# CVEs published 2020-09-25

112 CVEs were published on September 25, 2020: 4 critical, 8 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-15212](https://cve.now/CVE-2020-15212.md): Out of bounds access in tensorflow-lite (CVSS 8.1, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15213](https://cve.now/CVE-2020-15213.md): Denial of service in tensorflow-lite (CVSS 4.0, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15214](https://cve.now/CVE-2020-15214.md): Out of bounds write in tensorflow-lite (CVSS 8.1, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15201](https://cve.now/CVE-2020-15201.md): Heap buffer overflow in Tensorflow (CVSS 4.8, tensorflow · tensorflow-gpu +1)
- [CVE-2020-15202](https://cve.now/CVE-2020-15202.md): Integer truncation in Shard API usage (CVSS 9.0, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15203](https://cve.now/CVE-2020-15203.md): Denial of Service in Tensorflow (CVSS 7.5, tensorflow · tensorflow-gpu +1)
- [CVE-2020-15204](https://cve.now/CVE-2020-15204.md): Segfault in Tensorflow (CVSS 5.3, tensorflow · tensorflow-gpu +1)
- [CVE-2020-15205](https://cve.now/CVE-2020-15205.md): Data leak in Tensorflow (CVSS 9.0, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15206](https://cve.now/CVE-2020-15206.md): Denial of Service in Tensorflow (CVSS 9.0, tensorflow · tensorflow-gpu +1)
- [CVE-2020-15207](https://cve.now/CVE-2020-15207.md): Segfault and data corruption in tensorflow-lite (CVSS 8.7, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15208](https://cve.now/CVE-2020-15208.md): Data corruption in tensorflow-lite (CVSS 7.4, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15209](https://cve.now/CVE-2020-15209.md): Null pointer dereference in tensorflow-lite (CVSS 5.9, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15210](https://cve.now/CVE-2020-15210.md): Segmentation fault in tensorflow-lite (CVSS 6.5, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15211](https://cve.now/CVE-2020-15211.md): Out of bounds access in tensorflow-lite (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15191](https://cve.now/CVE-2020-15191.md): Undefined behavior in Tensorflow (CVSS 5.3, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15192](https://cve.now/CVE-2020-15192.md): Memory leak in Tensorflow (CVSS 4.3, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15193](https://cve.now/CVE-2020-15193.md): Memory corruption in Tensorflow (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15194](https://cve.now/CVE-2020-15194.md): Denial of Service in Tensorflow (CVSS 5.3, tensorflow · tensorflow-gpu +1)
- [CVE-2020-15195](https://cve.now/CVE-2020-15195.md): Heap buffer overflow in Tensorflow (CVSS 8.5, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15196](https://cve.now/CVE-2020-15196.md): Heap buffer overflow in Tensorflow (CVSS 8.5, tensorflow · tensorflow-gpu +1)
- [CVE-2020-15197](https://cve.now/CVE-2020-15197.md): Denial of Service in Tensorflow (CVSS 6.3, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15198](https://cve.now/CVE-2020-15198.md): Heap buffer overflow in Tensorflow (CVSS 5.4, tensorflow · tensorflow-gpu +1)
- [CVE-2020-15199](https://cve.now/CVE-2020-15199.md): Denial of Service in Tensorflow (CVSS 5.9, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15200](https://cve.now/CVE-2020-15200.md): Segfault in Tensorflow (CVSS 5.9, tensorflow · tensorflow-cpu +1)
- [CVE-2020-15190](https://cve.now/CVE-2020-15190.md): Segfault in Tensorflow (CVSS 5.3, tensorflow · tensorflow-gpu +1)
- [CVE-2020-25149](https://cve.now/CVE-2020-25149.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25148](https://cve.now/CVE-2020-25148.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25147](https://cve.now/CVE-2020-25147.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25146](https://cve.now/CVE-2020-25146.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25145](https://cve.now/CVE-2020-25145.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25144](https://cve.now/CVE-2020-25144.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-16242](https://cve.now/CVE-2020-16242.md): GE Reason S20 Ethernet Switch (no CVSS, General Electric Reason S20 Ethernet Switch)
- [CVE-2020-25143](https://cve.now/CVE-2020-25143.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25142](https://cve.now/CVE-2020-25142.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25141](https://cve.now/CVE-2020-25141.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-4727](https://cve.now/CVE-2020-4727.md): IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM InfoSphere Information Server)
- [CVE-2020-4531](https://cve.now/CVE-2020-4531.md): IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to ob (CVSS 5.3, IBM Business Automation Workflow · IBM Business Process Man…)
- [CVE-2020-25140](https://cve.now/CVE-2020-25140.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25139](https://cve.now/CVE-2020-25139.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25138](https://cve.now/CVE-2020-25138.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25137](https://cve.now/CVE-2020-25137.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-19455](https://cve.now/CVE-2020-19455.md): SQL injection exists in the jdownloads 3.2.63 component for Joomla! via components/com\_jdownloads/helpers/categories.php, order function via (no CVSS)
