# CVEs published 2020-09-17

138 CVEs were published on September 17, 2020: 1 critical, 6 high. Days are UTC.

- [CVE-2020-15187](https://cve.now/CVE-2020-15187.md): Duplicate plugin entries in Helm (CVSS 3.0, helm · helm.sh/helm/v3 +1)
- [CVE-2020-15186](https://cve.now/CVE-2020-15186.md): Improper sanitization of plugin names in Helm (CVSS 3.4, helm · helm.sh/helm/v3 +1)
- [CVE-2020-15185](https://cve.now/CVE-2020-15185.md): Duplicated chart entries in Helm (CVSS 2.2, helm · helm.sh/helm/v3 +1)
- [CVE-2020-0375](https://cve.now/CVE-2020-0375.md): In Telephony, there is a possible permission bypass due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0374](https://cve.now/CVE-2020-0374.md): In NFC, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0266](https://cve.now/CVE-2020-0266.md): In factory reset protection, there is a possible FRP bypass due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0363](https://cve.now/CVE-2020-0363.md): In libmedia, there is a possible resource exhaustion due to improper input validation. (no CVSS, Android)
- [CVE-2020-0362](https://cve.now/CVE-2020-0362.md): In libstagefright, there is a possible resource exhaustion due to improper input validation. (no CVSS, Android)
- [CVE-2020-0353](https://cve.now/CVE-2020-0353.md): In libmp4extractor, there is a possible resource exhaustion due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0351](https://cve.now/CVE-2020-0351.md): In libstagefright, there is possible CPU exhaustion due to improper input validation. (no CVSS, Android)
- [CVE-2020-0332](https://cve.now/CVE-2020-0332.md): In libstagefright, there is a possible dead loop due to an uncaught exception. (no CVSS, Android)
- [CVE-2020-0320](https://cve.now/CVE-2020-0320.md): In libstagefright, there is a possible resource exhaustion due to improper input validation. (no CVSS, Android)
- [CVE-2020-0301](https://cve.now/CVE-2020-0301.md): In libstagefright, there is a possible resource exhaustion due to improper input validation. (no CVSS, Android)
- [CVE-2020-0287](https://cve.now/CVE-2020-0287.md): In libmkvextractor, there is a possible resource exhaustion due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0373](https://cve.now/CVE-2020-0373.md): In SoundTriggerHwService, there is a possible out of bounds read due to a race condition. (no CVSS, Android)
- [CVE-2020-0370](https://cve.now/CVE-2020-0370.md): In libAACdec, there is a possible out of bounds read due to missing bounds check. (no CVSS, Android)
- [CVE-2020-0364](https://cve.now/CVE-2020-0364.md): In libDRCdec, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0361](https://cve.now/CVE-2020-0361.md): In libDRCdec, there is a possible information disclosure due to uninitialized data. (no CVSS, Android)
- [CVE-2020-0359](https://cve.now/CVE-2020-0359.md): In GLESRenderEngine, there is a possible out of bounds read due to a buffer overflow. (no CVSS, Android)
- [CVE-2020-0355](https://cve.now/CVE-2020-0355.md): In libFraunhoferAAC, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0344](https://cve.now/CVE-2020-0344.md): In MediaProvider, there is a possible permissions bypass due to SQL injection. (no CVSS, Android)
- [CVE-2020-0340](https://cve.now/CVE-2020-0340.md): In libcodec2\_soft\_mp3dec, there is a possible information disclosure due to uninitialized data. (no CVSS, Android)
- [CVE-2020-0329](https://cve.now/CVE-2020-0329.md): In the OMX encoder, there is a possible out of bounds read due to invalid input validation. (no CVSS, Android)
- [CVE-2020-0328](https://cve.now/CVE-2020-0328.md): In the camera, there is a possible out of bounds read due to an integer overflow. (no CVSS, Android)
- [CVE-2020-0324](https://cve.now/CVE-2020-0324.md): In libsonivox, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0314](https://cve.now/CVE-2020-0314.md): In AudioService, there are missing permission checks. (no CVSS, Android)
- [CVE-2020-0279](https://cve.now/CVE-2020-0279.md): In the AAC parser, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0274](https://cve.now/CVE-2020-0274.md): In the OMX parser, there is a possible information disclosure due to a returned raw pointer. (no CVSS, Android)
- [CVE-2020-0270](https://cve.now/CVE-2020-0270.md): In tremolo, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0125](https://cve.now/CVE-2020-0125.md): In mediadrm, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0406](https://cve.now/CVE-2020-0406.md): In libmpeg2dec, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0360](https://cve.now/CVE-2020-0360.md): In Notification Access Confirmation, there is a possible permissions bypass due to uninformed consent. (no CVSS, Android)
- [CVE-2020-0358](https://cve.now/CVE-2020-0358.md): In SurfaceFlinger, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2020-0357](https://cve.now/CVE-2020-0357.md): In SurfaceFlinger, there is a possible use-after-free due to improper locking. (no CVSS, Android)
- [CVE-2020-0356](https://cve.now/CVE-2020-0356.md): In the Audio HAL, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2020-0346](https://cve.now/CVE-2020-0346.md): In Mediaserver, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2020-0336](https://cve.now/CVE-2020-0336.md): In SurfaceFlinger, there is possible memory corruption due to type confusion. (no CVSS, Android)
- [CVE-2020-0306](https://cve.now/CVE-2020-0306.md): In LLVM, there is a possible ineffective stack cookie placement due to stack frame double reservation. (no CVSS, Android)
- [CVE-2020-0321](https://cve.now/CVE-2020-0321.md): In the mp3 extractor, there is a possible out of bounds write due to uninitialized data. (no CVSS, Android)
- [CVE-2020-0303](https://cve.now/CVE-2020-0303.md): In the Media extractor, there is a possible use after free due to improper locking. (no CVSS, Android)
- [CVE-2020-0264](https://cve.now/CVE-2020-0264.md): In libstagefright, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2020-0426](https://cve.now/CVE-2020-0426.md): In SyncManager, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0425](https://cve.now/CVE-2020-0425.md): There is a possible way to view notifications even when the "Lockdown" feature is on. (no CVSS, Android)
- [CVE-2020-0323](https://cve.now/CVE-2020-0323.md): In libavb, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0322](https://cve.now/CVE-2020-0322.md): In apexd, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0369](https://cve.now/CVE-2020-0369.md): In libavb, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2020-0372](https://cve.now/CVE-2020-0372.md): In ActivityManager, there is a possible access to protected data due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0352](https://cve.now/CVE-2020-0352.md): In MediaProvider, there is a possible permissions bypass due to SQL injection. (no CVSS, Android)
- [CVE-2020-0343](https://cve.now/CVE-2020-0343.md): In NetworkStatsService, there is a possible access to protected data due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0317](https://cve.now/CVE-2020-0317.md): In UsageStatsManager, there is a possible access to protected data due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0312](https://cve.now/CVE-2020-0312.md): In Battery Saver, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0308](https://cve.now/CVE-2020-0308.md): In Window Manager, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0297](https://cve.now/CVE-2020-0297.md): In devicepolicy service, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0296](https://cve.now/CVE-2020-0296.md): In ADB server and USB server, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0293](https://cve.now/CVE-2020-0293.md): In Java network APIs, there is possible access to sensitive network state due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0290](https://cve.now/CVE-2020-0290.md): In PackageManager, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0289](https://cve.now/CVE-2020-0289.md): In PackageManager, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0288](https://cve.now/CVE-2020-0288.md): In PackageManager, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0366](https://cve.now/CVE-2020-0366.md): In PackageInstaller, there is a possible permissions bypass due to a tapjacking vulnerability. (no CVSS, Android)
- [CVE-2020-0345](https://cve.now/CVE-2020-0345.md): In DocumentsUI, there is a possible permission bypass due to a confused deputy. (no CVSS, Android)
- [CVE-2020-0341](https://cve.now/CVE-2020-0341.md): In DisplayManager, there is a possible permission bypass due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0277](https://cve.now/CVE-2020-0277.md): In NetworkPolicyManagerService, there is a possible permissions bypass due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0130](https://cve.now/CVE-2020-0130.md): In screencap, there is a possible command injection due to improper input validation. (no CVSS, Android)
- [CVE-2020-0333](https://cve.now/CVE-2020-0333.md): In UrlQuerySanitizer, there is a possible improper input validation. (no CVSS, Android)
- [CVE-2020-0338](https://cve.now/CVE-2020-0338.md): In checkKeyIntent of AccountManagerService.java, there is a possible permission bypass. (no CVSS, Android)
- [CVE-2020-0337](https://cve.now/CVE-2020-0337.md): In MediaProvider, there is a possible bypass of a permissions check due to a confused deputy. (no CVSS, Android)
- [CVE-2020-0275](https://cve.now/CVE-2020-0275.md): In MediaProvider, there is a possible way to access ContentResolver and MediaStore entries the app shouldn't have access to due to a permiss (no CVSS, Android)
- [CVE-2020-0267](https://cve.now/CVE-2020-0267.md): In WindowManager, there is a possible launch of an unexpected app due to a confused deputy. (no CVSS, Android)
- [CVE-2020-0330](https://cve.now/CVE-2020-0330.md): In iorap, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2020-15184](https://cve.now/CVE-2020-15184.md): Aliases are never checked in Helm (CVSS 3.7, helm · helm.sh/helm/v3 +1)
- [CVE-2020-15183](https://cve.now/CVE-2020-15183.md): Reflected XSS leading to RCE in SoyCMS (CVSS 8.4, inunosinsi soycms)
- [CVE-2020-13260](https://cve.now/CVE-2020-13260.md): A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a (no CVSS)
- [CVE-2020-15182](https://cve.now/CVE-2020-15182.md): Cross-site Request Forgery leading to RCE in SOY CMS (CVSS 8.4, inunosinsi soycms)
- [CVE-2020-0434](https://cve.now/CVE-2020-0434.md): In Pixel's use of the Catpipe library, there is possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2020-0433](https://cve.now/CVE-2020-0433.md): In blk\_mq\_queue\_tag\_busy\_iter of blk-mq-tag.c, there is a possible use after free due to improper locking. (no CVSS, Android)
- [CVE-2020-0432](https://cve.now/CVE-2020-0432.md): In skb\_to\_mamac of networking.c, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2020-0431](https://cve.now/CVE-2020-0431.md): In kbd\_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0430](https://cve.now/CVE-2020-0430.md): In skb\_headlen of /include/linux/skbuff.h, there is a possible out of bounds read due to memory corruption. (no CVSS, Android)
- [CVE-2020-0429](https://cve.now/CVE-2020-0429.md): In l2tp\_session\_delete and related functions of l2tp\_core.c, there is possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2020-0428](https://cve.now/CVE-2020-0428.md): In CamX code, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2020-24750](https://cve.now/CVE-2020-24750.md): FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.h (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-0403](https://cve.now/CVE-2020-0403.md): In the FPC TrustZone fingerprint App, there is a possible invalid command handler due to an exposed test feature. (no CVSS, Android)
- [CVE-2020-0387](https://cve.now/CVE-2020-0387.md): In manifest files of the SmartSpace package, there is a possible tapjacking vector due to a missing permission check. (no CVSS, Android)
- [CVE-2020-24753](https://cve.now/CVE-2020-24753.md): A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execut (no CVSS)
- [CVE-2020-13169](https://cve.now/CVE-2020-13169.md): Stored XSS (Cross-Site Scripting) exists in the SolarWinds Orion Platform before before 2020.2.1 on multiple forms and pages. (no CVSS)
