# CVEs published 2020-09-22 34 CVEs were published on September 22, 2020: 0 critical, 5 high. Days are UTC. - [CVE-2020-25515](https://cve.now/CVE-2020-25515.md): Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books \> New Book , http://\/lms/index.php?p (no CVSS) - [CVE-2020-25514](https://cve.now/CVE-2020-25514.md): Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://\/lms/admin.php (no CVSS) - [CVE-2020-14022](https://cve.now/CVE-2020-14022.md): Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) f (no CVSS) - [CVE-2020-14025](https://cve.now/CVE-2020-14025.md): Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulnerabilities. (no CVSS) - [CVE-2020-14024](https://cve.now/CVE-2020-14024.md): Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient (no CVSS) - [CVE-2020-14023](https://cve.now/CVE-2020-14023.md): Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS. (no CVSS) - [CVE-2020-14026](https://cve.now/CVE-2020-14026.md): CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17 (no CVSS) - [CVE-2020-15839](https://cve.now/CVE-2020-15839.md): Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/for (no CVSS, com.liferay.portal:release.dxp.bom) - [CVE-2020-14027](https://cve.now/CVE-2020-14027.md): An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. (no CVSS) - [CVE-2020-14028](https://cve.now/CVE-2020-14028.md): An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. (no CVSS) - [CVE-2020-14031](https://cve.now/CVE-2020-14031.md): An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. (no CVSS) - [CVE-2020-25487](https://cve.now/CVE-2020-25487.md): PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php. (no CVSS) - [CVE-2020-24333](https://cve.now/CVE-2020-24333.md): A vulnerability in Arista’s CloudVision Portal (CVP) prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet (no CVSS) - [CVE-2020-16202](https://cve.now/CVE-2020-16202.md): WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code exe (no CVSS, WebAccess Node) - [CVE-2020-11856](https://cve.now/CVE-2020-11856.md): Arbitrary code execution vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. (no CVSS, Operation Bridge Reporter.) - [CVE-2020-11857](https://cve.now/CVE-2020-11857.md): An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. (no CVSS, Operation Bridge Reporter.) - [CVE-2020-4622](https://cve.now/CVE-2020-4622.md): IBM Data Risk Manager (iDNA) 2.0.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbou (CVSS 5.9, IBM Data Risk Manager) - [CVE-2020-4621](https://cve.now/CVE-2020-4621.md): IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient autho (CVSS 8.8, IBM Data Risk Manager) - [CVE-2020-4620](https://cve.now/CVE-2020-4620.md): IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation (CVSS 8.8, IBM Data Risk Manager) - [CVE-2020-4619](https://cve.now/CVE-2020-4619.md): IBM Data Risk Manager (iDNA) 2.0.6 stores user credentials in plain in clear text which can be read by an authenticated user. (CVSS 5.3, IBM Data Risk Manager) - [CVE-2020-4618](https://cve.now/CVE-2020-4618.md): IBM Data Risk Manager (iDNA) 2.0.6 could allow a privileged user to cause a denial of service due to improper input validation. (CVSS 5.5, IBM Data Risk Manager) - [CVE-2020-4617](https://cve.now/CVE-2020-4617.md): IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauth (CVSS 7.1, IBM Data Risk Manager) - [CVE-2020-4616](https://cve.now/CVE-2020-4616.md): IBM Data Risk Manager (iDNA) 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request. (CVSS 5.3, IBM Data Risk Manager) - [CVE-2020-4615](https://cve.now/CVE-2020-4615.md): IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Data Risk Manager) - [CVE-2020-4614](https://cve.now/CVE-2020-4614.md): IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive info (CVSS 3.7, IBM Data Risk Manager) - [CVE-2020-4613](https://cve.now/CVE-2020-4613.md): IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti (CVSS 5.9, IBM Data Risk Manager) - [CVE-2020-4612](https://cve.now/CVE-2020-4612.md): IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to obtain sensitive information using a specially crafted HTTP request. (CVSS 4.3, IBM Data Risk Manager) - [CVE-2020-4611](https://cve.now/CVE-2020-4611.md): IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to bypass security and execute actions reserved for admins. (CVSS 8.8, IBM Data Risk Manager) - [CVE-2020-11855](https://cve.now/CVE-2020-11855.md): An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. (no CVSS, Operation Bridge Reporter.) - [CVE-2020-3977](https://cve.now/CVE-2020-3977.md): VMware Horizon DaaS (7.x and 8.x before 8.0.1 Update 1) contains a broken authentication vulnerability due to a flaw in the way it handled t (no CVSS, VMware Horizon DaaS) - [CVE-2020-23446](https://cve.now/CVE-2020-23446.md): Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API (no CVSS) - [CVE-2020-8887](https://cve.now/CVE-2020-8887.md): Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauthenticated attacker t (no CVSS) - [CVE-2020-24619](https://cve.now/CVE-2020-24619.md): In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone). (no CVSS) - [CVE-2020-7734](https://cve.now/CVE-2020-7734.md): Cross-site Scripting (XSS) (CVSS 8.2, cabot) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-09-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.