CVEs published September 21, 2020
58 CVEs were published on September 21, 2020: 0 critical, 4 high.
- Published
- 58
- Critical
- 0
- High
- 4
- Medium
- 3
- Low
- 0
- Unrated
- 51
- Now in CISA KEV
- 0
- Fix available
- 50
Most affected products
- Google Chrome
- 47
- IBM DataPower Gateway
- 3
- Atlassian Jira Server
- 2
- Atlassian Jira Service Desk Server
- 1
- IBM Aspera Shares
- 1
- IBM Business Automation Content Analyzer on Cloud
- 1
- IBM WebSphere Application Server
- 1
- IBM WebSphere Application Server Liberty
- 1
High 4
- CVE-2020-4643IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML dIBM WebSphere Application Server
- CVE-2020-4581IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a chunked transfeIBM DataPower Gateway
- CVE-2020-4580IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially craftIBM DataPower Gateway
- CVE-2020-4579IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially craftIBM DataPower Gateway
Medium, low and unrated 54
- CVE-2020-6576Use after free in offscreen canvas in Google Chrome prior to 85.0.4183.102 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2020-6574Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieveGoogle Chrome
- CVE-2020-6575Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perfoGoogle Chrome
- CVE-2020-6570Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information vGoogle Chrome
- CVE-2020-6571Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN Google Chrome
- CVE-2020-6573Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2020-6568Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to bypass navGoogle Chrome
- CVE-2020-6569Integer overflow in WebUSB in Google Chrome prior to 85.0.4183.83 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2020-6566Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crGoogle Chrome
- CVE-2020-6567Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacGoogle Chrome
- CVE-2020-6564Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permGoogle Chrome
- CVE-2020-6565Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of theGoogle Chrome
- CVE-2020-6562Insufficient policy enforcement in Blink in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crGoogle Chrome
- CVE-2020-6563Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to obtain potGoogle Chrome
- CVE-2020-6559Use after free in presentation API in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2020-6560Insufficient policy enforcement in autofill in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via aGoogle Chrome
- CVE-2020-6561Inappropriate implementation in Content Security Policy in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origiGoogle Chrome
- CVE-2020-6556Heap buffer overflow in SwiftShader in Google Chrome prior to 84.0.4147.135 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2020-6558Insufficient policy enforcement in iOSWeb in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrGoogle Chrome
- CVE-2020-6554Use after free in extensions in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially perform a sandbox escape via aGoogle Chrome
- CVE-2020-6555Out of bounds read in WebGL in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to obtain potentially sensitive information frGoogle Chrome
- CVE-2020-6552Use after free in Blink in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6553Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruptiGoogle Chrome
- CVE-2020-6550Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2020-6551Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6548Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.125 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2020-6549Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6546Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege Google Chrome
- CVE-2020-6547Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive informationGoogle Chrome
- CVE-2020-6544Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6545Use after free in audio in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6542Use after free in ANGLE in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6543Use after free in task scheduling in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2020-6539Use after free in CSS in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2020-6540Buffer overflow in Skia in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6541Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2020-6537Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2020-6538Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin daGoogle Chrome
- CVE-2020-15966Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a Google Chrome
- CVE-2020-6532Use after free in SCTP in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2020-15964Insufficient data validation in media in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially exploit heap corruptiGoogle Chrome
- CVE-2020-15965Type confusion in V8 in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access viGoogle Chrome
- CVE-2020-15962Insufficient policy validation in serial in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bouGoogle Chrome
- CVE-2020-15963Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a Google Chrome
- CVE-2020-15960Heap buffer overflow in storage in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memorGoogle Chrome
- CVE-2020-15961Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a mGoogle Chrome
- CVE-2020-15959Insufficient policy enforcement in networking in Google Chrome prior to 85.0.4183.102 allowed an attacker who convinced the user to enable lGoogle Chrome
- CVE-2020-4731IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting.IBM Aspera Shares
- CVE-2020-4590IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerablIBM WebSphere Application Server Liberty
- CVE-2020-4315IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies.IBM Business Automation Content Analyzer on Cloud
- CVE-2020-16171An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342.
- CVE-2020-14177Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-basedAtlassian Jira Server
- CVE-2020-14180Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to Atlassian Jira Service Desk Server
- CVE-2020-14179Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLAAtlassian Jira Server