CVEs published September 23, 2020
72 CVEs were published on September 23, 2020: 1 critical, 17 high. 1 is now in CISA KEV.
- Published
- 72
- Critical
- 1
- High
- 17
- Medium
- 17
- Low
- 2
- Unrated
- 35
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- Cisco Email Security Appliance
- 4
- Cisco IOS XR Software
- 4
- Cisco WebEx WRF Player
- 3
- HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter
- 3
- IgniteNet HeliOS GLinq
- 3
- Jenkins project Jenkins Liquibase Runner Plugin · org.jenki…
- 3
- Aruba CX Switch Series 6200F, 6300, 6400, 8320, 8325, and
- 2
- Cisco TelePresence TC Software
- 2
- Cisco Unity Connection
- 2
- Cisco Web Security Appliance
- 2
Critical 1
High 17
- CVE-2020-11031Insecure encryption algorithm in GLPIglpi-project GLPI
- CVE-2019-15283Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-15285Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-15287Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-15289Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service VulnerabilitiesCisco TelePresence TC Software
- CVE-2019-15957Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Command Injection VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2019-15992Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2019-15993Cisco Small Business Switches Information Disclosure VulnerabilityCisco Small Business 250 Series Smart Switches Software
- CVE-2019-16009Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery VulnerabilityCisco IOS 12.2(15)B
- CVE-2019-16019Cisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesCisco IOS XR Software
- CVE-2019-16021Cisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesCisco IOS XR Software
- CVE-2019-16023Cisco IOS XR Software BGP EVPN Denial of Service VulnerabilitiesCisco IOS XR Software
- CVE-2019-1888Cisco Unified Contact Center Express Privilege Escalation VulnerabilityCisco Unified Contact Center Express
- CVE-2019-1947Cisco Email Security Appliance Denial of Service VulnerabilityCisco Email Security Appliance
- CVE-2019-1983Cisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service VulnerabilityCisco Email Security Appliance
- CVE-2020-3143Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Path Traversal VulnerabilityCisco TelePresence TC Software
- CVE-2020-3569Cisco IOS XR Software DVMRP Memory Exhaustion VulnerabilitiesCisco IOS XR Software
Medium, low and unrated 54
- CVE-2020-25603An issue was discovered in Xen through 4.14.x.
- CVE-2020-25596An issue was discovered in Xen through 4.14.x.
- CVE-2020-25604An issue was discovered in Xen through 4.14.x.
- CVE-2020-25602An issue was discovered in Xen through 4.14.x.
- CVE-2020-25601An issue was discovered in Xen through 4.14.x.
- CVE-2020-25600An issue was discovered in Xen through 4.14.x.
- CVE-2020-25599An issue was discovered in Xen through 4.14.x.
- CVE-2020-25598An issue was discovered in Xen 4.14.x.
- CVE-2020-25597An issue was discovered in Xen through 4.14.x.
- CVE-2020-25595An issue was discovered in Xen through 4.14.x.
- CVE-2020-5781In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file (/etc/config/luci) by the autheIgniteNet HeliOS GLinq
- CVE-2020-5782In IgniteNet HeliOS GLinq v2.2.1 r2961, if a user logs in and sets the ‘wan_type’ parameter, the wan interface for the device will become unIgniteNet HeliOS GLinq
- CVE-2020-5783In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms.IgniteNet HeliOS GLinq
- CVE-2020-24213An integer overflow was discovered in YGOPro ygocore v13.51.
