CVEs published September 29, 2020
39 CVEs were published on September 29, 2020: 0 critical, 5 high. 1 is now in CISA KEV.
- Published
- 39
- Critical
- 0
- High
- 5
- Medium
- 12
- Low
- 1
- Unrated
- 21
- Now in CISA KEV
- 1
- Fix available
- 15
Most affected products
- GitLab
- 13
- github.com/goharbor/harbor
- 1
- IBM Security Verify Privilege Vault Remote
- 1
- Pulse Connect Secre
- 1
- Pulse Connect Secure
- 1
- Pulse Secure Pulse Connect Secure/ Pulse Policy Secure
- 1
- russellhaering goxmldsig · github.com/russellhaering/goxmld…
- 1
- urllib3
- 1
High 5
- CVE-2020-13321A vulnerability was discovered in GitLab versions prior to 13.1.GitLab
- CVE-2020-13325A vulnerability was discovered in GitLab versions prior 13.1.GitLab
- CVE-2020-13323A vulnerability was discovered in GitLab versions prior 13.1.GitLab
- CVE-2020-13322A vulnerability was discovered in GitLab versions after 12.9.GitLab
- CVE-2020-8243A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template toPulse Connect Secre
Medium, low and unrated 34
- CVE-2020-26154url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered
- CVE-2020-26150info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct request, which calls the p
- CVE-2020-13794Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor.github.com/goharbor/harbor
- CVE-2018-5353The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate
- CVE-2018-5354The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privilege
- CVE-2020-24570An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1.
- CVE-2020-24569An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1.
- CVE-2020-25763Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code
- CVE-2020-25762An issue was discovered in SourceCodester Seat Reservation System 1.0.
- CVE-2020-25761Projectworlds Visitor Management System in PHP 1.0 allows XSS.
- CVE-2020-25760Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection.
- CVE-2020-13658In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privi
- CVE-2020-26148md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial of service (e.g., as
- CVE-2020-13326A vulnerability was discovered in GitLab versions prior to 13.1.GitLab
- CVE-2020-13324A vulnerability was discovered in GitLab versions prior to 13.1.GitLab
- CVE-2020-13331An issue has been discovered in GitLab affecting versions prior to 12.10.13.GitLab
- CVE-2020-13330An issue has been discovered in GitLab affecting versions prior to 12.10.13.GitLab
- CVE-2020-13329An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13.GitLab
- CVE-2020-13328An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13.GitLab
- CVE-2020-13320An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project seGitLab
- CVE-2020-15216Signature Validation Bypass in goxmldsigrussellhaering goxmldsig · github.com/russellhaering/goxmld…
- CVE-2020-13319An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13.GitLab
- CVE-2020-13296An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6.GitLab
- CVE-2020-20800An issue was discovered in MetInfo v7.0.0 beta.
- CVE-2020-4607IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due toIBM Security Verify Privilege Vault Remote
- CVE-2020-26043An issue was discovered in Hoosk CMS v1.8.0.
- CVE-2020-26042An issue was discovered in Hoosk CMS v1.8.0.
- CVE-2020-8256A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file readiPulse Connect Secure
- CVE-2020-8238A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to cPulse Secure Pulse Connect Secure/ Pulse Policy Secure
- CVE-2020-26041An issue was discovered in Hoosk CmS v1.8.0.
- CVE-2020-15594An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511.
- CVE-2020-14030An issue was discovered in Ozeki NG SMS Gateway through 4.17.6.
- CVE-2020-15595An issue was discovered in Zoho Application Control Plus before version 10.0.511.
- CVE-2020-26137urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF controlurllib3