# CVEs published 2020-09-21

58 CVEs were published on September 21, 2020: 0 critical, 4 high. Days are UTC.

- [CVE-2020-6576](https://cve.now/CVE-2020-6576.md): Use after free in offscreen canvas in Google Chrome prior to 85.0.4183.102 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2020-6574](https://cve.now/CVE-2020-6574.md): Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve (no CVSS, Google Chrome)
- [CVE-2020-6575](https://cve.now/CVE-2020-6575.md): Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perfo (no CVSS, Google Chrome)
- [CVE-2020-6570](https://cve.now/CVE-2020-6570.md): Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information v (no CVSS, Google Chrome)
- [CVE-2020-6571](https://cve.now/CVE-2020-6571.md): Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN (no CVSS, Google Chrome)
- [CVE-2020-6573](https://cve.now/CVE-2020-6573.md): Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer proces (no CVSS, Google Chrome)
- [CVE-2020-6568](https://cve.now/CVE-2020-6568.md): Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to bypass nav (no CVSS, Google Chrome)
- [CVE-2020-6569](https://cve.now/CVE-2020-6569.md): Integer overflow in WebUSB in Google Chrome prior to 85.0.4183.83 allowed a remote attacker who had compromised the renderer process to pote (no CVSS, Google Chrome)
- [CVE-2020-6566](https://cve.now/CVE-2020-6566.md): Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a cr (no CVSS, Google Chrome)
- [CVE-2020-6567](https://cve.now/CVE-2020-6567.md): Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attac (no CVSS, Google Chrome)
- [CVE-2020-6564](https://cve.now/CVE-2020-6564.md): Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a perm (no CVSS, Google Chrome)
- [CVE-2020-6565](https://cve.now/CVE-2020-6565.md): Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the (no CVSS, Google Chrome)
- [CVE-2020-6562](https://cve.now/CVE-2020-6562.md): Insufficient policy enforcement in Blink in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a cr (no CVSS, Google Chrome)
- [CVE-2020-6563](https://cve.now/CVE-2020-6563.md): Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to obtain pot (no CVSS, Google Chrome)
- [CVE-2020-6559](https://cve.now/CVE-2020-6559.md): Use after free in presentation API in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2020-6560](https://cve.now/CVE-2020-6560.md): Insufficient policy enforcement in autofill in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a (no CVSS, Google Chrome)
- [CVE-2020-6561](https://cve.now/CVE-2020-6561.md): Inappropriate implementation in Content Security Policy in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origi (no CVSS, Google Chrome)
- [CVE-2020-6556](https://cve.now/CVE-2020-6556.md): Heap buffer overflow in SwiftShader in Google Chrome prior to 84.0.4147.135 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2020-6558](https://cve.now/CVE-2020-6558.md): Insufficient policy enforcement in iOSWeb in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restr (no CVSS, Google Chrome)
- [CVE-2020-6554](https://cve.now/CVE-2020-6554.md): Use after free in extensions in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially perform a sandbox escape via a (no CVSS, Google Chrome)
- [CVE-2020-6555](https://cve.now/CVE-2020-6555.md): Out of bounds read in WebGL in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to obtain potentially sensitive information fr (no CVSS, Google Chrome)
- [CVE-2020-6552](https://cve.now/CVE-2020-6552.md): Use after free in Blink in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6553](https://cve.now/CVE-2020-6553.md): Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corrupti (no CVSS, Google Chrome)
- [CVE-2020-6550](https://cve.now/CVE-2020-6550.md): Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2020-6551](https://cve.now/CVE-2020-6551.md): Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6548](https://cve.now/CVE-2020-6548.md): Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.125 allowed a remote attacker who had compromised the renderer process to p (no CVSS, Google Chrome)
- [CVE-2020-6549](https://cve.now/CVE-2020-6549.md): Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6546](https://cve.now/CVE-2020-6546.md): Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege (no CVSS, Google Chrome)
- [CVE-2020-6547](https://cve.now/CVE-2020-6547.md): Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive information (no CVSS, Google Chrome)
- [CVE-2020-6544](https://cve.now/CVE-2020-6544.md): Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6545](https://cve.now/CVE-2020-6545.md): Use after free in audio in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6542](https://cve.now/CVE-2020-6542.md): Use after free in ANGLE in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6543](https://cve.now/CVE-2020-6543.md): Use after free in task scheduling in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2020-6539](https://cve.now/CVE-2020-6539.md): Use after free in CSS in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2020-6540](https://cve.now/CVE-2020-6540.md): Buffer overflow in Skia in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6541](https://cve.now/CVE-2020-6541.md): Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2020-6537](https://cve.now/CVE-2020-6537.md): Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (no CVSS, Google Chrome)
- [CVE-2020-6538](https://cve.now/CVE-2020-6538.md): Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin da (no CVSS, Google Chrome)
- [CVE-2020-15966](https://cve.now/CVE-2020-15966.md): Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a (no CVSS, Google Chrome)
- [CVE-2020-6532](https://cve.now/CVE-2020-6532.md): Use after free in SCTP in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2020-15964](https://cve.now/CVE-2020-15964.md): Insufficient data validation in media in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially exploit heap corrupti (no CVSS, Google Chrome)
- [CVE-2020-15965](https://cve.now/CVE-2020-15965.md): Type confusion in V8 in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access vi (no CVSS, Google Chrome)
- [CVE-2020-15962](https://cve.now/CVE-2020-15962.md): Insufficient policy validation in serial in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bou (no CVSS, Google Chrome)
- [CVE-2020-15963](https://cve.now/CVE-2020-15963.md): Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a (no CVSS, Google Chrome)
- [CVE-2020-15960](https://cve.now/CVE-2020-15960.md): Heap buffer overflow in storage in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memor (no CVSS, Google Chrome)
- [CVE-2020-15961](https://cve.now/CVE-2020-15961.md): Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a m (no CVSS, Google Chrome)
- [CVE-2020-15959](https://cve.now/CVE-2020-15959.md): Insufficient policy enforcement in networking in Google Chrome prior to 85.0.4183.102 allowed an attacker who convinced the user to enable l (no CVSS, Google Chrome)
- [CVE-2020-4643](https://cve.now/CVE-2020-4643.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML d (CVSS 7.5, IBM WebSphere Application Server)
- [CVE-2020-4731](https://cve.now/CVE-2020-4731.md): IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Aspera Shares)
- [CVE-2020-4590](https://cve.now/CVE-2020-4590.md): IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerabl (CVSS 5.3, IBM WebSphere Application Server Liberty)
- [CVE-2020-4581](https://cve.now/CVE-2020-4581.md): IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a chunked transfe (CVSS 7.5, IBM DataPower Gateway)
- [CVE-2020-4580](https://cve.now/CVE-2020-4580.md): IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially craft (CVSS 7.5, IBM DataPower Gateway)
- [CVE-2020-4579](https://cve.now/CVE-2020-4579.md): IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially craft (CVSS 7.5, IBM DataPower Gateway)
- [CVE-2020-4315](https://cve.now/CVE-2020-4315.md): IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. (CVSS 4.3, IBM Business Automation Content Analyzer on Cloud)
- [CVE-2020-16171](https://cve.now/CVE-2020-16171.md): An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. (no CVSS)
- [CVE-2020-14177](https://cve.now/CVE-2020-14177.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based (no CVSS, Atlassian Jira Server)
- [CVE-2020-14180](https://cve.now/CVE-2020-14180.md): Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to (no CVSS, Atlassian Jira Service Desk Server)
- [CVE-2020-14179](https://cve.now/CVE-2020-14179.md): Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA (no CVSS, Atlassian Jira Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.