# CVEs published 2020-09-27

11 CVEs were published on September 27, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-25813](https://cve.now/CVE-2020-25813.md): In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users. (no CVSS, mediawiki/core)
- [CVE-2020-25827](https://cve.now/CVE-2020-25827.md): An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. (no CVSS, mediawiki/core)
- [CVE-2020-25869](https://cve.now/CVE-2020-25869.md): An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. (no CVSS)
- [CVE-2020-25828](https://cve.now/CVE-2020-25828.md): An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. (no CVSS, mediawiki/core)
- [CVE-2020-25814](https://cve.now/CVE-2020-25814.md): In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. (no CVSS, mediawiki/core)
- [CVE-2020-25815](https://cve.now/CVE-2020-25815.md): An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. (no CVSS, mediawiki/core)
- [CVE-2020-25812](https://cve.now/CVE-2020-25812.md): An issue was discovered in MediaWiki 1.34.x before 1.34.4. (no CVSS, mediawiki/core)
- [CVE-2020-26121](https://cve.now/CVE-2020-26121.md): An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. (no CVSS)
- [CVE-2020-26120](https://cve.now/CVE-2020-26120.md): XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacem (no CVSS)
- [CVE-2020-26117](https://cve.now/CVE-2020-26117.md): In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. (no CVSS)
- [CVE-2020-26116](https://cve.now/CVE-2020-26116.md): http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attack (no CVSS, libpython · python +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.