CVEs published September 25, 2020
112 CVEs were published on September 25, 2020: 4 critical, 8 high. 1 is now in CISA KEV.
- Published
- 112
- Critical
- 4
- High
- 8
- Medium
- 17
- Low
- 0
- Unrated
- 83
- Now in CISA KEV
- 1
- Fix available
- 26
Most affected products
- tensorflow · tensorflow-cpu +1
- 17
- Brocade Fabric OS
- 9
- tensorflow · tensorflow-gpu +1
- 8
- Brocade SANnav
- 2
- BIG-IP
- 1
- BIG-IP, BIG-IQ
- 1
- General Electric Reason S20 Ethernet Switch
- 1
- IBM Business Automation Workflow · IBM Business Process Man…
- 1
- IBM InfoSphere Information Server
- 1
- ng-packagr
- 1
Critical 4
- CVE-2020-15202Integer truncation in Shard API usagetensorflow · tensorflow-cpu +1
- CVE-2020-15205Data leak in Tensorflowtensorflow · tensorflow-cpu +1
- CVE-2020-15206Denial of Service in Tensorflowtensorflow · tensorflow-gpu +1
- CVE-2020-25223A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
High 8
- CVE-2020-15212Out of bounds access in tensorflow-litetensorflow · tensorflow-cpu +1
- CVE-2020-15214Out of bounds write in tensorflow-litetensorflow · tensorflow-cpu +1
- CVE-2020-15203Denial of Service in Tensorflowtensorflow · tensorflow-gpu +1
- CVE-2020-15207Segfault and data corruption in tensorflow-litetensorflow · tensorflow-cpu +1
- CVE-2020-15208Data corruption in tensorflow-litetensorflow · tensorflow-cpu +1
- CVE-2020-15193Memory corruption in Tensorflowtensorflow · tensorflow-cpu +1
- CVE-2020-15195Heap buffer overflow in Tensorflowtensorflow · tensorflow-cpu +1
- CVE-2020-15196Heap buffer overflow in Tensorflowtensorflow · tensorflow-gpu +1
Medium, low and unrated 100
- CVE-2020-15213Denial of service in tensorflow-litetensorflow · tensorflow-cpu +1
- CVE-2020-15201Heap buffer overflow in Tensorflowtensorflow · tensorflow-gpu +1
- CVE-2020-15204Segfault in Tensorflowtensorflow · tensorflow-gpu +1
- CVE-2020-15209Null pointer dereference in tensorflow-litetensorflow · tensorflow-cpu +1
- CVE-2020-15210Segmentation fault in tensorflow-litetensorflow · tensorflow-cpu +1
- CVE-2020-15211Out of bounds access in tensorflow-litetensorflow · tensorflow-cpu +1
- CVE-2020-15191Undefined behavior in Tensorflowtensorflow · tensorflow-cpu +1
- CVE-2020-15192Memory leak in Tensorflowtensorflow · tensorflow-cpu +1
- CVE-2020-15194Denial of Service in Tensorflowtensorflow · tensorflow-gpu +1
- CVE-2020-15197Denial of Service in Tensorflowtensorflow · tensorflow-cpu +1
- CVE-2020-15198Heap buffer overflow in Tensorflowtensorflow · tensorflow-gpu +1
- CVE-2020-15199Denial of Service in Tensorflowtensorflow · tensorflow-cpu +1
- CVE-2020-15200Segfault in Tensorflowtensorflow · tensorflow-cpu +1
- CVE-2020-15190Segfault in Tensorflowtensorflow · tensorflow-gpu +1
- CVE-2020-25149An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25148An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25147An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25146An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25145An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25144An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-16242GE Reason S20 Ethernet SwitchGeneral Electric Reason S20 Ethernet Switch
- CVE-2020-25143An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25142An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25141An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-4727IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim.IBM InfoSphere Information Server
- CVE-2020-4531IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obIBM Business Automation Workflow · IBM Business Process Man…
- CVE-2020-25140An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25139An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25138An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25137An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-19455SQL injection exists in the jdownloads 3.2.63 component for Joomla! via components/com_jdownloads/helpers/categories.php, order function via
- CVE-2020-19451SQL injection exists in the jdownloads 3.2.63 component for Joomla! via com_jdownloads/helpers/jdownloadshelper.php, updateLog function via
- CVE-2020-25136An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25135An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25134An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-19450SQL injection exists in the jdownloads 3.2.63 component for Joomla! via com_jdownloads/helpers/jdownloadshelper.php, getUserLimits function
- CVE-2020-25133An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25132An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25131An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-25130An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631.
