CVEs published September 22, 2020
34 CVEs were published on September 22, 2020: 0 critical, 5 high.
- Published
- 34
- Critical
- 0
- High
- 5
- Medium
- 7
- Low
- 1
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- IBM Data Risk Manager
- 12
- Operation Bridge Reporter.
- 3
- cabot
- 1
- com.liferay.portal:release.dxp.bom
- 1
- VMware Horizon DaaS
- 1
- WebAccess Node
- 1
High 5
- CVE-2020-4621IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient authoIBM Data Risk Manager
- CVE-2020-4620IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation IBM Data Risk Manager
- CVE-2020-4617IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthIBM Data Risk Manager
- CVE-2020-4611IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to bypass security and execute actions reserved for admins.IBM Data Risk Manager
- CVE-2020-7734Cross-site Scripting (XSS)cabot
Medium, low and unrated 29
- CVE-2020-25515Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book , http://<site>/lms/index.php?p
- CVE-2020-25514Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php
- CVE-2020-14022Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) f
- CVE-2020-14025Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulnerabilities.
- CVE-2020-14024Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient
- CVE-2020-14023Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS.
- CVE-2020-14026CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17
- CVE-2020-15839Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/forcom.liferay.portal:release.dxp.bom
- CVE-2020-14027An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.
- CVE-2020-14028An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.
- CVE-2020-14031An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.
- CVE-2020-25487PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php.
- CVE-2020-24333A vulnerability in Arista’s CloudVision Portal (CVP) prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet
- CVE-2020-16202WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code exeWebAccess Node
- CVE-2020-11856Arbitrary code execution vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.Operation Bridge Reporter.
- CVE-2020-11857An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.Operation Bridge Reporter.
- CVE-2020-4622IBM Data Risk Manager (iDNA) 2.0.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbouIBM Data Risk Manager
- CVE-2020-4619IBM Data Risk Manager (iDNA) 2.0.6 stores user credentials in plain in clear text which can be read by an authenticated user.IBM Data Risk Manager
- CVE-2020-4618IBM Data Risk Manager (iDNA) 2.0.6 could allow a privileged user to cause a denial of service due to improper input validation.IBM Data Risk Manager
- CVE-2020-4616IBM Data Risk Manager (iDNA) 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request.IBM Data Risk Manager
- CVE-2020-4615IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site scripting.IBM Data Risk Manager
- CVE-2020-4614IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive infoIBM Data Risk Manager
- CVE-2020-4613IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiIBM Data Risk Manager
- CVE-2020-4612IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to obtain sensitive information using a specially crafted HTTP request.IBM Data Risk Manager
- CVE-2020-11855An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier.Operation Bridge Reporter.
- CVE-2020-3977VMware Horizon DaaS (7.x and 8.x before 8.0.1 Update 1) contains a broken authentication vulnerability due to a flaw in the way it handled tVMware Horizon DaaS
- CVE-2020-23446Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API
- CVE-2020-8887Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauthenticated attacker t
- CVE-2020-24619In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone).