# CVEs published 2020-09-23

72 CVEs were published on September 23, 2020: 1 critical, 17 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-25603](https://cve.now/CVE-2020-25603.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-25596](https://cve.now/CVE-2020-25596.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-25604](https://cve.now/CVE-2020-25604.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-25602](https://cve.now/CVE-2020-25602.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-25601](https://cve.now/CVE-2020-25601.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-25600](https://cve.now/CVE-2020-25600.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-25599](https://cve.now/CVE-2020-25599.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-25598](https://cve.now/CVE-2020-25598.md): An issue was discovered in Xen 4.14.x. (no CVSS)
- [CVE-2020-25597](https://cve.now/CVE-2020-25597.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-25595](https://cve.now/CVE-2020-25595.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-5781](https://cve.now/CVE-2020-5781.md): In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file (/etc/config/luci) by the authe (no CVSS, IgniteNet HeliOS GLinq)
- [CVE-2020-5782](https://cve.now/CVE-2020-5782.md): In IgniteNet HeliOS GLinq v2.2.1 r2961, if a user logs in and sets the ‘wan\_type’ parameter, the wan interface for the device will become un (no CVSS, IgniteNet HeliOS GLinq)
- [CVE-2020-5783](https://cve.now/CVE-2020-5783.md): In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms. (no CVSS, IgniteNet HeliOS GLinq)
- [CVE-2020-11031](https://cve.now/CVE-2020-11031.md): Insecure encryption algorithm in GLPI (CVSS 7.8, glpi-project GLPI)
- [CVE-2020-24213](https://cve.now/CVE-2020-24213.md): An integer overflow was discovered in YGOPro ygocore v13.51. (no CVSS)
- [CVE-2020-25739](https://cve.now/CVE-2020-25739.md): An issue was discovered in the gon gem before gon-6.4.0 for Ruby. (no CVSS, gon)
- [CVE-2020-4340](https://cve.now/CVE-2020-4340.md): IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. (CVSS 3.1, IBM Security Secret Server)
- [CVE-2020-4324](https://cve.now/CVE-2020-4324.md): IBM Security Secret Server proir to 10.9 could allow a remote attacker to bypass security restrictions, caused by improper input validation. (CVSS 3.5, IBM Security Secret Server)
- [CVE-2020-2284](https://cve.now/CVE-2020-2284.md): Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Liquibase Runner Plugin · org.jenki…)
- [CVE-2020-2285](https://cve.now/CVE-2020-2285.md): A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate c (no CVSS, Jenkins project Jenkins Liquibase Runner Plugin · org.jenki…)
- [CVE-2020-2282](https://cve.now/CVE-2020-2282.md): Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read (no CVSS, Jenkins project Jenkins Implied Labels Plugin · org.jenkins…)
- [CVE-2020-2283](https://cve.now/CVE-2020-2283.md): Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulne (no CVSS, Jenkins project Jenkins Liquibase Runner Plugin · org.jenki…)
- [CVE-2020-2280](https://cve.now/CVE-2020-2280.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code. (no CVSS, Jenkins project Jenkins Warnings Plugin · org.jvnet.hudson.…)
- [CVE-2020-2281](https://cve.now/CVE-2020-2281.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserv (no CVSS, Jenkins project Jenkins Lockable Resources Plugin · org.6wi…)
- [CVE-2020-2279](https://cve.now/CVE-2020-2279.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scrip (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2020-16240](https://cve.now/CVE-2020-16240.md): GE Digital APM Classic, Versions 4.4 and prior. (no CVSS, GE Digital APM Classic)
- [CVE-2020-16244](https://cve.now/CVE-2020-16244.md): GE Digital APM Classic, Versions 4.4 and prior. (no CVSS, GE Digital APM Classic)
