# CVEs published 2020-09-15

53 CVEs were published on September 15, 2020: 3 critical, 12 high. Days are UTC.

- [CVE-2020-7297](https://cve.now/CVE-2020-7297.md): Web Gateway (MWG) - Privilege Escalation vulnerability (CVSS 5.7, McAfee Web Gateway)
- [CVE-2020-10768](https://cve.now/CVE-2020-10768.md): A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation afte (CVSS 5.5, Linux Kernel kernel)
- [CVE-2020-7296](https://cve.now/CVE-2020-7296.md): Web Gateway (MWG) - Privilege Escalation vulnerability (CVSS 5.7, McAfee Web Gateway)
- [CVE-2020-7295](https://cve.now/CVE-2020-7295.md): Web Gateway (MWG) - Privilege Escalation vulnerability (CVSS 3.5, McAfee Web Gateway)
- [CVE-2020-7294](https://cve.now/CVE-2020-7294.md): Web Gateway (MWG) - Privilege Escalation vulnerability (CVSS 4.6, McAfee Web Gateway)
- [CVE-2020-7293](https://cve.now/CVE-2020-7293.md): Web Gateway (MWG) - Privilege Escalation vulnerability (CVSS 9.0, McAfee Web Gateway)
- [CVE-2020-10767](https://cve.now/CVE-2020-10767.md): A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). (CVSS 5.5, Linux Kernel kernel)
- [CVE-2020-10766](https://cve.now/CVE-2020-10766.md): A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. (CVSS 5.5, Linux Kernel kernel)
- [CVE-2020-25453](https://cve.now/CVE-2020-25453.md): An issue was discovered in BlackCat CMS before 1.4. (no CVSS)
- [CVE-2020-14385](https://cve.now/CVE-2020-14385.md): A flaw was found in the Linux kernel before 5.9-rc4. (CVSS 5.5, Linux Kernel kernel)
- [CVE-2020-23833](https://cve.now/CVE-2020-23833.md): Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers to execute arbitrary (no CVSS)
- [CVE-2020-23828](https://cve.now/CVE-2020-23828.md): A File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote attackers to achieve Remote Code Execution (RCE) (no CVSS)
- [CVE-2020-24561](https://cve.now/CVE-2020-24561.md): A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affecte (no CVSS, Trend Micro ServerProtect for Linux)
- [CVE-2020-14304](https://cve.now/CVE-2020-14304.md): A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device. (CVSS 4.4, Linux Kernel kernel)
- [CVE-2020-11977](https://cve.now/CVE-2020-11977.md): In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use (no CVSS, Apache Syncope · org.apache.syncope:syncope)
- [CVE-2020-9416](https://cve.now/CVE-2020-9416.md): TIBCO Spotfire Stored Cross Site Scripting Vulnerability (CVSS 8.2, TIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2)
- [CVE-2020-14331](https://cve.now/CVE-2020-14331.md): A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the (no CVSS, Linux Kernel)
- [CVE-2020-15172](https://cve.now/CVE-2020-15172.md): Remote Code Execution in Act module (CVSS 8.7, zephyrkul FluffyCogs)
- [CVE-2020-10759](https://cve.now/CVE-2020-10759.md): A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. (no CVSS, fwupd)
- [CVE-2020-15148](https://cve.now/CVE-2020-15148.md): Unsafe deserialization in Yii 2 (CVSS 8.9, yiisoft yii2 · yiisoft/yii2)
- [CVE-2020-15179](https://cve.now/CVE-2020-15179.md): HTML Injection in ScratchSig (CVSS 8.0, InternationalScratchWiki wiki-scratchsig)
- [CVE-2020-15178](https://cve.now/CVE-2020-15178.md): Potential XSS in PrestaShop contactform (CVSS 8.0, PrestaShop contactform · prestashop/contactform)
- [CVE-2020-25071](https://cve.now/CVE-2020-25071.md): Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visit. (no CVSS)
- [CVE-2020-8346](https://cve.now/CVE-2020-8346.md): A denial of service vulnerability was reported in the Lenovo Vantage component called Lenovo System Interface Foundation prior to version 1. (CVSS 5.5, Lenovo System Interface Foundation)
- [CVE-2020-8342](https://cve.now/CVE-2020-8342.md): A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege. (CVSS 7.3, Lenovo System Update)
- [CVE-2020-8340](https://cve.now/CVE-2020-8340.md): A cross-site scripting (XSS) vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 (Integrated Management Module 2), prior (CVSS 6.3, Lenovo System x IMM2 firmware for: x240, Machine Types:… +1)
- [CVE-2020-8339](https://cve.now/CVE-2020-8339.md): A cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module (AMM) web interf (CVSS 4.3, IBM BladeCenter AMM firmware)
- [CVE-2020-14345](https://cve.now/CVE-2020-14345.md): A flaw was found in X.Org Server before xorg-x11-server 1.20.9. (no CVSS, xorg-x11-server)
- [CVE-2020-4711](https://cve.now/CVE-2020-4711.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. (CVSS 6.5, IBM Spectrum Protect Plus)
- [CVE-2020-4703](https://cve.now/CVE-2020-4703.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which (CVSS 8.0, IBM Spectrum Protect Plus)
- [CVE-2020-4530](https://cve.now/CVE-2020-4530.md): IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Business Process Manager · IBM Business Automation Work…)
- [CVE-2020-4526](https://cve.now/CVE-2020-4526.md): IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious a (CVSS 4.3, IBM Maximo Asset Management)
- [CVE-2020-4521](https://cve.now/CVE-2020-4521.md): IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a (CVSS 8.8, IBM Maximo Asset Management)
- [CVE-2020-4344](https://cve.now/CVE-2020-4344.md): IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the sy (CVSS 4.0, IBM Tivoli Business Service Manager)
- [CVE-2019-4671](https://cve.now/CVE-2019-4671.md): IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to SQL injection. (CVSS 6.3, IBM Maximo Asset Management)
- [CVE-2020-23512](https://cve.now/CVE-2020-23512.md): VR CAM P1 Model P1 v1 has an incorrect access control vulnerability where an attacker can obtain complete access of the device from web (rem (no CVSS)
- [CVE-2020-16101](https://cve.now/CVE-2020-16101.md): It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer ac (CVSS 7.5, Gallagher Command Centre)
- [CVE-2020-16096](https://cve.now/CVE-2020-16096.md): In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior to (CVSS 9.9, Gallagher Command Centre)
- [CVE-2020-16098](https://cve.now/CVE-2020-16098.md): It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8 (CVSS 9.8, Gallagher Command Centre)
- [CVE-2020-16100](https://cve.now/CVE-2020-16100.md): It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to im (CVSS 7.5, Gallagher Command Centre)
- [CVE-2020-16097](https://cve.now/CVE-2020-16097.md): On controllers running versions of v8.20 prior to vCR8.20.200221b (distributed in v8.20.1093(MR2)), v8.10 prior to vGR8.10.179 (distributed (CVSS 7.3, Gallagher Command Centre)
- [CVE-2020-16099](https://cve.now/CVE-2020-16099.md): In Gallagher Command Centre v8.20 prior to v8.20.1093(MR2) it is possible to create Guard Tour events that when accessed via things like rep (CVSS 4.3, Gallagher Command Centre)
- [CVE-2020-23451](https://cve.now/CVE-2020-23451.md): Spiceworks Version \<= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function. (no CVSS)
- [CVE-2020-24925](https://cve.now/CVE-2020-24925.md): A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. (no CVSS)
- [CVE-2020-24924](https://cve.now/CVE-2020-24924.md): A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using th (no CVSS)
- [CVE-2020-13307](https://cve.now/CVE-2020-13307.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 3.8, GitLab)
- [CVE-2020-13308](https://cve.now/CVE-2020-13308.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 2.7, GitLab)
- [CVE-2020-13303](https://cve.now/CVE-2020-13303.md): A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. (CVSS 7.1, GitLab)
- [CVE-2020-8927](https://cve.now/CVE-2020-8927.md): Buffer overflow in Brotli library (CVSS 5.3, Google Brotli · brotli +119)
- [CVE-2020-14314](https://cve.now/CVE-2020-14314.md): A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a direc (CVSS 5.5, Linux Kernel kernel)
- [CVE-2020-14346](https://cve.now/CVE-2020-14346.md): A flaw was found in xorg-x11-server before 1.20.9. (no CVSS, xorg-x11-server)
- [CVE-2020-14361](https://cve.now/CVE-2020-14361.md): A flaw was found in X.Org Server before xorg-x11-server 1.20.9. (no CVSS, xorg-x11-server)
- [CVE-2020-14362](https://cve.now/CVE-2020-14362.md): A flaw was found in X.Org Server before xorg-x11-server 1.20.9. (no CVSS, xorg-x11-server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.