# CVEs published 2020-10-06 72 CVEs were published on October 6, 2020: 1 critical, 5 high. Days are UTC. - [CVE-2020-14183](https://cve.now/CVE-2020-14183.md): Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support (no CVSS, Atlassian Jira Server) - [CVE-2020-16267](https://cve.now/CVE-2020-16267.md): Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA mo (no CVSS) - [CVE-2020-15927](https://cve.now/CVE-2020-15927.md): Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP mo (no CVSS) - [CVE-2020-26600](https://cve.now/CVE-2020-26600.md): An issue was discovered on Samsung mobile devices with Q(10.0) software. (no CVSS) - [CVE-2020-26601](https://cve.now/CVE-2020-26601.md): An issue was discovered in DirEncryptService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. (no CVSS) - [CVE-2020-26602](https://cve.now/CVE-2020-26602.md): An issue was discovered in EthernetNetwork on Samsung mobile devices with O(8.1), P(9.0), Q(10.0), and R(11.0) software. (no CVSS) - [CVE-2020-26604](https://cve.now/CVE-2020-26604.md): An issue was discovered in SystemUI on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. (no CVSS) - [CVE-2020-26605](https://cve.now/CVE-2020-26605.md): An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software. (no CVSS) - [CVE-2020-26606](https://cve.now/CVE-2020-26606.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. (no CVSS) - [CVE-2020-26607](https://cve.now/CVE-2020-26607.md): An issue was discovered in TimaService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. (no CVSS) - [CVE-2020-26603](https://cve.now/CVE-2020-26603.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. (no CVSS) - [CVE-2020-26599](https://cve.now/CVE-2020-26599.md): An issue was discovered on Samsung mobile devices with Q(10.0) software. (no CVSS) - [CVE-2020-15239](https://cve.now/CVE-2020-15239.md): Directory Traversal in xmpp-http-upload (CVSS 3.5, horazont xmpp-http-upload · xmpp-http-upload) - [CVE-2020-13333](https://cve.now/CVE-2020-13333.md): A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. (CVSS 4.3, GitLab) - [CVE-2020-13345](https://cve.now/CVE-2020-13345.md): An issue has been discovered in GitLab affecting all versions starting from 10.8. (CVSS 5.5, GitLab) - [CVE-2020-13343](https://cve.now/CVE-2020-13343.md): An issue has been discovered in GitLab affecting all versions starting from 11.2. (CVSS 7.5, GitLab) - [CVE-2020-26597](https://cve.now/CVE-2020-26597.md): An issue was discovered on LG mobile devices with Android OS 9.0 and 10 software. (no CVSS) - [CVE-2020-26598](https://cve.now/CVE-2020-26598.md): An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, and 9.0 software. (no CVSS) - [CVE-2020-15215](https://cve.now/CVE-2020-15215.md): Context isolation bypass in Electron (CVSS 5.6, electron) - [CVE-2020-1907](https://cve.now/CVE-2020-1907.md): A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior (no CVSS, Facebook WhatsApp for Android · Facebook WhatsApp Busine… +3) - [CVE-2020-1904](https://cve.now/CVE-2020-1904.md): A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directo (no CVSS, Facebook WhatsApp for iOS · Facebook WhatsApp Business for…) - [CVE-2020-1905](https://cve.now/CVE-2020-1905.md): Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, w (no CVSS, Facebook WhatsApp for Android) - [CVE-2020-1906](https://cve.now/CVE-2020-1906.md): A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-o (no CVSS, Facebook WhatsApp for Android · Facebook WhatsApp Business…) - [CVE-2020-1902](https://cve.now/CVE-2020-1902.md): A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for And (no CVSS, Facebook WhatsApp for Android · Facebook WhatsApp Business…) - [CVE-2020-1903](https://cve.now/CVE-2020-1903.md): An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 (no CVSS, Facebook WhatsApp for iOS · Facebook WhatsApp Business for…) - [CVE-2020-1901](https://cve.now/CVE-2020-1901.md): Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while pro (no CVSS, Facebook WhatsApp for iOS) - [CVE-2020-15174](https://cve.now/CVE-2020-15174.md): Unpreventable top-level navigation in Electron (CVSS 7.5, electron) - [CVE-2019-4326](https://cve.now/CVE-2019-4326.md): "HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Securit (no CVSS, "HCL AppScan Enterprise ") - [CVE-2019-4325](https://cve.now/CVE-2019-4325.md): "HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details." (no CVSS, "HCL AppScan Enterprise ") - [CVE-2020-24807](https://cve.now/CVE-2020-24807.md): The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execu (no CVSS, socket.io-file) - [CVE-2020-7740](https://cve.now/CVE-2020-7740.md): Server-side Request Forgery (SSRF) (CVSS 8.2, node-pdf-generator) - [CVE-2020-4528](https://cve.now/CVE-2020-4528.md): IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user, under special conditions, to (CVSS 5.9, IBM DataPower Gateway) - [CVE-2019-4725](https://cve.now/CVE-2019-4725.md): IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Access Manager Appliance) - [CVE-2020-26582](https://cve.now/CVE-2020-26582.md): D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the IP JSON (no CVSS) - [CVE-2020-7739](https://cve.now/CVE-2020-7739.md): Server-side Request Forgery (SSRF) (CVSS 8.2, phantomjs-seo) - [CVE-2020-26575](https://cve.now/CVE-2020-26575.md): In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. (no