CVEs published October 6, 2020
72 CVEs were published on October 6, 2020: 1 critical, 5 high.
- Published
- 72
- Critical
- 1
- High
- 5
- Medium
- 7
- Low
- 1
- Unrated
- 58
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- GitLab
- 3
- "HCL AppScan Enterprise "
- 2
- Crafter Software Crafter CMS · org.craftercms:crafter-studio
- 2
- electron
- 2
- Facebook WhatsApp for Android · Facebook WhatsApp Business…
- 2
- Facebook WhatsApp for iOS · Facebook WhatsApp Business for…
- 2
- kernel
- 2
- MPD: FreeBSD PPP daemon
- 2
- Atlassian Jira Server
- 1
- CMONOS Co. CMONOS.JP
- 1
Critical 1
High 5
- CVE-2020-13343An issue has been discovered in GitLab affecting all versions starting from 11.2.GitLab
- CVE-2020-15174Unpreventable top-level navigation in Electronelectron
- CVE-2020-7740Server-side Request Forgery (SSRF)node-pdf-generator
- CVE-2020-7739Server-side Request Forgery (SSRF)phantomjs-seo
- CVE-2020-8782ALEOS LAN-Side RPC Service Remote Code Execution
Medium, low and unrated 66
- CVE-2020-14183Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's SupportAtlassian Jira Server
- CVE-2020-16267Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA mo
- CVE-2020-15927Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP mo
- CVE-2020-26600An issue was discovered on Samsung mobile devices with Q(10.0) software.
- CVE-2020-26601An issue was discovered in DirEncryptService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
- CVE-2020-26602An issue was discovered in EthernetNetwork on Samsung mobile devices with O(8.1), P(9.0), Q(10.0), and R(11.0) software.
- CVE-2020-26604An issue was discovered in SystemUI on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software.
- CVE-2020-26605An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software.
- CVE-2020-26606An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software.
- CVE-2020-26607An issue was discovered in TimaService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
- CVE-2020-26603An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
- CVE-2020-26599An issue was discovered on Samsung mobile devices with Q(10.0) software.
- CVE-2020-15239Directory Traversal in xmpp-http-uploadhorazont xmpp-http-upload · xmpp-http-upload
- CVE-2020-13333A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3.GitLab
- CVE-2020-13345An issue has been discovered in GitLab affecting all versions starting from 10.8.GitLab
- CVE-2020-26597An issue was discovered on LG mobile devices with Android OS 9.0 and 10 software.
- CVE-2020-26598An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, and 9.0 software.
- CVE-2020-15215Context isolation bypass in Electronelectron
- CVE-2020-1907A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior Facebook WhatsApp for Android · Facebook WhatsApp Busine… +3
- CVE-2020-1904A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directoFacebook WhatsApp for iOS · Facebook WhatsApp Business for…
- CVE-2020-1905Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, wFacebook WhatsApp for Android
- CVE-2020-1906A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-oFacebook WhatsApp for Android · Facebook WhatsApp Business…
- CVE-2020-1902A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for AndFacebook WhatsApp for Android · Facebook WhatsApp Business…
- CVE-2020-1903An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61Facebook WhatsApp for iOS · Facebook WhatsApp Business for…
- CVE-2020-1901Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while proFacebook WhatsApp for iOS
- CVE-2019-4326"HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Securit"HCL AppScan Enterprise "
- CVE-2019-4325"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details.""HCL AppScan Enterprise "
- CVE-2020-24807The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execusocket.io-file
- CVE-2020-4528IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user, under special conditions, to IBM DataPower Gateway
- CVE-2019-4725IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting.IBM Security Access Manager Appliance
- CVE-2020-26582D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the IP JSON
- CVE-2020-26575In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop.
- CVE-2020-25863In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash.
- CVE-2020-25866In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for c
- CVE-2020-25862In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash.
- CVE-2020-26574Leostream Connection Broker 8.2.x is affected by stored XSS.
- CVE-2019-19200REDDOXX MailDepot 2032 2.2.1242 allows authenticated users to access the mailboxes of other users.
- CVE-2020-25803Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects.Crafter Software Crafter CMS · org.craftercms:crafter-studio
- CVE-2020-25742pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid poin
- CVE-2020-25743hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call
- CVE-2020-25802Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.Crafter Software Crafter CMS · org.craftercms:crafter-studio
- CVE-2020-8781Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process.
- CVE-2020-7466The PPP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted PPP authentication message to cause the MPD: FreeBSD PPP daemon
- CVE-2020-7465The L2TP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted L2TP control packet with AVP Q.931 CausMPD: FreeBSD PPP daemon
- CVE-2020-15598Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request.
- CVE-2020-25641A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7.kernel
- CVE-2020-24219An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97.
- CVE-2020-24218An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97.
- CVE-2020-24217An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders.
- CVE-2020-24216An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders.
- CVE-2020-24215An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders.
- CVE-2020-24214An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders.
- CVE-2020-23832A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthe
- CVE-2020-25986A Cross Site Request Forgery (CSRF) vulnerability in MonoCMS Blog 1.0 allows attackers to change the password of a user.
- CVE-2020-25987MonoCMS Blog 1.0 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog.
- CVE-1999-0199manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of
- CVE-2020-5632InfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.NEC InfoCage SiteShell series
- CVE-2020-5634ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versELECOM CO. ELECOM LAN routers
- CVE-2020-5631Stored cross-site scripting vulnerability in CMONOS.JP ver2.0.20191009 and earlier allows remote attackers to inject arbitrary script via unCMONOS Co. CMONOS.JP
- CVE-2020-26570The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.
- CVE-2020-26571The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.
- CVE-2020-26572The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.
- CVE-2020-25613An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1.webrick
- CVE-2020-25637A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about netlibvirt
- CVE-2020-25643A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7.kernel
- CVE-2020-25644A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session.wildfly-openssl · org.wildfly.openssl:wildfly-openssl-nativ…