CVEs published October 1, 2020
44 CVEs were published on October 1, 2020: 0 critical, 1 high.
- Published
- 44
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 2
- Unrated
- 39
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- Mozilla Firefox · Mozilla Thunderbird
- 7
- Mozilla Firefox
- 6
- Teltonika Gateway TRB245
- 6
- Apache NiFi · org.apache.nifi:nifi
- 3
- actions toolkit · @actions/core
- 1
- Apache Ant · gradle +1
- 1
- Apache NiFi · org.apache.nifi:nifi-stateless
- 1
- Atlassian @atlaskit/editor-core · @atlaskit/editor-core
- 1
- Atlassian Crowd
- 1
- Bitdefender Engines
- 1
High 1
Medium, low and unrated 43
- CVE-2020-5387Dell XPS 13 9370 BIOS versions prior to 1.13.1 contains an Improper Exception Handling vulnerability.Dell CPG BIOS
- CVE-2020-9491In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by prApache NiFi · org.apache.nifi:nifi
- CVE-2020-13940In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trustApache NiFi · org.apache.nifi:nifi
- CVE-2020-9487In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a reqApache NiFi · org.apache.nifi:nifi
- CVE-2020-9486In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values.Apache NiFi · org.apache.nifi:nifi-stateless
- CVE-2020-5788Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk viTeltonika Gateway TRB245
- CVE-2020-5787Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk viTeltonika Gateway TRB245
- CVE-2020-5785Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct reflected cross-site Teltonika Gateway TRB245
- CVE-2020-5786Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a remote attacker to perform sensitive application actions by tricTeltonika Gateway TRB245
- CVE-2020-5789Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to read the contents of arbitrary fiTeltonika Gateway TRB245
- CVE-2020-5784Server-Side Request Forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a low privileged user to cause the application to perform HTTP GETeltonika Gateway TRB245
- CVE-2020-14223HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS).HCL Digital Experience
- CVE-2020-11979As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was alApache Ant · gradle +1
- CVE-2020-15533In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnera
- CVE-2020-15663If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location wiMozilla Firefox · Mozilla Thunderbird
- CVE-2020-15664By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTriggerMozilla Firefox · Mozilla Thunderbird
- CVE-2020-15665Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page.Mozilla Firefox
- CVE-2020-15666When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MMozilla Firefox
- CVE-2020-15667When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading tMozilla Firefox
- CVE-2020-15668A lock was missing when accessing a data structure and importing certificate information into the trust database.Mozilla Firefox
- CVE-2020-15669When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified.Mozilla Firefox ESR · Mozilla Thunderbird
- CVE-2020-15670Mozilla developers reported memory safety bugs present in Firefox for Android 79.Mozilla Firefox · Mozilla Thunderbird
- CVE-2020-15671When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the inputMozilla Firefox for Android
- CVE-2020-15673Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2.Mozilla Firefox · Mozilla Thunderbird
- CVE-2020-15674Mozilla developers reported memory safety bugs present in Firefox 80.Mozilla Firefox
- CVE-2020-15675When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash.Mozilla Firefox
- CVE-2020-15676Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed aMozilla Firefox · Mozilla Thunderbird
- CVE-2020-15677By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to Mozilla Firefox · Mozilla Thunderbird
- CVE-2020-15678When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free.Mozilla Firefox · Mozilla Thunderbird
- CVE-2020-25200Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts.
- CVE-2020-15228Environment Variable Injection in GitHub Actionsactions toolkit · @actions/core
- CVE-2019-19393The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configur
- CVE-2020-25018Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization.
- CVE-2020-25017Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers.
- CVE-2020-16844In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcaistio.io/istio
- CVE-2020-24620Unisys Stealth(core) before 4.0.134 stores passwords in a recoverable format.
- CVE-2020-4576IBM WebSphere Application Server 7.5, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a speIBM WebSphere Application Server
- CVE-2020-25990WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php.
- CVE-2020-24860CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the
- CVE-2020-24861GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create
- CVE-2020-8109Bitdefender ace.xmd parser out-of-bounds write (VA-8772)Bitdefender Engines
- CVE-2019-20903The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScripAtlassian @atlaskit/editor-core · @atlaskit/editor-core
- CVE-2019-20902Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP.Atlassian Crowd