# CVEs published 2020-10-01

44 CVEs were published on October 1, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-5387](https://cve.now/CVE-2020-5387.md): Dell XPS 13 9370 BIOS versions prior to 1.13.1 contains an Improper Exception Handling vulnerability. (CVSS 2.3, Dell CPG BIOS)
- [CVE-2020-9491](https://cve.now/CVE-2020-9491.md): In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by pr (no CVSS, Apache NiFi · org.apache.nifi:nifi)
- [CVE-2020-13940](https://cve.now/CVE-2020-13940.md): In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trust (no CVSS, Apache NiFi · org.apache.nifi:nifi)
- [CVE-2020-9487](https://cve.now/CVE-2020-9487.md): In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a req (no CVSS, Apache NiFi · org.apache.nifi:nifi)
- [CVE-2020-9486](https://cve.now/CVE-2020-9486.md): In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. (no CVSS, Apache NiFi · org.apache.nifi:nifi-stateless)
- [CVE-2020-5788](https://cve.now/CVE-2020-5788.md): Relative Path Traversal in Teltonika firmware TRB2\_R\_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk vi (no CVSS, Teltonika Gateway TRB245)
- [CVE-2020-5787](https://cve.now/CVE-2020-5787.md): Relative Path Traversal in Teltonika firmware TRB2\_R\_00.02.04.3 allows a remote, authenticated attacker to delete arbitrary files on disk vi (no CVSS, Teltonika Gateway TRB245)
- [CVE-2020-5785](https://cve.now/CVE-2020-5785.md): Insufficient output sanitization in Teltonika firmware TRB2\_R\_00.02.04.3 allows an unauthenticated attacker to conduct reflected cross-site (no CVSS, Teltonika Gateway TRB245)
- [CVE-2020-5786](https://cve.now/CVE-2020-5786.md): Cross-site request forgery in Teltonika firmware TRB2\_R\_00.02.04.3 allows a remote attacker to perform sensitive application actions by tric (no CVSS, Teltonika Gateway TRB245)
- [CVE-2020-5789](https://cve.now/CVE-2020-5789.md): Relative Path Traversal in Teltonika firmware TRB2\_R\_00.02.04.3 allows a remote, authenticated attacker to read the contents of arbitrary fi (no CVSS, Teltonika Gateway TRB245)
- [CVE-2020-5784](https://cve.now/CVE-2020-5784.md): Server-Side Request Forgery in Teltonika firmware TRB2\_R\_00.02.04.3 allows a low privileged user to cause the application to perform HTTP GE (no CVSS, Teltonika Gateway TRB245)
- [CVE-2020-14223](https://cve.now/CVE-2020-14223.md): HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). (no CVSS, HCL Digital Experience)
- [CVE-2020-11979](https://cve.now/CVE-2020-11979.md): As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was al (no CVSS, Apache Ant · gradle +1)
- [CVE-2020-15227](https://cve.now/CVE-2020-15227.md): Remote Code Execution vulnerability (CVSS 8.7, nette application · nette/application)
- [CVE-2020-15533](https://cve.now/CVE-2020-15533.md): In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalation module is vulnera (no CVSS)
- [CVE-2020-15663](https://cve.now/CVE-2020-15663.md): If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location wi (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-15664](https://cve.now/CVE-2020-15664.md): By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-15665](https://cve.now/CVE-2020-15665.md): Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. (no CVSS, Mozilla Firefox)
- [CVE-2020-15666](https://cve.now/CVE-2020-15666.md): When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the M (no CVSS, Mozilla Firefox)
- [CVE-2020-15667](https://cve.now/CVE-2020-15667.md): When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading t (no CVSS, Mozilla Firefox)
- [CVE-2020-15668](https://cve.now/CVE-2020-15668.md): A lock was missing when accessing a data structure and importing certificate information into the trust database. (no CVSS, Mozilla Firefox)
- [CVE-2020-15669](https://cve.now/CVE-2020-15669.md): When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird)
- [CVE-2020-15670](https://cve.now/CVE-2020-15670.md): Mozilla developers reported memory safety bugs present in Firefox for Android 79. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-15671](https://cve.now/CVE-2020-15671.md): When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input (no CVSS, Mozilla Firefox for Android)
- [CVE-2020-15673](https://cve.now/CVE-2020-15673.md): Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-15674](https://cve.now/CVE-2020-15674.md): Mozilla developers reported memory safety bugs present in Firefox 80. (no CVSS, Mozilla Firefox)
- [CVE-2020-15675](https://cve.now/CVE-2020-15675.md): When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. (no CVSS, Mozilla Firefox)
- [CVE-2020-15676](https://cve.now/CVE-2020-15676.md): Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed a (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-15677](https://cve.now/CVE-2020-15677.md): By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-15678](https://cve.now/CVE-2020-15678.md): When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-25200](https://cve.now/CVE-2020-25200.md): Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. (no CVSS)
- [CVE-2020-15228](https://cve.now/CVE-2020-15228.md): Environment Variable Injection in GitHub Actions (CVSS 3.5, actions toolkit · @actions/core)
- [CVE-2019-19393](https://cve.now/CVE-2019-19393.md): The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00\_2 to V3.15.70\_4 devices fails to sanitize user input on the system configur (no CVSS)
- [CVE-2020-25018](https://cve.now/CVE-2020-25018.md): Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization. (no CVSS)
- [CVE-2020-25017](https://cve.now/CVE-2020-25017.md): Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. (no CVSS)
- [CVE-2020-16844](https://cve.now/CVE-2020-16844.md): In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildca (no CVSS, istio.io/istio)
- [CVE-2020-24620](https://cve.now/CVE-2020-24620.md): Unisys Stealth(core) before 4.0.134 stores passwords in a recoverable format. (no CVSS)
- [CVE-2020-4576](https://cve.now/CVE-2020-4576.md): IBM WebSphere Application Server 7.5, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a spe (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2020-25990](https://cve.now/CVE-2020-25990.md): WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display\_name' in /websitebaker/admin/preferences/save.php. (no CVSS)
- [CVE-2020-24860](https://cve.now/CVE-2020-24860.md): CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the (no CVSS)
- [CVE-2020-24861](https://cve.now/CVE-2020-24861.md): GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create (no CVSS)
- [CVE-2020-8109](https://cve.now/CVE-2020-8109.md): Bitdefender ace.xmd parser out-of-bounds write (VA-8772) (CVSS 5.9, Bitdefender Engines)
- [CVE-2019-20903](https://cve.now/CVE-2019-20903.md): The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScrip (no CVSS, Atlassian @atlaskit/editor-core · @atlaskit/editor-core)
- [CVE-2019-20902](https://cve.now/CVE-2019-20902.md): Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. (no CVSS, Atlassian Crowd)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.