# CVEs published 2020-10-07

28 CVEs were published on October 7, 2020: 2 critical, 4 high. Days are UTC.

- [CVE-2020-15501](https://cve.now/CVE-2020-15501.md): Smarter Coffee Maker before 2nd generation allows firmware replacement without authentication or authorization. (no CVSS)
- [CVE-2020-25867](https://cve.now/CVE-2020-25867.md): SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. (no CVSS)
- [CVE-2020-25768](https://cve.now/CVE-2020-25768.md): Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. (no CVSS, contao/core-bundle · contao/contao)
- [CVE-2020-15226](https://cve.now/CVE-2020-15226.md): SQL Injection in GLPI Search API (CVSS 5.0, glpi-project glpi)
- [CVE-2020-15217](https://cve.now/CVE-2020-15217.md): User data exposure in GLPI (CVSS 5.3, glpi-project glpi)
- [CVE-2020-15177](https://cve.now/CVE-2020-15177.md): Unauthenticated Stored XSS in GLPI (CVSS 8.0, glpi-project glpi)
- [CVE-2020-15176](https://cve.now/CVE-2020-15176.md): SQL injection in GLPI (CVSS 8.7, glpi-project glpi)
- [CVE-2020-15175](https://cve.now/CVE-2020-15175.md): Unauthenticated File Deletion in GLPI (CVSS 7.4, glpi-project glpi)
- [CVE-2020-7316](https://cve.now/CVE-2020-7316.md): File and Removable Media Protection update fixes one vulnerability (CVSS 6.6, McAfee File & Removable Media Protection)
- [CVE-2020-26164](https://cve.now/CVE-2020-26164.md): In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large am (no CVSS)
- [CVE-2020-26880](https://cve.now/CVE-2020-26880.md): Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf conf (no CVSS)
- [CVE-2020-26876](https://cve.now/CVE-2020-26876.md): The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materi (no CVSS)
- [CVE-2020-17551](https://cve.now/CVE-2020-17551.md): ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution. (no CVSS, impresscms/impresscms)
- [CVE-2020-13342](https://cve.now/CVE-2020-13342.md): An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmat (CVSS 2.7, GitLab)
- [CVE-2020-26870](https://cve.now/CVE-2020-26870.md): Cure53 DOMPurify before 2.0.17 allows mutation XSS. (no CVSS, dompurify)
- [CVE-2020-26596](https://cve.now/CVE-2020-26596.md): The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code (no CVSS)
- [CVE-2020-24246](https://cve.now/CVE-2020-24246.md): Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from (no CVSS)
- [CVE-2019-16160](https://cve.now/CVE-2019-16160.md): An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service. (no CVSS)
- [CVE-2020-11800](https://cve.now/CVE-2020-11800.md): Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. (CVSS 9.0)
- [CVE-2020-14355](https://cve.now/CVE-2020-14355.md): Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14 (no CVSS, spice)
- [CVE-2020-24722](https://cve.now/CVE-2020-24722.md): An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications (no CVSS)
- [CVE-2020-25343](https://cve.now/CVE-2020-25343.md): Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields\['bo (no CVSS)
- [CVE-2020-13346](https://cve.now/CVE-2020-13346.md): Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to a (CVSS 6.5, GitLab)
- [CVE-2020-13334](https://cve.now/CVE-2020-13334.md): In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the co (CVSS 5.9, GitLab)
- [CVE-2020-13347](https://cve.now/CVE-2020-13347.md): A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. (CVSS 9.1, GitLab Runner)
- [CVE-2020-13335](https://cve.now/CVE-2020-13335.md): Improper group membership validation when deleting a user account in GitLab \>=7.12 allows a user to delete own account without deleting/tran (CVSS 4.3, GitLab)
- [CVE-2020-25985](https://cve.now/CVE-2020-25985.md): MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. (no CVSS)
- [CVE-2020-7742](https://cve.now/CVE-2020-7742.md): Prototype Pollution (CVSS 7.5, simpl-schema)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.