CVEs published September 24, 2020
99 CVEs were published on September 24, 2020: 3 critical, 36 high.
- Published
- 99
- Critical
- 3
- High
- 36
- Medium
- 24
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Cisco IOS XE Software
- 40
- Aveva
- 5
- Cisco IOS
- 5
- Cisco Aironet Access Point Software
- 3
- PrestaShop
- 3
- Lenovo Enterprise Network Disk
- 2
- ory fosite · github.com/ory/fosite
- 2
- Trend Micro Security
- 2
- Cisco IOS 15.2(5)E1
- 1
- Cisco IOS 15.2(6)E4
- 1
Critical 3
- CVE-2020-13501An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.Aveva
- CVE-2020-13500SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.Aveva
- CVE-2020-13499An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.Aveva
High 36
- CVE-2020-3141Cisco IOS XE Software Privilege Escalation VulnerabilitiesCisco IOS XE Software
- CVE-2020-3359Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers Multicast DNS Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3390Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Trap Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3399Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3400Cisco IOS XE Software Web UI Authorization Bypass VulnerabilityCisco IOS XE Software
- CVE-2020-3407Cisco IOS XE Software RESTCONF and NETCONF-YANG Access Control List Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3408Cisco IOS and IOS XE Software Split DNS Denial of Service VulnerabilityCisco IOS
- CVE-2020-3409Cisco IOS and IOS XE Software PROFINET Denial of Service VulnerabilityCisco IOS
- CVE-2020-3414Cisco IOS XE Software for Cisco 4461 Integrated Services Routers Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3421Cisco IOS XE Software Zone-Based Firewall Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2020-3422Cisco IOS XE Software IP Service Level Agreements Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3425Cisco IOS XE Software Privilege Escalation VulnerabilitiesCisco IOS XE Software
- CVE-2020-3426Cisco IOS Software for Cisco Industrial Routers Virtual-LPWA Unauthorized Access VulnerabilityCisco IOS 15.2(6)E4
- CVE-2020-3428Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family WLAN Local Profiling Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3429Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family WPA Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3465Cisco IOS XE Software Ethernet Frame Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3480Cisco IOS XE Software Zone-Based Firewall Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2020-3486Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2020-3487Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2020-3488Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2020-3489Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2020-3492Cisco IOS XE Software for Catalyst 9800 Series and Cisco AireOS Software for Cisco WLC Flexible NetFlow Version 9 Denial of Service VulnerabilityCisco Wireless LAN Controller
- CVE-2020-3493Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2020-3494Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2020-3497Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2020-3508Cisco IOS XE Software for Cisco ASR 1000 Series 20-Gbps Embedded Services Processor IP ARP Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3509Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers DHCP Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3510Cisco IOS XE Software for Catalyst 9200 Series Switches Umbrella Connector Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3511Cisco IOS and IOS XE Software ISDN Q.931 Denial of Service VulnerabilityCisco IOS
- CVE-2020-3512Cisco IOS and IOS XE Software PROFINET Link Layer Discovery Protocol Denial of Service VulnerabilityCisco IOS
- CVE-2020-3526Cisco IOS XE Software Common Open Policy Service Engine Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3527Cisco Catalyst 9200 Series Switches Jumbo Frame Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3552Cisco Aironet Access Points Ethernet Wired Clients Denial of Service VulnerabilityCisco Aironet Access Point Software
- CVE-2020-3560Cisco Aironet Access Points UDP Flooding Denial of Service VulnerabilityCisco Aironet Access Point Software
- CVE-2020-15222Replay of private_key_jwt possible in ORY Fositeory fosite · github.com/ory/fosite
- CVE-2020-15223Ignored storage errors on token revokation in ORY Fositeory fosite · github.com/ory/fosite
Medium, low and unrated 60
- CVE-2020-17365Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to pote
- CVE-2020-15843ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PR
- CVE-2020-15162Stored XSS in PrestaShopPrestaShop
- CVE-2020-13991vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register.
- CVE-2020-15160Blind SQL Injection in PrestaShopPrestaShop
- CVE-2020-15161Potential XSS in PrestaShopPrestaShop
- CVE-2020-8348A DOM-based cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 thLenovo Enterprise Network Disk
- CVE-2020-8347A reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 tLenovo Enterprise Network Disk
- CVE-2020-8333A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow aLenovo BIOS
- CVE-2020-15851Lack of access control in Nakivo Backup & Replication Transporter version 9.4.0.r43656 allows remote users to access unencrypted backup repo
- CVE-2020-15850Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access the Nakivo Director w
- CVE-2016-11086lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot oauth
- CVE-2020-15930An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.joplin
- CVE-2020-19447SQL injection exists in the jdownloads 3.2.63 component for Joomla! com_jdownloads/models/send.php via the f_marked_files_id parameter.
- CVE-2020-3393Cisco IOS XE Software IOx Application Hosting Privilege Escalation VulnerabilityCisco IOS XE Software
- CVE-2020-3396Cisco IOS XE Software IOx Guest Shell USB SSD Namespace Protection Privilege Escalation VulnerabilityCisco IOS XE Software
- CVE-2020-3403Cisco IOS XE Software Command Injection VulnerabilityCisco IOS XE Software
- CVE-2020-3404Cisco IOS XE Software Consent Token Bypass VulnerabilityCisco IOS XE Software
- CVE-2020-3416Cisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution VulnerabilitiesCisco IOS XE Software
- CVE-2020-3417Cisco IOS XE Software Arbitrary Code Execution VulnerabilityCisco IOS XE Software
- CVE-2020-3418Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family Improper Access Control VulnerabilityCisco IOS XE Software
- CVE-2020-3423Cisco IOS XE Software Arbitrary Code Execution VulnerabilityCisco IOS XE Software
- CVE-2020-3474Cisco IOS XE Software Web Management Framework VulnerabilitiesCisco IOS XE Software
- CVE-2020-3475Cisco IOS XE Software Web Management Framework VulnerabilitiesCisco IOS XE Software
- CVE-2020-3476Cisco IOS XE Software Arbitrary File Overwrite VulnerabilityCisco IOS XE Software
- CVE-2020-3477Cisco IOS and IOS XE Software Information Disclosure VulnerabilityCisco IOS
- CVE-2020-3479Cisco IOS and IOS XE Software MP-BGP EVPN Denial of Service VulnerabilityCisco IOS 15.2(5)E1
- CVE-2020-3503Cisco IOS XE Software Guest Shell Unauthorized File System Access VulnerabilityCisco IOS XE Software
- CVE-2020-3513Cisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution VulnerabilitiesCisco IOS XE Software
- CVE-2020-3516Cisco IOS XE Software Web UI Improper Input Validation VulnerabilityCisco IOS XE Software
- CVE-2020-3524Cisco IOS XE ROM Monitor Software VulnerabilityCisco IOS XE ROMMON Software
- CVE-2020-3559Cisco Aironet Access Point Authentication Flood Denial of Service VulnerabilityCisco Aironet Access Point Software
- CVE-2020-13119ismartgate PRO 1.5.9 is vulnerable to clickjacking.
- CVE-2020-12843ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to garage doors.
- CVE-2020-12838ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php.
- CVE-2020-12842ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php.
- CVE-2020-12839ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.php.
- CVE-2020-12837ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading images to garage doors.
- CVE-2020-12840ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload sound files via /index.php
- CVE-2020-12841ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.php
- CVE-2020-12282iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php.
- CVE-2020-12281iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php.
- CVE-2020-12280iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to open/close a specified garage door/gate via /isg/opendoor.php.
- CVE-2020-15840In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.pacom.liferay.portal:com.liferay.portal.impl · com.liferay… +1
- CVE-2020-24365An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices.
- CVE-2020-13505Parameter psClass in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks.Aveva
- CVE-2020-13504Parameter AttFilterValue in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks.Aveva
- CVE-2020-26088A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to
- CVE-2020-16147The login page in Telmat AccessLog <= 6.0 (TAL_20180415) allows an attacker to get root shell access via Unauthenticated code injection over
- CVE-2020-16148The ping page of the administration panel in Telmat AccessLog <= 6.0 (TAL_20180415) allows an attacker to get root shell access via authenti
- CVE-2020-12811A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unaFortinet FortiManager · Fortinet FortiAnalyzer
- CVE-2020-12815An improper neutralization of input vulnerability in FortiTester before 3.9.0 may allow a remote authenticated attacker to inject script relFortinet FortiTester
- CVE-2020-12817An improper neutralization of input vulnerability in FortiAnalyzer before 6.4.1 and 6.2.5 may allow a remote authenticated attacker to injecFortinet FortiAnalyzer
- CVE-2020-12818An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP Fortinet FortiOS
- CVE-2020-12816An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored croFortinet FortiNAC
- CVE-2020-22453Untis WebUntis before 2020.9.6 allows XSS in multiple functions that store information.
- CVE-2020-6020Check Point Security Management's Internal CA web management before Jumbo HFAs R80.10 Take 278, R80.20 Take 160, R80.30 Take 210, and R80.40ICA Management Portal
- CVE-2020-24560An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allTrend Micro Security
- CVE-2020-15604An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allTrend Micro Security
- CVE-2015-4719The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.