-x11-server
- CVE-2020-14361A flaw was found in X.Org Server before xorg-x11-server 1.20.9.xorg-x11-server
- CVE-2020-14362A flaw was found in X.Org Server before xorg-x11-server 1.20.9.xorg-x11-server