- CVE-2020-25739An issue was discovered in the gon gem before gon-6.4.0 for Ruby.gon
- CVE-2020-4340IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation.IBM Security Secret Server
- CVE-2020-4324IBM Security Secret Server proir to 10.9 could allow a remote attacker to bypass security restrictions, caused by improper input validation.IBM Security Secret Server
- CVE-2020-2284Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Liquibase Runner Plugin · org.jenki…
- CVE-2020-2285A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate cJenkins project Jenkins Liquibase Runner Plugin · org.jenki…
- CVE-2020-2282Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read Jenkins project Jenkins Implied Labels Plugin · org.jenkins…
- CVE-2020-2283Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulneJenkins project Jenkins Liquibase Runner Plugin · org.jenki…
- CVE-2020-2280A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code.Jenkins project Jenkins Warnings Plugin · org.jvnet.hudson.…
- CVE-2020-2281A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreservJenkins project Jenkins Lockable Resources Plugin · org.6wi…
- CVE-2020-2279A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2020-16240GE Digital APM Classic, Versions 4.4 and prior.GE Digital APM Classic
- CVE-2020-16244GE Digital APM Classic, Versions 4.4 and prior.GE Digital APM Classic
- CVE-2020-24626Unathenticated directory traversal in the ReceiverServlet class doPost() method can lead to arbitrary remote code execution in HPE Pay Per UHPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter
- CVE-2020-24625Unathenticated directory traversal in the ReceiverServlet class doGet() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) UtiHPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter
- CVE-2020-24624Unathenticated directory traversal in the DownloadServlet class execute() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) UHPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter
- CVE-2020-7121Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F, 6300, 6400, 8320, 8325, and 8400 have been found.Aruba CX Switch Series 6200F, 6300, 6400, 8320, 8325, and
- CVE-2020-7122Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F, 6300, 6400, 8320, 8325, and 8400 have been found.Aruba CX Switch Series 6200F, 6300, 6400, 8320, 8325, and
- CVE-2020-10687A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possUndertow · io.undertow:undertow-core
- CVE-2020-10714A flaw was found in WildFly Elytron version 1.11.3.Final and before.wildfly-elytron · org.wildfly.security:wildfly-elytron
- CVE-2020-14365A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packagansible
- CVE-2020-25826PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp.BrowserSubprocess.exe.
- CVE-2020-25821peg-markdown 0.4.14 has a NULL pointer dereference in process_raw_blocks in markdown_lib.c.
- CVE-2019-15959Cisco Small Business SPA500 Series IP Phones Local Script Execution VulnerabilityCisco SPA525G2 5-line IP Phone
- CVE-2019-15963Cisco Unified Communications Manager Information Disclosure VulnerabilityCisco Unity Connection
- CVE-2019-15969Cisco Web Security Appliance Management Interface Cross-Site Scripting VulnerabilityCisco Web Security Appliance
- CVE-2019-15974Cisco Managed Services Accelerator Open Redirect VulnerabilityCisco Managed Services Accelerator
- CVE-2019-16000Cisco Umbrella Roaming Client for Windows Install VulnerabilityCisco Umbrella Enterprise Roaming Client for Windows
- CVE-2019-16004Cisco Vision Dynamic Signage Director Authentication Bypass VulnerabilityCisco Vision Dynamic Signage Director
- CVE-2019-16007Cisco AnyConnect Secure Mobility Client for Android Service Hijack VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2019-16017Cisco Unified Customer Voice Portal Insecure Direct Object Reference VulnerabilityCisco Unified Customer Voice Portal
- CVE-2019-16025Cisco Emergency Responder Stored Cross-Site Scripting VulnerabilityCisco Emergency Responder
- CVE-2019-1736Multiple Cisco UCS-Based Products UEFI Secure Boot Bypass VulnerabilityCisco Identity Services Engine Software
- CVE-2020-3116Cisco Webex Centers Denial of Service VulnerabilityCisco WebEx Event Center
- CVE-2020-3117Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection VulnerabilityCisco Web Security Appliance
- CVE-2020-3124Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery VulnerabilityCisco Hosted Collaboration Mediation Fulfillment
- CVE-2020-3130Cisco Unity Connection Directory Traversal VulnerabilityCisco Unity Connection
- CVE-2020-3133Cisco Email Security Appliance Content Filter Bypass VulnerabilityCisco Email Security Appliance
- CVE-2020-3135Cisco Unified Communications Manager Cross-Site Request Forgery VulnerabilityCisco Unified Communications Manager
- CVE-2020-3137Cisco Email Security Appliance Cross-Site Scripting VulnerabilityCisco Email Security Appliance
- CVE-2020-14370An information disclosure vulnerability was found in containers/podman in versions before 2.0.5.podman · github.com/containers/podman/v2 +2