CVEs published September 18, 2020
104 CVEs were published on September 18, 2020: 2 critical, 0 high.
- Published
- 104
- Critical
- 2
- High
- 0
- Medium
- 9
- Low
- 2
- Unrated
- 91
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- Android
- 46
- Philips Clinical Collaboration Platform
- 5
- Adobe Media Encoder
- 3
- NodeJS Node
- 3
- BUFFALO WHR-G54S
- 2
- Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
- 2
- inunosinsi soycms
- 2
- NVIDIA GeForce NOW Application
- 2
- UNIQLO CO. UNIQLO App for Android
- 2
- Citrix ADC, Citrix Gateway
- 1
Critical 2
Medium, low and unrated 102
- CVE-2020-8200Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active DirecCitrix StoreFront
- CVE-2020-8237Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.json-bigint
- CVE-2020-8201Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users.NodeJS Node
- CVE-2020-8247Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 1Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
- CVE-2020-8246Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 1Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP
- CVE-2020-8158Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further typeorm
- CVE-2020-8245Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC, Citrix Gateway
- CVE-2020-8253Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10Citrix XenMobile Server
- CVE-2020-8252The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which NodeJS Node
- CVE-2020-8251Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unablNodeJS Node
- CVE-2020-8225A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authenticaDesktop Client
- CVE-2020-11861Unauthorized escalation of local privileges vulnerability on Micro Focus Operation Agent, affecting all versions prior to versions 12.11.Operations Agent
- CVE-2020-25633A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final.Red Hat resteasy-client · org.jboss.resteasy:resteasy-cl… +1
- CVE-2020-9084Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a use-after-free (UAF) vulnerability.Taurus-AN00B
- CVE-2020-16230All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources.HMS Networks Ewon Flexy and Cosy
- CVE-2020-7945Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who shouContinuous Delivery for Puppet Enterprise
- CVE-2020-16247Philips Clinical Collaboration Platform ConfigurationPhilips Clinical Collaboration Platform
- CVE-2020-16200Philips Clinical Collaboration Platform Algorithm DowngradePhilips Clinical Collaboration Platform
- CVE-2020-16198Philips Clinical Collaboration Platform Protection Mechanism FailurePhilips Clinical Collaboration Platform
- CVE-2020-14525Philips Clinical Collaboration Platform Improper Neutralization of Script in Attributes in a Web PagePhilips Clinical Collaboration Platform
- CVE-2020-14506Philips Clinical Collaboration Platform Cross-site Request ForgeryPhilips Clinical Collaboration Platform
- CVE-2020-14390A flaw was found in the Linux kernel in versions before 5.9-rc6.kernel
- CVE-2020-3979InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at initialization time, writaVMware InstallBuilder
- CVE-2020-25766An issue was discovered in MISP before 2.4.132.
- CVE-2020-15189Remote Code Execution in SOY CMSinunosinsi soycms
- CVE-2020-14021An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.
- CVE-2020-14029An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.