- [CVE-2020-19451](https://cve.now/CVE-2020-19451.md): SQL injection exists in the jdownloads 3.2.63 component for Joomla! via com\_jdownloads/helpers/jdownloadshelper.php, updateLog function via (no CVSS)
- [CVE-2020-25136](https://cve.now/CVE-2020-25136.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25135](https://cve.now/CVE-2020-25135.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25134](https://cve.now/CVE-2020-25134.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-19450](https://cve.now/CVE-2020-19450.md): SQL injection exists in the jdownloads 3.2.63 component for Joomla! via com\_jdownloads/helpers/jdownloadshelper.php, getUserLimits function (no CVSS)
- [CVE-2020-25133](https://cve.now/CVE-2020-25133.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25132](https://cve.now/CVE-2020-25132.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25131](https://cve.now/CVE-2020-25131.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-25130](https://cve.now/CVE-2020-25130.md): An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. (no CVSS)
- [CVE-2020-5929](https://cve.now/CVE-2020-5929.md): In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a (no CVSS, BIG-IP)
- [CVE-2020-5930](https://cve.now/CVE-2020-5930.md): In BIG-IP 15.0.0-15.1.0.4, 14.1.0-14.1.2.7, 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 and BIG-IQ 5.2.0-7.1.0, unauthenticated at (no CVSS, BIG-IP, BIG-IQ)
- [CVE-2020-15374](https://cve.now/CVE-2020-15374.md): Rest API in Brocade Fabric OS v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c is vulnerable to multiple instances of reflected inp (no CVSS, Brocade Fabric OS)
- [CVE-2020-15373](https://cve.now/CVE-2020-15373.md): Multiple buffer overflow vulnerabilities in REST API in Brocade Fabric OS versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c (no CVSS, Brocade Fabric OS)
- [CVE-2020-15372](https://cve.now/CVE-2020-15372.md): A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0\_CBN3, v8.2.1e, (no CVSS, Brocade Fabric OS)
- [CVE-2020-15371](https://cve.now/CVE-2020-15371.md): Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0\_CBN3, contains code injection and privilege es (no CVSS, Brocade Fabric OS)
- [CVE-2020-15370](https://cve.now/CVE-2020-15370.md): Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in clearte (no CVSS, Brocade Fabric OS)
- [CVE-2020-15369](https://cve.now/CVE-2020-15369.md): Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password fiel (no CVSS, Brocade Fabric OS)
- [CVE-2018-6448](https://cve.now/CVE-2018-6448.md): A vulnerability in the management interface in Brocade Fabric OS Versions before Brocade Fabric OS v9.0.0 could allow a remote attacker to p (no CVSS, Brocade Fabric OS)
- [CVE-2018-6449](https://cve.now/CVE-2018-6449.md): Host Header Injection vulnerability in the http management interface in Brocade Fabric OS versions before v9.0.0 could allow a remote attack (no CVSS, Brocade Fabric OS)
- [CVE-2019-16211](https://cve.now/CVE-2019-16211.md): Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability. (no CVSS, Brocade SANnav)
- [CVE-2019-16212](https://cve.now/CVE-2019-16212.md): A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. (no CVSS, Brocade SANnav)
- [CVE-2018-6447](https://cve.now/CVE-2018-6447.md): A Reflective XSS Vulnerability in HTTP Management Interface in Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, (no CVSS, Brocade Fabric OS)
- [CVE-2020-13995](https://cve.now/CVE-2020-13995.md): U.S. (no CVSS)
- [CVE-2020-7735](https://cve.now/CVE-2020-7735.md): Command Injection (CVSS 6.6, ng-packagr)
- [CVE-2020-15394](https://cve.now/CVE-2020-15394.md): The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, lea (no CVSS)
- [CVE-2020-15521](https://cve.now/CVE-2020-15521.md): Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) . (no CVSS)
- [CVE-2019-11556](https://cve.now/CVE-2019-11556.md): Pagure before 5.6 allows XSS via the templates/blame.html blame view. (no CVSS)
- [CVE-2020-26098](https://cve.now/CVE-2020-26098.md): cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). (no CVSS)
- [CVE-2020-26099](https://cve.now/CVE-2020-26099.md): cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491). (no CVSS)
- [CVE-2020-26100](https://cve.now/CVE-2020-26100.md): chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). (no CVSS)
- [CVE-2020-26101](https://cve.now/CVE-2020-26101.md): In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). (no CVSS)
- [CVE-2020-26102](https://cve.now/CVE-2020-26102.md): In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550). (no CVSS)
- [CVE-2020-26103](https://cve.now/CVE-2020-26103.md): In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551). (no CVSS)
- [CVE-2020-26104](https://cve.now/CVE-2020-26104.md): In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552). (no CVSS)