- CVE-2020-5929In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a BIG-IP
- CVE-2020-5930In BIG-IP 15.0.0-15.1.0.4, 14.1.0-14.1.2.7, 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 and BIG-IQ 5.2.0-7.1.0, unauthenticated atBIG-IP, BIG-IQ
- CVE-2020-15374Rest API in Brocade Fabric OS v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c is vulnerable to multiple instances of reflected inpBrocade Fabric OS
- CVE-2020-15373Multiple buffer overflow vulnerabilities in REST API in Brocade Fabric OS versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2cBrocade Fabric OS
- CVE-2020-15372A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0_CBN3, v8.2.1e,Brocade Fabric OS
- CVE-2020-15371Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, contains code injection and privilege esBrocade Fabric OS
- CVE-2020-15370Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in clearteBrocade Fabric OS
- CVE-2020-15369Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password fielBrocade Fabric OS
- CVE-2018-6448A vulnerability in the management interface in Brocade Fabric OS Versions before Brocade Fabric OS v9.0.0 could allow a remote attacker to pBrocade Fabric OS
- CVE-2018-6449Host Header Injection vulnerability in the http management interface in Brocade Fabric OS versions before v9.0.0 could allow a remote attackBrocade Fabric OS
- CVE-2019-16211Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.Brocade SANnav
- CVE-2019-16212A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection.Brocade SANnav
- CVE-2018-6447A Reflective XSS Vulnerability in HTTP Management Interface in Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e,Brocade Fabric OS
- CVE-2020-13995U.S.
- CVE-2020-7735Command Injectionng-packagr
- CVE-2020-15394The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, lea
- CVE-2020-15521Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) .
- CVE-2019-11556Pagure before 5.6 allows XSS via the templates/blame.html blame view.
- CVE-2020-26098cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).
- CVE-2020-26099cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).
- CVE-2020-26100chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).
- CVE-2020-26101In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).
- CVE-2020-26102In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).
- CVE-2020-26103In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
- CVE-2020-26104In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
- CVE-2020-26105In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).
- CVE-2020-26106cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).
- CVE-2020-26107cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).
- CVE-2020-26108cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).
- CVE-2020-26109cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).
- CVE-2020-26110cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).
- CVE-2020-26111cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).
- CVE-2020-26112The email quota cache in cPanel before 90.0.10 allows overwriting of files.
- CVE-2020-26113cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).
- CVE-2020-26114cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).
- CVE-2020-26115cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).
- CVE-2020-25625hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.
- CVE-2020-25085QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SD
- CVE-2020-25084QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
- CVE-2020-25203The Framer Preview application 12 for Android exposes com.framer.viewer.FramerViewActivity to other applications.
- CVE-2020-23837A Cross-Site Request Forgery (CSRF) vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin (or
- CVE-2020-24718bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not prope
- CVE-2020-24595Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to retrieve sensitive information due
- CVE-2020-24594Mitel MiCloud Management Portal before 6.1 SP5 could allow an unauthenticated attacker to execute arbitrary scripts due to insufficient inpu
- CVE-2020-24593Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials d
- CVE-2020-24592Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system information due to insu
- CVE-2020-24692The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient
- CVE-2020-24621A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS.
- CVE-2020-24615Pexip Infinity before 24.1 has Improper Input Validation, leading to temporary denial of service via SIP.
- CVE-2020-13387Pexip Infinity before 23.4 has a lack of input validation, leading to temporary denial of service via H.323.
- CVE-2020-12824Pexip Infinity 23.x before 23.3 has improper input validation, leading to a temporary software abort via RTP.
- CVE-2020-11805Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN.
- CVE-2017-17477Pexip Infinity before 17 allows an unauthenticated remote attacker to achieve stored XSS via management web interface views.
- CVE-2019-7178Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup.
- CVE-2019-7177Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin.
- CVE-2018-10585Pexip Infinity before 18 allows remote Denial of Service (XML parsing).
- CVE-2018-10432Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP).
- CVE-2020-25749The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) could allow an remote attacker to
- CVE-2020-25748A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339).
- CVE-2020-25747The Telnet service of Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) can allow a remote attacker to gain acces