CVEs published September 30, 2020
54 CVEs were published on September 30, 2020: 1 critical, 3 high.
- Published
- 54
- Critical
- 1
- High
- 3
- Medium
- 4
- Low
- 3
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- dpdk
- 5
- mantisbt/mantisbt
- 3
- handlebars
- 2
- Apache Hadoop · org.apache.hadoop:hadoop-main
- 1
- Apache OpenMeetings · org.apache.openmeetings:openmeetings-…
- 1
- Apache Superset · apache-superset
- 1
- Apache Tapestry · org.apache.tapestry:tapestry-core
- 1
- August Smart Lock and Connect Wi-Fi Bridge App · August Con…
- 1
- Bitdefender Engines
- 1
- bootstrap-select
- 1
Critical 1
High 3
- CVE-2020-6654DLL HijackingEaton 9000x Programming and Configuration Software
- CVE-2020-12505WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07WAGO 750-852 · WAGO 750-880/xxx-xxx +5
- CVE-2020-26160jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is algithub.com/dgrijalva/jwt-go · github.com/dgrijalva/jwt-go/v4
Medium, low and unrated 50
- CVE-2020-13336An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13.GitLab
- CVE-2020-12869RainbowFish PacsOne Server 6.8.4 allows XSS.
- CVE-2020-13952In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto databaseApache Superset · apache-superset
- CVE-2020-16234FATEK Automation PLC WinProladderFATEK Automation PLC WinProladder
- CVE-2020-12715RainbowFish PacsOne Server 6.8.4 has Incorrect Access Control.
- CVE-2020-12870RainbowFish PacsOne Server 6.8.4 allows SQL injection on the username parameter in the signup page.
- CVE-2020-25830An issue was discovered in MantisBT before 2.24.3.mantisbt/mantisbt
- CVE-2020-25781An issue was discovered in file_download.php in MantisBT before 2.24.3.mantisbt/mantisbt
- CVE-2020-25288An issue was discovered in MantisBT before 2.24.3.mantisbt/mantisbt
- CVE-2020-25816HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiratiogithub.com/hashicorp/vault
- CVE-2020-25626A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2.Django REST Framework · djangorestframework
- CVE-2020-14374A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5.dpdk
- CVE-2020-14377A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5.dpdk
- CVE-2020-14376A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5.dpdk
- CVE-2020-14375A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5.dpdk
- CVE-2020-15849Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates() method.
- CVE-2020-15488Re:Desk 2.3 allows insecure file upload.
- CVE-2020-15487Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria() function in the protected/models/Ticket.ph
- CVE-2020-19676Nacos 1.1.4 is affected by: Incorrect Access Control.com.alibaba.nacos:nacos-common
- CVE-2020-24721An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in COVID-19 applications
- CVE-2020-19672Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the background upload interface, through parameter
- CVE-2019-18991A partial authentication bypass vulnerability exists on Atheros AR9132 3.60(AMX.8), AR9283 1.85, and AR9285 1.0.0.12NA devices.
- CVE-2019-18990A partial authentication bypass vulnerability exists on Realtek RTL8812AR 1.21WW, RTL8196D 1.0.0, RTL8192ER 2.10, and RTL8881AN 1.09 devices
- CVE-2019-18989A partial authentication bypass vulnerability exists on Mediatek MT7620N 1.06 devices.
- CVE-2020-13951Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.Apache OpenMeetings · org.apache.openmeetings:openmeetings-…
- CVE-2020-19670In Niushop B2B2C Multi-Business Basic Edition V1.11, authentication can be bypassed, causing administrators to reset any passwords.
- CVE-2018-11765In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication wApache Hadoop · org.apache.hadoop:hadoop-main
- CVE-2020-13953In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being ruApache Tapestry · org.apache.tapestry:tapestry-core
- CVE-2020-21564An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11.
- CVE-2020-26163BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows
- CVE-2020-21527There is an Arbitrary file deletion vulnerability in halo v1.1.3.
- CVE-2020-21526An Arbitrary file writing vulnerability in halo v1.1.3.
- CVE-2020-21525Halo V1.1.3 is affected by: Arbitrary File reading.
- CVE-2020-4629IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information froIBM WebSphere Application Server
- CVE-2020-21524There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrat
- CVE-2020-21523A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function.
- CVE-2020-21522An issue was discovered in halo V1.1.3.
- CVE-2020-21244An issue was discovered in FrontAccounting 2.4.7.
- CVE-2019-17098Use of Hard-coded Cryptographic Key vulnerability in August Connect Wi-Fi Bridge AppAugust Smart Lock and Connect Wi-Fi Bridge App · August Con…
- CVE-2020-22481An issue was discovered in HFish 0.5.1.
- CVE-2019-20920Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution.handlebars
- CVE-2019-20921bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS).bootstrap-select
- CVE-2019-20922Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching.handlebars
- CVE-2020-26149NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.nats · nats.ws
- CVE-2020-15731Local Privilege Escalation in Bitdefender Engines (VA-8953)Bitdefender Engines
- CVE-2020-5132SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collisionSonicWall SMA100 · SonicWall SMA1000 +1
- CVE-2020-26157Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing.
- CVE-2020-26158Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered.
- CVE-2020-22842CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php.
- CVE-2020-14378An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cyclesdpdk