# CVEs published 2020-09-29 39 CVEs were published on September 29, 2020: 0 critical, 5 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2020-26154](https://cve.now/CVE-2020-26154.md): url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered (no CVSS) - [CVE-2020-26150](https://cve.now/CVE-2020-26150.md): info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct request, which calls the p (no CVSS) - [CVE-2020-13794](https://cve.now/CVE-2020-13794.md): Harbor 1.9.\* 1.10.\* and 2.0.\* allows Exposure of Sensitive Information to an Unauthorized Actor. (no CVSS, github.com/goharbor/harbor) - [CVE-2018-5353](https://cve.now/CVE-2018-5353.md): The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate (no CVSS) - [CVE-2018-5354](https://cve.now/CVE-2018-5354.md): The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privilege (no CVSS) - [CVE-2020-24570](https://cve.now/CVE-2020-24570.md): An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. (no CVSS) - [CVE-2020-24569](https://cve.now/CVE-2020-24569.md): An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. (no CVSS) - [CVE-2020-25763](https://cve.now/CVE-2020-25763.md): Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code (no CVSS) - [CVE-2020-25762](https://cve.now/CVE-2020-25762.md): An issue was discovered in SourceCodester Seat Reservation System 1.0. (no CVSS) - [CVE-2020-25761](https://cve.now/CVE-2020-25761.md): Projectworlds Visitor Management System in PHP 1.0 allows XSS. (no CVSS) - [CVE-2020-25760](https://cve.now/CVE-2020-25760.md): Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. (no CVSS) - [CVE-2020-13658](https://cve.now/CVE-2020-13658.md): In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to elevate their privi (no CVSS) - [CVE-2020-26148](https://cve.now/CVE-2020-26148.md): md\_push\_block\_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial of service (e.g., as (no CVSS) - [CVE-2020-13326](https://cve.now/CVE-2020-13326.md): A vulnerability was discovered in GitLab versions prior to 13.1. (CVSS 4.3, GitLab) - [CVE-2020-13321](https://cve.now/CVE-2020-13321.md): A vulnerability was discovered in GitLab versions prior to 13.1. (CVSS 8.3, GitLab) - [CVE-2020-13324](https://cve.now/CVE-2020-13324.md): A vulnerability was discovered in GitLab versions prior to 13.1. (CVSS 6.5, GitLab) - [CVE-2020-13325](https://cve.now/CVE-2020-13325.md): A vulnerability was discovered in GitLab versions prior 13.1. (CVSS 7.1, GitLab) - [CVE-2020-13323](https://cve.now/CVE-2020-13323.md): A vulnerability was discovered in GitLab versions prior 13.1. (CVSS 7.7, GitLab) - [CVE-2020-13331](https://cve.now/CVE-2020-13331.md): An issue has been discovered in GitLab affecting versions prior to 12.10.13. (CVSS 5.4, GitLab) - [CVE-2020-13330](https://cve.now/CVE-2020-13330.md): An issue has been discovered in GitLab affecting versions prior to 12.10.13. (CVSS 4.4, GitLab) - [CVE-2020-13329](https://cve.now/CVE-2020-13329.md): An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. (CVSS 6.5, GitLab) - [CVE-2020-13328](https://cve.now/CVE-2020-13328.md): An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. (CVSS 4.8, GitLab) - [CVE-2020-13320](https://cve.now/CVE-2020-13320.md): An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project se (CVSS 6.5, GitLab) - [CVE-2020-13322](https://cve.now/CVE-2020-13322.md): A vulnerability was discovered in GitLab versions after 12.9. (CVSS 7.2, GitLab) - [CVE-2020-15216](https://cve.now/CVE-2020-15216.md): Signature Validation Bypass in goxmldsig (CVSS 5.3, russellhaering goxmldsig · github.com/russellhaering/goxmld…) - [CVE-2020-13319](https://cve.now/CVE-2020-13319.md): An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. (CVSS 4.3, GitLab) - [CVE-2020-13296](https://cve.now/CVE-2020-13296.md): An issue has been discovered in GitLab affecting versions \>=10.7 \<13.0.14, \>=13.1.0 \<13.1.8, \>=13.2.0 \<13.2.6. (CVSS 6.5, GitLab) - [CVE-2020-20800](https://cve.now/CVE-2020-20800.md): An issue was discovered in MetInfo v7.0.0 beta. (no CVSS) - [CVE-2020-4607](https://cve.now/CVE-2020-4607.md): IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due to (CVSS 3.3, IBM Security Verify Privilege Vault Remote) - [CVE-2020-26043](https://cve.now/CVE-2020-26043.md): An issue was discovered in Hoosk CMS v1.8.0. (no CVSS) - [CVE-2020-8243](https://cve.now/CVE-2020-8243.md): A vulnerability in the Pulse Connect Secure \< 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to (CVSS 7.2, KEV, Pulse Connect Secre) - [CVE-2020-26042](https://cve.now/CVE-2020-26042.md): An issue was discovered in Hoosk CMS v1.8.0. (no CVSS) - [CVE-2020-8256](https://cve.now/CVE-2020-8256.md): A vulnerability in the Pulse Connect Secure \< 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file readi (no CVSS, Pulse Connect Secure) - [CVE-2020-8238](https://cve.now/CVE-2020-8238.md): A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure \< 9.1R8.2 could allow attackers to c (no CVSS, Pulse Secure Pulse Connect Secure/ Pulse Policy Secure) - [CVE-2020-26041](https://cve.now/CVE-2020-26041.md): An issue was discovered in Hoosk CmS v1.8.0. (no CVSS) - [CVE-2020-15594](https://cve.now/CVE-2020-15594.md): An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. (CVSS 4.3) - [CVE-2020-14030](https://cve.now/CVE-2020-14030.md): An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. (no CVSS) - [CVE-2020-15595](https://cve.now/CVE-2020-15595.md): An issue was discovered in Zoho Application Control Plus before version 10.0.511. (CVSS 4.3) - [CVE-2020-26137](https://cve.now/CVE-2020-26137.md): urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control (no CVSS, urllib3) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-09-29 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.