- [CVE-2020-26105](https://cve.now/CVE-2020-26105.md): In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). (no CVSS)
- [CVE-2020-26106](https://cve.now/CVE-2020-26106.md): cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558). (no CVSS)
- [CVE-2020-26107](https://cve.now/CVE-2020-26107.md): cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561). (no CVSS)
- [CVE-2020-26108](https://cve.now/CVE-2020-26108.md): cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). (no CVSS)
- [CVE-2020-26109](https://cve.now/CVE-2020-26109.md): cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557). (no CVSS)
- [CVE-2020-26110](https://cve.now/CVE-2020-26110.md): cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564). (no CVSS)
- [CVE-2020-26111](https://cve.now/CVE-2020-26111.md): cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566). (no CVSS)
- [CVE-2020-26112](https://cve.now/CVE-2020-26112.md): The email quota cache in cPanel before 90.0.10 allows overwriting of files. (no CVSS)
- [CVE-2020-26113](https://cve.now/CVE-2020-26113.md): cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569). (no CVSS)
- [CVE-2020-26114](https://cve.now/CVE-2020-26114.md): cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573). (no CVSS)
- [CVE-2020-26115](https://cve.now/CVE-2020-26115.md): cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574). (no CVSS)
- [CVE-2020-25625](https://cve.now/CVE-2020-25625.md): hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. (no CVSS)
- [CVE-2020-25085](https://cve.now/CVE-2020-25085.md): QEMU 5.0.0 has a heap-based Buffer Overflow in flatview\_read\_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SD (no CVSS)
- [CVE-2020-25084](https://cve.now/CVE-2020-25084.md): QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb\_packet\_map return value is not checked. (no CVSS)
- [CVE-2020-25203](https://cve.now/CVE-2020-25203.md): The Framer Preview application 12 for Android exposes com.framer.viewer.FramerViewActivity to other applications. (no CVSS)
- [CVE-2020-23837](https://cve.now/CVE-2020-23837.md): A Cross-Site Request Forgery (CSRF) vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin (or (no CVSS)
- [CVE-2020-24718](https://cve.now/CVE-2020-24718.md): bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not prope (no CVSS)
- [CVE-2020-24595](https://cve.now/CVE-2020-24595.md): Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to retrieve sensitive information due (no CVSS)
- [CVE-2020-24594](https://cve.now/CVE-2020-24594.md): Mitel MiCloud Management Portal before 6.1 SP5 could allow an unauthenticated attacker to execute arbitrary scripts due to insufficient inpu (no CVSS)
- [CVE-2020-24593](https://cve.now/CVE-2020-24593.md): Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials d (no CVSS)
- [CVE-2020-24592](https://cve.now/CVE-2020-24592.md): Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system information due to insu (no CVSS)
- [CVE-2020-24692](https://cve.now/CVE-2020-24692.md): The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient (no CVSS)
- [CVE-2020-24621](https://cve.now/CVE-2020-24621.md): A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS. (no CVSS)
- [CVE-2020-24615](https://cve.now/CVE-2020-24615.md): Pexip Infinity before 24.1 has Improper Input Validation, leading to temporary denial of service via SIP. (no CVSS)
- [CVE-2020-13387](https://cve.now/CVE-2020-13387.md): Pexip Infinity before 23.4 has a lack of input validation, leading to temporary denial of service via H.323. (no CVSS)
- [CVE-2020-12824](https://cve.now/CVE-2020-12824.md): Pexip Infinity 23.x before 23.3 has improper input validation, leading to a temporary software abort via RTP. (no CVSS)
- [CVE-2020-11805](https://cve.now/CVE-2020-11805.md): Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN. (no CVSS)
- [CVE-2017-17477](https://cve.now/CVE-2017-17477.md): Pexip Infinity before 17 allows an unauthenticated remote attacker to achieve stored XSS via management web interface views. (no CVSS)
- [CVE-2019-7178](https://cve.now/CVE-2019-7178.md): Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup. (no CVSS)
- [CVE-2019-7177](https://cve.now/CVE-2019-7177.md): Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin. (no CVSS)
- [CVE-2018-10585](https://cve.now/CVE-2018-10585.md): Pexip Infinity before 18 allows remote Denial of Service (XML parsing). (no CVSS)
- [CVE-2018-10432](https://cve.now/CVE-2018-10432.md): Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP). (no CVSS)
- [CVE-2020-25749](https://cve.now/CVE-2020-25749.md): The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) could allow an remote attacker to (no CVSS)
- [CVE-2020-25748](https://cve.now/CVE-2020-25748.md): A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339). (no CVSS)
- [CVE-2020-25747](https://cve.now/CVE-2020-25747.md): The Telnet service of Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) can allow a remote attacker to gain acces (no CVSS)
- [CVE-2020-25223](https://cve.now/CVE-2020-25223.md): A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11 (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.