- [CVE-2019-20919](https://cve.now/CVE-2019-20919.md): An issue was discovered in the DBI module before 1.643 for Perl. (no CVSS)
- [CVE-2020-25729](https://cve.now/CVE-2020-25729.md): ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php. (no CVSS)
- [CVE-2020-25489](https://cve.now/CVE-2020-25489.md): A heap overflow in Sqreen PyMiniRacer (aka Python Mini Racer) before 0.3.0 allows remote attackers to potentially exploit heap corruption. (no CVSS, py-mini-racer)
- [CVE-2020-25490](https://cve.now/CVE-2020-25490.md): Lack of cryptographic signature verification in the Sqreen PHP agent daemon before 1.16.0 makes it easier for remote attackers to inject rul (no CVSS)
- [CVE-2020-24046](https://cve.now/CVE-2020-24046.md): A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. (no CVSS)
- [CVE-2020-24045](https://cve.now/CVE-2020-24045.md): A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. (no CVSS)
- [CVE-2020-25727](https://cve.now/CVE-2020-25727.md): The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within (no CVSS)
- [CVE-2020-25728](https://cve.now/CVE-2020-25728.md): The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change a (no CVSS)
- [CVE-2020-11700](https://cve.now/CVE-2020-11700.md): An issue was discovered in Titan SpamTitan 7.07. (no CVSS)
- [CVE-2020-11699](https://cve.now/CVE-2020-11699.md): An issue was discovered in Titan SpamTitan 7.07. (no CVSS)
- [CVE-2020-11698](https://cve.now/CVE-2020-11698.md): An issue was discovered in Titan SpamTitan 7.07. (no CVSS)
- [CVE-2020-11804](https://cve.now/CVE-2020-11804.md): An issue was discovered in Titan SpamTitan 7.07. (no CVSS)
- [CVE-2020-11803](https://cve.now/CVE-2020-11803.md): An issue was discovered in Titan SpamTitan 7.07. (no CVSS)
- [CVE-2020-0342](https://cve.now/CVE-2020-0342.md): There is a possible out of bounds write due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-160812576 (no CVSS, Android)
- [CVE-2020-0278](https://cve.now/CVE-2020-0278.md): There is a possible out of bounds write due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-160812574 (no CVSS, Android)
- [CVE-2020-0391](https://cve.now/CVE-2020-0391.md): In applyPolicy of PackageManagerService.java, there is possible arbitrary command execution as System due to an unenforced protected-broadca (no CVSS, Android)
- [CVE-2020-0390](https://cve.now/CVE-2020-0390.md): In the app zygote SE Policy, there is a possible permissions bypass. (no CVSS, Android)
- [CVE-2020-0389](https://cve.now/CVE-2020-0389.md): In createSaveNotification of RecordingService.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0229](https://cve.now/CVE-2020-0229.md): There is a possible out of bounds write due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-156333725 (no CVSS, Android)
- [CVE-2020-0388](https://cve.now/CVE-2020-0388.md): In createEmergencyLocationUserNotification of GnssVisibilityControl.java, there is a possible permissions bypass due to an empty mutable Pen (no CVSS, Android)
- [CVE-2020-0386](https://cve.now/CVE-2020-0386.md): In onCreate of RequestPermissionActivity.java, there is a possible tapjacking vector due to an insecure default value. (no CVSS, Android)
- [CVE-2020-0394](https://cve.now/CVE-2020-0394.md): In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. (no CVSS, Android)
- [CVE-2020-0396](https://cve.now/CVE-2020-0396.md): In various places in Telephony, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0397](https://cve.now/CVE-2020-0397.md): In getNotificationBuilder of CarrierServiceStateTracker.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0395](https://cve.now/CVE-2020-0395.md): In showNotification of EmergencyCallbackModeService.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0393](https://cve.now/CVE-2020-0393.md): In decrypt and decrypt\_1\_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0399](https://cve.now/CVE-2020-0399.md): In showLimitedSimFunctionWarningNotification of NotificationMgr.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0407](https://cve.now/CVE-2020-0407.md): In various functions in fscrypt\_ice.c and related files in some implementations of f2fs encryption that use encryption hardware which only s (no CVSS, Android)