- [CVE-2020-24626](https://cve.now/CVE-2020-24626.md): Unathenticated directory traversal in the ReceiverServlet class doPost() method can lead to arbitrary remote code execution in HPE Pay Per U (no CVSS, HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter)
- [CVE-2020-24625](https://cve.now/CVE-2020-24625.md): Unathenticated directory traversal in the ReceiverServlet class doGet() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) Uti (no CVSS, HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter)
- [CVE-2020-24624](https://cve.now/CVE-2020-24624.md): Unathenticated directory traversal in the DownloadServlet class execute() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) U (no CVSS, HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter)
- [CVE-2020-7121](https://cve.now/CVE-2020-7121.md): Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F, 6300, 6400, 8320, 8325, and 8400 have been found. (no CVSS, Aruba CX Switch Series 6200F, 6300, 6400, 8320, 8325, and)
- [CVE-2020-7122](https://cve.now/CVE-2020-7122.md): Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F, 6300, 6400, 8320, 8325, and 8400 have been found. (no CVSS, Aruba CX Switch Series 6200F, 6300, 6400, 8320, 8325, and)
- [CVE-2020-10687](https://cve.now/CVE-2020-10687.md): A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is poss (no CVSS, Undertow · io.undertow:undertow-core)
- [CVE-2020-10714](https://cve.now/CVE-2020-10714.md): A flaw was found in WildFly Elytron version 1.11.3.Final and before. (no CVSS, wildfly-elytron · org.wildfly.security:wildfly-elytron)
- [CVE-2020-14365](https://cve.now/CVE-2020-14365.md): A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packag (no CVSS, ansible)
- [CVE-2020-25826](https://cve.now/CVE-2020-25826.md): PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp.BrowserSubprocess.exe. (no CVSS)
- [CVE-2020-25821](https://cve.now/CVE-2020-25821.md): peg-markdown 0.4.14 has a NULL pointer dereference in process\_raw\_blocks in markdown\_lib.c. (no CVSS)
- [CVE-2019-15283](https://cve.now/CVE-2019-15283.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-15285](https://cve.now/CVE-2019-15285.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-15287](https://cve.now/CVE-2019-15287.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-15289](https://cve.now/CVE-2019-15289.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service Vulnerabilities (CVSS 7.5, Cisco TelePresence TC Software)
- [CVE-2019-15957](https://cve.now/CVE-2019-15957.md): Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Command Injection Vulnerability (CVSS 7.2, Cisco Small Business RV Series Router Firmware)
- [CVE-2019-15959](https://cve.now/CVE-2019-15959.md): Cisco Small Business SPA500 Series IP Phones Local Script Execution Vulnerability (CVSS 6.6, Cisco SPA525G2 5-line IP Phone)
- [CVE-2019-15963](https://cve.now/CVE-2019-15963.md): Cisco Unified Communications Manager Information Disclosure Vulnerability (CVSS 4.3, Cisco Unity Connection)
- [CVE-2019-15969](https://cve.now/CVE-2019-15969.md): Cisco Web Security Appliance Management Interface Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Web Security Appliance)
- [CVE-2019-15974](https://cve.now/CVE-2019-15974.md): Cisco Managed Services Accelerator Open Redirect Vulnerability (CVSS 4.7, Cisco Managed Services Accelerator)
- [CVE-2019-15992](https://cve.now/CVE-2019-15992.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution Vulnerability (CVSS 7.2, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-15993](https://cve.now/CVE-2019-15993.md): Cisco Small Business Switches Information Disclosure Vulnerability (CVSS 7.5, Cisco Small Business 250 Series Smart Switches Software)
- [CVE-2019-16000](https://cve.now/CVE-2019-16000.md): Cisco Umbrella Roaming Client for Windows Install Vulnerability (CVSS 4.4, Cisco Umbrella Enterprise Roaming Client for Windows)
