CVEs published September 16, 2020
82 CVEs were published on September 16, 2020: 0 critical, 2 high.
- Published
- 82
- Critical
- 0
- High
- 2
- Medium
- 5
- Low
- 1
- Unrated
- 74
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- CodeMeter
- 6
- VMware Workstation and Horizon Client for Windows
- 5
- SCADAPack 7x Remote Connect V3.6.3.574 and prior.
- 4
- Jenkins project Jenkins ElasTest Plugin · org.jenkins-ci.pl…
- 3
- github.com/sylabs/singularity
- 2
- Jenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…
- 2
- Jenkins project Jenkins MongoDB Plugin · org.jenkins-ci.plu…
- 2
- Jenkins project Jenkins Perfecto Plugin · io.jenkins.plugin…
- 2
- Jenkins project Jenkins Storable Configs Plugin · org.jvnet…
- 2
- keycloak · org.keycloak:keycloak-parent
- 2
High 2
Medium, low and unrated 80
- CVE-2020-24377A DNS rebinding vulnerability in the Freebox OS web interface in Freebox Server before 4.2.3.
- CVE-2020-24376A DNS rebinding vulnerability in the UPnP IGD implementations in Freebox v5 before 1.5.29 and Freebox Server before 4.2.3.
- CVE-2020-24373A CSRF vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3.
- CVE-2020-24374A DNS rebinding vulnerability in Freebox v5 before 1.5.29.
- CVE-2020-20406A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions
- CVE-2020-16233An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back packets containing data fCodeMeter
- CVE-2020-14513CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted license file due to unverCodeMeter
- CVE-2020-14515CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file sigCodeMeter
- CVE-2020-14519This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are affected, including VCodeMeter
- CVE-2020-14517Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodCodeMeter
- CVE-2020-14509Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mechanism does not verifyCodeMeter
- CVE-2020-13259A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauthenticated, remote at
- CVE-2020-6781Improper Certificate Validation in Bosch Smart Home System App for iOSBosch Smart Home
- CVE-2020-10718A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the ThreaWildfly
- CVE-2020-1694A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience.keycloak · org.keycloak:keycloak-parent
- CVE-2020-10715A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x.openshift/console
- CVE-2020-10748A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances.keycloak · org.keycloak:keycloak-parent
- CVE-2020-25040Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations,github.com/sylabs/singularity
- CVE-2020-14348It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the user namespace puts AMAMQ
- CVE-2020-25039Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container executgithub.com/sylabs/singularity
- CVE-2020-13928Apache Atlas before 2.1.0 contain a XSS vulnerability.Apache Atlas · org.apache.atlas:apache-atlas
- CVE-2020-25015A specific router allows changing the Wi-Fi password remotely.
- CVE-2020-3990VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an information disclosure vulnerability due to an integeVMware Workstation and Horizon Client for Windows
- CVE-2020-3989VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain a denial of service vulnerability due to an out-of-boundVMware Workstation and Horizon Client for Windows
- CVE-2020-3988VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrintVMware Workstation and Horizon Client for Windows
- CVE-2020-3987VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrintVMware Workstation and Horizon Client for Windows
- CVE-2020-3986VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrintVMware Workstation and Horizon Client for Windows
- CVE-2020-3980VMware Fusion (11.x) contains a privilege escalation vulnerability due to the way it allows configuring the system wide path.VMware Fusion
- CVE-2014-10402An issue was discovered in the DBI module through 1.643 for Perl.
- CVE-2020-4708IBM Security Trusteer Pinpoint Detect 11.6.5 could disclose some information due to using a wildcard in the Access-Control-Allow-Origin headIBM Security Trusteer Pinpoint Detect
- CVE-2020-4409IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack.IBM Maximo Asset Management
- CVE-2020-7532A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator (V1.2.0 and prior) which could alloSCADAPack x70 Security Administrator V1.2.0 and prior.
- CVE-2020-7531A CWE-284 Improper Access Control vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows an attacker to plaSCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-7530A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows improper access to SCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-7529A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Transversal') vulnerability exists in SCADAPack 7x Remote ConnecSCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-7528A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which could allow arbSCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-1748A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypWildfly · org.wildfly.security:wildfly-elytron
- CVE-2020-10758A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified Keycloak · org.keycloak:keycloak-parent
- CVE-2020-10733The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths.PostgreSQL
- CVE-2020-24889A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-
- CVE-2020-25614xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of servicegithub.com/antchfx/xmlquery
- CVE-2020-24890libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent a
- CVE-2020-14382A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invcryptsetup
- CVE-2020-1710The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400JBoss Enterprise Application Platform
- CVE-2020-25412com_line() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution.
- CVE-2020-14315A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3.bsdiff
- CVE-2020-14393A buffer overflow was found in perl-DBI < 1.643 in DBI.xs.perl-dbi
- CVE-2020-2278Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permisJenkins project Jenkins Storable Configs Plugin · org.jvnet…
- CVE-2020-2276Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/ConfJenkins project Jenkins Selection tasks Plugin · org.jvnet.…
- CVE-2020-2277Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller.Jenkins project Jenkins Storable Configs Plugin · org.jvnet…
- CVE-2020-2273A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-spJenkins project Jenkins ElasTest Plugin · org.jenkins-ci.pl…
- CVE-2020-2274Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller Jenkins project Jenkins ElasTest Plugin · org.jenkins-ci.pl…
- CVE-2020-2275Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workJenkins project Jenkins Copy data to workspace Plugin · org…
- CVE-2020-2271Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scriptiJenkins project Jenkins Locked Files Report Plugin · org.jv…
- CVE-2020-2272A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacJenkins project Jenkins ElasTest Plugin · org.jenkins-ci.pl…
- CVE-2020-2269Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-sJenkins project Jenkins chosen-views-tabbar Plugin · org.je…
- CVE-2020-2270Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site sJenkins project Jenkins ClearCase Release Plugin · org.jvne…
- CVE-2020-2266Jenkins Description Column Plugin 1.3 and earlier does not escape the job description in the column tooltip, resulting in a stored cross-sitJenkins project Jenkins Description Column Plugin · org.jen…
- CVE-2020-2267A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some meJenkins project Jenkins MongoDB Plugin · org.jenkins-ci.plu…
- CVE-2020-2268A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadataJenkins project Jenkins MongoDB Plugin · org.jenkins-ci.plu…
- CVE-2020-2264Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored cross-site scripting Jenkins project Jenkins Custom Job Icon Plugin · org.jenkin…
- CVE-2020-2265Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a stored Jenkins project Jenkins Coverage/Complexity Scatter Plot Pl…
- CVE-2020-2262Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (Jenkins project Jenkins Android Lint Plugin · org.jvnet.hud…
- CVE-2020-2263Jenkins Radiator View Plugin 1.29 and earlier does not escape the full name of the jobs in tooltips, resulting in a stored cross-site scriptJenkins project Jenkins Radiator View Plugin · org.jenkins-…
- CVE-2020-2260A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attackJenkins project Jenkins Perfecto Plugin · io.jenkins.plugin…
- CVE-2020-2261Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to rJenkins project Jenkins Perfecto Plugin · io.jenkins.plugin…
- CVE-2020-2257Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site Jenkins project Jenkins Validating String Parameter Plugin…
- CVE-2020-2258Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attJenkins project Jenkins Health Advisor by CloudBees Plugin…
- CVE-2020-2259Jenkins computer-queue-plugin Plugin 1.5 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting Jenkins project Jenkins computer-queue-plugin Plugin · jenk…
- CVE-2020-2255A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an atJenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…
- CVE-2020-2256Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, Jenkins project Jenkins Pipeline Maven Integration Plugin ·…
- CVE-2020-2253Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server.Jenkins project Jenkins Email Extension Plugin · org.jenkin…
- CVE-2020-2254Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/ConfigureJenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…
- CVE-2020-2252Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server.Jenkins project Jenkins Mailer Plugin · org.jenkins-ci.plug…
- CVE-2020-14392An untrusted pointer dereference flaw was found in Perl-DBI < 1.643.perl-dbi
- CVE-2020-14386A flaw was found in the Linux kernel before 5.9-rc4.Linux Kernel kernel
- CVE-2020-25559gnuplot 5.5 is affected by double free when executing print_set_output.
- CVE-2020-7268McAfee Email Gateway (MEG) - Path Traversal vulnerabilityMcAfee Email Gateway
- CVE-2020-10781A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read theLinux Kernel kernel
- CVE-2020-14306An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3.openshift-service-mesh/istio-rhel8-operator