- CVE-2020-24623A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework.HPE Universal API Framework for VMware ESXi (OVA) in HPE Un…
- CVE-2020-0365In netd, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0349In NFC, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0348In NFC, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0331In Settings, there is a possible permissions bypass.Android
- CVE-2020-0327In core networking, there is a missing permission check.Android
- CVE-2020-0325In NFC, there is a missing bounds check.Android
- CVE-2020-0316In Telephony, there is a missing permission check.Android
- CVE-2020-0315In Zen Mode, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0313In NotificationManagerService, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0311In InputManagerService, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0310In Settings, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0307In Settings, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0304In Settings, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0302In Settings, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0300In NFC, there is a possible out of bounds read due to uninitialized data.Android
- CVE-2020-0295In Telecom, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0294In bindWallpaperComponentLocked of WallpaperManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0292In Bluetooth, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0291In Bluetooth, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0286In Bluetooth AVRCP, there is a possible leak of audio metadata due to residual data.Android
- CVE-2020-0285In Telephony, there is a possible permission bypass due to a missing permission check.Android
- CVE-2020-5976NVIDIA GeForce NOW, versions prior to 2.0.23 (Windows, macOS) and versions prior to 5.31 (Android, Shield TV), contains a vulnerability in tNVIDIA GeForce NOW Application
- CVE-2020-0284In Telephony, there is a possible permission bypass due to a missing permission check.Android
- CVE-2020-0282In NFC, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0281In NFC, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0276In Telephony, there is a possible permission bypass due to a missing permission check.Android
- CVE-2020-0272In libhwbinder, there is a possible information disclosure due to uninitialized data.Android
- CVE-2020-0269In Android Auto Settings, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0265In Telephony, there are possible leaks of sensitive data due to missing permission checks.Android
- CVE-2020-0263In the Accessibility service, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0405In NetworkStackNotifier, there is a possible permissions bypass due to an unsafe implicit PendingIntent.Android
- CVE-2020-0350In NFC, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0347In iptables, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2020-0335In NFC, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0334In NFC, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0326In NFC, there is a possible out of bounds write due to uninitialized data.Android
- CVE-2020-0319In NFC, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0309In the Bluetooth server, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2020-0299In Bluetooth, there is a possible spoofing of bluetooth device metadata due to a missing permission check.Android
- CVE-2020-0298In Bluetooth, there is a possible control over Bluetooth enabled state due to a missing permission check.Android
- CVE-2020-0273In hwservicemanager, there is a possible out of bounds write due to freeing a wild pointer.Android
- CVE-2020-0271In the Settings app, there is an insecure default value.Android
- CVE-2020-0268In NFC, there is a possible use-after-free due to a race condition.Android
- CVE-2020-0262In WiFi tethering, there is a possible attacker controlled intent due to an unsafe PendingIntent.Android
- CVE-2020-7358Code Injection in Rapid7 AppSpider Pro InstallerRapid7 AppSpider
- CVE-2020-0089In the audio server, there is a missing permission check.Android
- CVE-2020-0354In Bluetooth, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0318In the System UI, there is a possible system crash due to an uncaught exception.Android
- CVE-2020-5975NVIDIA GeForce NOW, versions prior to 2.0.23 on Windows and macOS, contains a vulnerability in the desktop application software that includeNVIDIA GeForce NOW Application
- CVE-2020-15958An issue was discovered in 1CRM System through 8.6.7.
- CVE-2020-9745Adobe Media Encoder PSD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Media Encoder
- CVE-2020-9744Adobe Media Encoder WMV File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Media Encoder
- CVE-2020-9739Adobe Media Encoder FLV File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Media Encoder
- CVE-2020-15773An issue was discovered in Gradle Enterprise before 2020.2.4.
- CVE-2020-15767An issue was discovered in Gradle Enterprise before 2020.2.5.
- CVE-2020-15770An issue was discovered in Gradle Enterprise 2018.5.
- CVE-2020-15771An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1.
- CVE-2020-15772An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4.
- CVE-2020-15774An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4.
- CVE-2020-15775An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4.
- CVE-2020-15776An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4.
- CVE-2020-15768An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache Node 1.0 - 9.2.
- CVE-2020-15769An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4.
- CVE-2020-5628UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable AUNIQLO CO. UNIQLO App for Android
- CVE-2020-5629UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App UNIQLO CO. UNIQLO App for Android
- CVE-2020-5605Directory traversal vulnerability in WHR-G54S firmware 1.43 and earlier allows an attacker to access sensitive information such as setting vBUFFALO WHR-G54S
- CVE-2020-5606Cross-site scripting vulnerability in WHR-G54S firmware 1.43 and earlier allows remote attackers to inject arbitrary script via a specially BUFFALO WHR-G54S
- CVE-2020-25756A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking.
- CVE-2020-25751The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=com_pago&view=comments filter_publi
- CVE-2020-25750An issue was discovered in DotPlant2 before 2020-09-14.devgroup/dotplant
- CVE-2020-25744SaferVPN before 5.0.3.3 on Windows could allow low-privileged users to create or overwrite arbitrary files, which could cause a denial of se
- CVE-2020-25735webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/add_announcement.php, administration
- CVE-2020-25734webTareas through 2.1 allows files/Default/ Directory Listing.
- CVE-2020-25733webTareas through 2.1 allows upload of the dangerous .exe and .shtml file types.