CVEs published October 7, 2020
28 CVEs were published on October 7, 2020: 2 critical, 4 high.
- Published
- 28
- Critical
- 2
- High
- 4
- Medium
- 6
- Low
- 1
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- glpi-project glpi
- 5
- GitLab
- 4
- contao/core-bundle · contao/contao
- 1
- dompurify
- 1
- GitLab Runner
- 1
- impresscms/impresscms
- 1
- McAfee File & Removable Media Protection
- 1
- simpl-schema
- 1
- spice
- 1
Critical 2
High 4
Medium, low and unrated 22
- CVE-2020-15501Smarter Coffee Maker before 2nd generation allows firmware replacement without authentication or authorization.
- CVE-2020-25867SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings.
- CVE-2020-25768Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation.contao/core-bundle · contao/contao
- CVE-2020-15226SQL Injection in GLPI Search APIglpi-project glpi
- CVE-2020-15217User data exposure in GLPIglpi-project glpi
- CVE-2020-7316File and Removable Media Protection update fixes one vulnerabilityMcAfee File & Removable Media Protection
- CVE-2020-26164In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large am
- CVE-2020-26880Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf conf
- CVE-2020-26876The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materi
- CVE-2020-17551ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.impresscms/impresscms
- CVE-2020-13342An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending ConfirmatGitLab
- CVE-2020-26870Cure53 DOMPurify before 2.0.17 allows mutation XSS.dompurify
- CVE-2020-26596The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code
- CVE-2020-24246Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from
- CVE-2019-16160An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.
- CVE-2020-14355Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14spice
- CVE-2020-24722An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications
- CVE-2020-25343Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['bo
- CVE-2020-13346Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to aGitLab
- CVE-2020-13334In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the coGitLab
- CVE-2020-13335Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/tranGitLab
- CVE-2020-25985MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion.