CVEs published October 2, 2020
72 CVEs were published on October 2, 2020: 2 critical, 5 high.
- Published
- 72
- Critical
- 2
- High
- 5
- Medium
- 8
- Low
- 0
- Unrated
- 57
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- NVIDIA vGPU Software
- 7
- NVIDIA GPU Display Driver
- 4
- GitLab
- 2
- HPE KVM IP Console Switches
- 2
- mapfish-print · org.mapfish.print:print-lib +2
- 2
- ory fosite · github.com/ory/fosite
- 2
- PHP Group PHP
- 2
- Bitdefender Engines
- 1
- bmoor
- 1
- Cloud Foundry BOSH System Metrics Server
- 1
Critical 2
High 5
- CVE-2020-13337An issue has been discovered in GitLab affecting versions from 12.10 to 12.10.12 that allowed for a stored XSS payload to be added as a grouGitLab
- CVE-2020-15230Arbitrary file read un Vaporvapor
- CVE-2020-7738Arbitrary Code Executionshiba
- CVE-2020-7737Prototype Pollutionsafetydance
- CVE-2020-7736Prototype Pollutionbmoor
Medium, low and unrated 65
- CVE-2020-25776Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a symbolic link privilege escalation attack where an attacker could exploit aTrend Micro Antivirus for Mac
- CVE-2020-5988NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which allocated memory can be freed twice, which may lead to infoNVIDIA vGPU Software
- CVE-2020-5989NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which it can dereference a NULL pointer, which may lead to denialNVIDIA vGPU Software
- CVE-2020-5985NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data length is not validated, which may lead to taNVIDIA vGPU Software
- CVE-2020-5986NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampNVIDIA vGPU Software
- CVE-2020-5987NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin in which guest-supplied parameters remain writable by the guest afterNVIDIA vGPU Software
- CVE-2020-5983NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin and the host driver kernel module, in which the potential exists to wNVIDIA vGPU Software
- CVE-2020-5984NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin in which it may have the use-after-free vulnerability while freeing sNVIDIA vGPU Software
- CVE-2020-15233OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addressesory fosite · github.com/ory/fosite
- CVE-2020-15234Redirect URL matching ignores character casingory fosite · github.com/ory/fosite
- CVE-2020-26527An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7.
- CVE-2020-26526An issue was discovered in Damstra Smart Asset 2020.7.
- CVE-2020-26525Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter.
- CVE-2020-12676FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Sig
- CVE-2020-13338An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2.GitLab
- CVE-2020-15589A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho
- CVE-2020-24397An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534.
- CVE-2020-24628A remote code injection vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.HPE KVM IP Console Switches
- CVE-2020-24627A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.HPE KVM IP Console Switches
- CVE-2020-24568An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1.
- CVE-2020-5981NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), in which a speNVIDIA GPU Display Driver
- CVE-2020-5982NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) scheduler, in which the soNVIDIA GPU Display Driver
- CVE-2020-5979NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which a user is presentedNVIDIA GPU Display Driver
- CVE-2020-5980NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in multiple components in which a securely loaded system DLL will NVIDIA GPU Display Driver
- CVE-2020-26541The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism.
- CVE-2020-5422UAA password may appear in BOSH System Metrics Server process argumentsCloud Foundry BOSH System Metrics Server
- CVE-2020-24356Local Privilege Escalation in cloudflaredcloudflared · github.com/cloudflare/cloudflared
- CVE-2020-7070PHP parses encoded cookie names so malicious `__Host-` cookies can be sentPHP Group PHP
- CVE-2020-7069Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVPHP Group PHP
- CVE-2020-18191GetSimpleCMS-3.3.15 is affected by directory traversal.
- CVE-2020-18190Bludit v3.8.1 is affected by directory traversal.
- CVE-2020-18185class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment.
- CVE-2020-18184In PluxXml V5.7,the theme edit function /PluXml/core/admin/parametres_edittpl.php allows remote attackers to execute arbitrary PHP code by p
- CVE-2020-25623Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal.
- CVE-2020-8110Bitdefender ceva_emu.cvd module denial-of-service (VA-8766)Bitdefender Engines
- CVE-2020-13168SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.
- CVE-2020-26135Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.
- CVE-2020-26134Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.
- CVE-2020-26124openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.
- CVE-2020-25741fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.
- CVE-2020-24698An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used.
- CVE-2020-24697An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used.
- CVE-2020-24696An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used.
- CVE-2020-17482An issue has been found in PowerDNS Authoritative Server before 4.3.1 where an authorized user with the ability to insert crafted records in
- CVE-2020-17382The MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overflow (0x80102040, 0x80102044, 0x80102050,and 0x80102054).
- CVE-2020-14294An issue was discovered in Secudos Qiata FTA 1.70.19.
- CVE-2020-14293conf_datetime in Secudos DOMOS 5.8 allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field
- CVE-2020-12127An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an at
- CVE-2020-12126Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak
- CVE-2020-12125A remote buffer overflow vulnerability in the /cgi-bin/makeRequest.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker
- CVE-2020-12124A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an atta
- CVE-2020-12123CSRF vulnerabilities in the /cgi-bin/ directory of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to remotely access router endpoi
- CVE-2019-19199REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not invalidated upon a logout.
- CVE-2020-26534An issue was discovered in Foxit Reader and PhantomPDF before 10.1.
- CVE-2020-26535An issue was discovered in Foxit Reader and PhantomPDF before 10.1.
- CVE-2020-26536An issue was discovered in Foxit Reader and PhantomPDF before 10.1.
- CVE-2020-26537An issue was discovered in Foxit Reader and PhantomPDF before 10.1.
- CVE-2020-26538An issue was discovered in Foxit Reader and PhantomPDF before 10.1.
- CVE-2020-26539An issue was discovered in Foxit Reader and PhantomPDF before 10.1.
- CVE-2020-26540An issue was discovered in Foxit Reader and PhantomPDF before 4.1 on macOS.
- CVE-2020-26524CodeLathe FileCloud before 20.2.0.11915 allows username enumeration.
- CVE-2020-26523Froala Editor before 3.2.2 allows XSS via pasted content.froala/wysiwyg-editor
- CVE-2020-26519Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a denial of service.
- CVE-2020-26518Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/include/chart_genera
- CVE-2020-26511The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token.