- [CVE-2019-16004](https://cve.now/CVE-2019-16004.md): Cisco Vision Dynamic Signage Director Authentication Bypass Vulnerability (CVSS 6.5, Cisco Vision Dynamic Signage Director)
- [CVE-2019-16007](https://cve.now/CVE-2019-16007.md): Cisco AnyConnect Secure Mobility Client for Android Service Hijack Vulnerability (CVSS 5.9, Cisco AnyConnect Secure Mobility Client)
- [CVE-2019-16009](https://cve.now/CVE-2019-16009.md): Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability (CVSS 8.8, Cisco IOS 12.2(15)B)
- [CVE-2019-16017](https://cve.now/CVE-2019-16017.md): Cisco Unified Customer Voice Portal Insecure Direct Object Reference Vulnerability (CVSS 6.8, Cisco Unified Customer Voice Portal)
- [CVE-2019-16019](https://cve.now/CVE-2019-16019.md): Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities (CVSS 8.6, Cisco IOS XR Software)
- [CVE-2019-16021](https://cve.now/CVE-2019-16021.md): Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities (CVSS 8.6, Cisco IOS XR Software)
- [CVE-2019-16023](https://cve.now/CVE-2019-16023.md): Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities (CVSS 8.6, Cisco IOS XR Software)
- [CVE-2019-16025](https://cve.now/CVE-2019-16025.md): Cisco Emergency Responder Stored Cross-Site Scripting Vulnerability (CVSS 5.5, Cisco Emergency Responder)
- [CVE-2019-16028](https://cve.now/CVE-2019-16028.md): Cisco Firepower Management Center Lightweight Directory Access Protocol Authentication Bypass Vulnerability (CVSS 9.8, Cisco Firepower Management Center)
- [CVE-2019-1736](https://cve.now/CVE-2019-1736.md): Multiple Cisco UCS-Based Products UEFI Secure Boot Bypass Vulnerability (CVSS 6.2, Cisco Identity Services Engine Software)
- [CVE-2019-1888](https://cve.now/CVE-2019-1888.md): Cisco Unified Contact Center Express Privilege Escalation Vulnerability (CVSS 7.2, Cisco Unified Contact Center Express)
- [CVE-2019-1947](https://cve.now/CVE-2019-1947.md): Cisco Email Security Appliance Denial of Service Vulnerability (CVSS 8.6, Cisco Email Security Appliance)
- [CVE-2019-1983](https://cve.now/CVE-2019-1983.md): Cisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service Vulnerability (CVSS 7.5, Cisco Email Security Appliance)
- [CVE-2020-3116](https://cve.now/CVE-2020-3116.md): Cisco Webex Centers Denial of Service Vulnerability (CVSS 5.5, Cisco WebEx Event Center)
- [CVE-2020-3117](https://cve.now/CVE-2020-3117.md): Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerability (CVSS 4.7, Cisco Web Security Appliance)
- [CVE-2020-3124](https://cve.now/CVE-2020-3124.md): Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability (CVSS 6.5, Cisco Hosted Collaboration Mediation Fulfillment)
- [CVE-2020-3130](https://cve.now/CVE-2020-3130.md): Cisco Unity Connection Directory Traversal Vulnerability (CVSS 5.9, Cisco Unity Connection)
- [CVE-2020-3133](https://cve.now/CVE-2020-3133.md): Cisco Email Security Appliance Content Filter Bypass Vulnerability (CVSS 5.8, Cisco Email Security Appliance)
- [CVE-2020-3135](https://cve.now/CVE-2020-3135.md): Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability (CVSS 6.5, Cisco Unified Communications Manager)
- [CVE-2020-3137](https://cve.now/CVE-2020-3137.md): Cisco Email Security Appliance Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Email Security Appliance)
- [CVE-2020-3143](https://cve.now/CVE-2020-3143.md): Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Path Traversal Vulnerability (CVSS 8.8, Cisco TelePresence TC Software)
- [CVE-2020-3569](https://cve.now/CVE-2020-3569.md): Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities (CVSS 8.6, KEV, Cisco IOS XR Software)
- [CVE-2020-14370](https://cve.now/CVE-2020-14370.md): An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. (no CVSS, podman · github.com/containers/podman/v2 +2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.