# CVEs published 2020-10-05 23 CVEs were published on October 5, 2020: 1 critical, 1 high. Days are UTC. - [CVE-2020-15237](https://cve.now/CVE-2020-15237.md): Timing attack in Shrine (CVSS 5.9, shrinerb shrine · shrine) - [CVE-2020-16226](https://cve.now/CVE-2020-16226.md): Mitsubishi Electric Multiple Products (no CVSS, Mitsubishi Electric QJ71MES96 · Mitsubishi Electric QJ7… +54) - [CVE-2020-24231](https://cve.now/CVE-2020-24231.md): Symmetric DS \<3.12.0 uses mx4j to provide access to JMX over HTTP. (no CVSS) - [CVE-2020-15235](https://cve.now/CVE-2020-15235.md): Sensitive data exposure in RACTF (CVSS 5.9, ractf core) - [CVE-2020-15236](https://cve.now/CVE-2020-15236.md): Directory Traversal in Wiki.js (CVSS 8.6, Requarks wiki) - [CVE-2020-6875](https://cve.now/CVE-2020-6875.md): A ZTE product is impacted by the improper access control vulnerability. (no CVSS, \) - [CVE-2020-26048](https://cve.now/CVE-2020-26048.md): The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file within an image extension (no CVSS) - [CVE-2020-0571](https://cve.now/CVE-2020-0571.md): Improper conditions check in BIOS firmware for 8th Generation Intel(R) Core(TM) Processors and Intel(R) Pentium(R) Silver Processor Series m (no CVSS, Intel BIOS) - [CVE-2019-14556](https://cve.now/CVE-2019-14556.md): Improper initialization in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series P (no CVSS, Intel BIOS) - [CVE-2020-8671](https://cve.now/CVE-2020-8671.md): Insufficient control flow management in BIOS firmware 8th, 9th Generation Intel(R) Core(TM) Processors and Intel(R) Celeron(R) Processor 400 (no CVSS, Intel BIOS) - [CVE-2019-14558](https://cve.now/CVE-2019-14558.md): Insufficient control flow management in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & (no CVSS, Intel BIOS) - [CVE-2020-12302](https://cve.now/CVE-2020-12302.md): Improper permissions in the Intel(R) Driver & Support Assistant before version 20.7.26.7 may allow an authenticated user to potentially enab (no CVSS, Intel(R) Driver & Support Assistant) - [CVE-2019-14557](https://cve.now/CVE-2019-14557.md): Buffer overflow in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processor (no CVSS, Intel BIOS) - [CVE-2020-26061](https://cve.now/CVE-2020-26061.md): ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. (no CVSS) - [CVE-2020-4493](https://cve.now/CVE-2020-4493.md): IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow an attacker to bypass authentication and issue commands using a specially crafted HT (CVSS 9.8, IBM Maximo Asset Management) - [CVE-2020-25635](https://cve.now/CVE-2020-25635.md): A flaw was found in Ansible Base when using the aws\_ssm connection plugin as garbage collector is not happening after playbook run is comple (CVSS 5.0, AWS Community Community Collections · ansible) - [CVE-2020-8182](https://cve.now/CVE-2020-8182.md): Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had t (no CVSS, Nextcloud Deck) - [CVE-2020-8223](https://cve.now/CVE-2020-8223.md): A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they (no CVSS, Nextcloud Server) - [CVE-2020-8235](https://cve.now/CVE-2020-8235.md): Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments. (no CVSS, Nextcloud Deck app) - [CVE-2020-8228](https://cve.now/CVE-2020-8228.md): A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times. (no CVSS, Nextcloud Preferred Provider) - [CVE-2020-25636](https://cve.now/CVE-2020-25636.md): A flaw was found in Ansible Base when using the aws\_ssm connection plugin as there is no namespace separation for file transfers. (CVSS 6.6, AWS Community Community Collections) - [CVE-2020-26166](https://cve.now/CVE-2020-26166.md): The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web scri (no CVSS) - [CVE-2020-7709](https://cve.now/CVE-2020-7709.md): Prototype Pollution (CVSS 6.0, json-pointer · org.webjars.npm:json-pointer) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-10-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.