- [CVE-2020-0382](https://cve.now/CVE-2020-0382.md): In RunInternal of dumpstate.cpp, there is a possible user consent bypass due to an uncaught exception. (no CVSS, Android)
- [CVE-2020-0245](https://cve.now/CVE-2020-0245.md): In DecodeFrameCombinedMode of combined\_decode.cpp, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2020-0401](https://cve.now/CVE-2020-0401.md): In setInstallerPackageName of PackageManagerService.java, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0392](https://cve.now/CVE-2020-0392.md): In getLayerDebugInfo of SurfaceFlinger.cpp, there is a possible code execution due to a double free. (no CVSS, Android)
- [CVE-2020-0383](https://cve.now/CVE-2020-0383.md): In Parse\_ins of eas\_mdls.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0385](https://cve.now/CVE-2020-0385.md): In Parse\_insh of eas\_mdls.c, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2020-0384](https://cve.now/CVE-2020-0384.md): In Parse\_art of eas\_mdls.c, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2020-0381](https://cve.now/CVE-2020-0381.md): In Parse\_wave of eas\_mdls.c, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2020-0379](https://cve.now/CVE-2020-0379.md): In the Bluetooth service, there is a possible spoofing attack due to a logic error. (no CVSS, Android)
- [CVE-2020-0123](https://cve.now/CVE-2020-0123.md): There is a possible out of bounds write due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-149871374 (no CVSS, Android)
- [CVE-2020-0380](https://cve.now/CVE-2020-0380.md): In allocExcessBits of bitalloc.c, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2020-0074](https://cve.now/CVE-2020-0074.md): In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default hand (no CVSS, Android)
- [CVE-2020-0404](https://cve.now/CVE-2020-0404.md): In uvc\_scan\_chain\_forward of uvc\_driver.c, there is a possible linked list corruption due to an unusual root cause. (no CVSS, Android)
- [CVE-2020-14338](https://cve.now/CVE-2020-14338.md): A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfl (no CVSS, Wildfly · xerces:xercesImpl)
- [CVE-2020-13944](https://cve.now/CVE-2020-13944.md): In Apache Airflow \< 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. (no CVSS, Apache Airflow · apache-airflow)
- [CVE-2020-13948](https://cve.now/CVE-2020-13948.md): While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templ (no CVSS, Apache Superset · apache-superset)
- [CVE-2020-6113](https://cve.now/CVE-2020-6113.md): An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating (CVSS 8.8, Nitro Pro)
- [CVE-2020-6112](https://cve.now/CVE-2020-6112.md): An exploitable code execution vulnerability exists in the JPEG2000 Stripe Decoding functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2 (CVSS 8.8, Nitro Pro)
- [CVE-2020-6115](https://cve.now/CVE-2020-6115.md): An exploitable vulnerability exists in the cross-reference table repairing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. (CVSS 8.8, Nitro Pro)
- [CVE-2020-6116](https://cve.now/CVE-2020-6116.md): An arbitrary code execution vulnerability exists in the rendering functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. (CVSS 8.8, Nitro Pro)
- [CVE-2020-8028](https://cve.now/CVE-2020-8028.md): salt-api is accessible to every user on SUSE Manager Server (CVSS 9.3, SUSE Linux Enterprise Module for SUSE Manager Server · SUSE…)
- [CVE-2020-14181](https://cve.now/CVE-2020-14181.md): Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu (no CVSS, Atlassian Jira Server)
- [CVE-2020-0427](https://cve.now/CVE-2020-0427.md): In create\_pinctrl of core.c, there is a possible out of bounds read due to a use after free. (no CVSS, Android)
- [CVE-2020-25215](https://cve.now/CVE-2020-25215.md): yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document. (no CVSS)
- [CVE-2020-25216](https://cve.now/CVE-2020-25216.md): yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesh (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.