CVSS) - [CVE-2020-25863](https://cve.now/CVE-2020-25863.md): In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. (no CVSS) - [CVE-2020-25866](https://cve.now/CVE-2020-25866.md): In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for c (no CVSS) - [CVE-2020-25862](https://cve.now/CVE-2020-25862.md): In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. (no CVSS) - [CVE-2020-26574](https://cve.now/CVE-2020-26574.md): Leostream Connection Broker 8.2.x is affected by stored XSS. (no CVSS) - [CVE-2020-7741](https://cve.now/CVE-2020-7741.md): Cross-site Scripting (XSS) (CVSS 9.9, hellojs) - [CVE-2019-19200](https://cve.now/CVE-2019-19200.md): REDDOXX MailDepot 2032 2.2.1242 allows authenticated users to access the mailboxes of other users. (no CVSS) - [CVE-2020-25803](https://cve.now/CVE-2020-25803.md): Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects. (CVSS 4.2, Crafter Software Crafter CMS · org.craftercms:crafter-studio) - [CVE-2020-25742](https://cve.now/CVE-2020-25742.md): pci\_change\_irq\_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci\_get\_bus() might not return a valid poin (no CVSS) - [CVE-2020-25743](https://cve.now/CVE-2020-25743.md): hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide\_cancel\_dma\_sync call (no CVSS) - [CVE-2020-25802](https://cve.now/CVE-2020-25802.md): Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting. (CVSS 4.2, Crafter Software Crafter CMS · org.craftercms:crafter-studio) - [CVE-2020-8782](https://cve.now/CVE-2020-8782.md): ALEOS LAN-Side RPC Service Remote Code Execution (CVSS 7.5) - [CVE-2020-8781](https://cve.now/CVE-2020-8781.md): Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process. (no CVSS) - [CVE-2020-7466](https://cve.now/CVE-2020-7466.md): The PPP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted PPP authentication message to cause the (no CVSS, MPD: FreeBSD PPP daemon) - [CVE-2020-7465](https://cve.now/CVE-2020-7465.md): The L2TP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted L2TP control packet with AVP Q.931 Caus (no CVSS, MPD: FreeBSD PPP daemon) - [CVE-2020-15598](https://cve.now/CVE-2020-15598.md): Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. (no CVSS) - [CVE-2020-25641](https://cve.now/CVE-2020-25641.md): A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. (no CVSS, kernel) - [CVE-2020-24219](https://cve.now/CVE-2020-24219.md): An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. (no CVSS) - [CVE-2020-24218](https://cve.now/CVE-2020-24218.md): An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. (no CVSS) - [CVE-2020-24217](https://cve.now/CVE-2020-24217.md): An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. (no CVSS) - [CVE-2020-24216](https://cve.now/CVE-2020-24216.md): An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. (no CVSS) - [CVE-2020-24215](https://cve.now/CVE-2020-24215.md): An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. (no CVSS) - [CVE-2020-24214](https://cve.now/CVE-2020-24214.md): An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. (no CVSS) - [CVE-2020-23832](https://cve.now/CVE-2020-23832.md): A Persistent Cross-Site Scripting (XSS) vulnerability in message\_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthe (no CVSS) - [CVE-2020-25986](https://cve.now/CVE-2020-25986.md): A Cross Site Request Forgery (CSRF) vulnerability in MonoCMS Blog 1.0 allows attackers to change the password of a user. (no CVSS) - [CVE-2020-25987](https://cve.now/CVE-2020-25987.md): MonoCMS Blog 1.0 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog. (no CVSS) - [CVE-1999-0199](https://cve.now/CVE-1999-0199.md): manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of (no CVSS) - [CVE-2020-5632](https://cve.now/CVE-2020-5632.md): InfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0. (no CVSS, NEC InfoCage SiteShell series) - [CVE-2020-5634](https://cve.now/CVE-2020-5634.md): ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware vers (no CVSS, ELECOM CO. ELECOM LAN routers) - [CVE-2020-5631](https://cve.now/CVE-2020-5631.md): Stored cross-site scripting vulnerability in CMONOS.JP ver2.0.20191009 and earlier allows remote attackers to inject arbitrary script via un (no CVSS, CMONOS Co. CMONOS.JP) - [CVE-2020-26570](https://cve.now/CVE-2020-26570.md): The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc\_oberthur\_read\_file. (no CVSS) - [CVE-2020-26571](https://cve.now/CVE-2020-26571.md): The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc\_pkcs15emu\_gemsafeGPK\_init. (no CVSS) - [CVE-2020-26572](https://cve.now/CVE-2020-26572.md): The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos\_decipher. (no CVSS) - [CVE-2020-25613](https://cve.now/CVE-2020-25613.md): An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. (no CVSS, webrick) - [CVE-2020-25637](https://cve.now/CVE-2020-25637.md): A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about net (no CVSS, libvirt) - [CVE-2020-25643](https://cve.now/CVE-2020-25643.md): A flaw was found in the HDLC\_PPP module of the Linux kernel in versions before 5.9-rc7. (no CVSS, kernel) - [CVE-2020-25644](https://cve.now/CVE-2020-25644.md): A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. (no CVSS, wildfly-openssl · org.wildfly.openssl:wildfly-openssl-nativ…) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-10-06 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.