CVEs published October 8, 2020
54 CVEs were published on October 8, 2020: 2 critical, 7 high.
- Published
- 54
- Critical
- 2
- High
- 7
- Medium
- 16
- Low
- 0
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- GitLab
- 3
- Cisco ASR 5000 Series Software
- 2
- Cisco Identity Services Engine Software
- 2
- Cisco Video Surveillance 8000 Series IP Cameras
- 2
- IBM QRadar SIEM
- 2
- Jenkins project Jenkins Active Choices Plugin · org.biouno:…
- 2
- Jenkins project Jenkins Audit Trail Plugin · org.jenkins-ci…
- 2
- Jenkins project Jenkins Maven Cascade Release Plugin · com.…
- 2
- Mozilla Firefox
- 2
- pyrocms/pyrocms
- 2
Critical 2
High 7
- CVE-2020-9048victor Web Client - Arbitrary File Deletion VulnerabilityJohnson Controls victor Web Client
- CVE-2020-13340An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job LogGitLab
- CVE-2020-4799IBM Informix spatial 14.10 could allow a local user to execute commands as a privileged user due to an out of bounds write vulnerability.IBM Informix Dynamic Server
- CVE-2019-4545IBM QRadar SIEM 7.3 and 7.4 when configured to use Active Directory Authentication may be susceptible to spoofing attacks.IBM QRadar SIEM
- CVE-2020-3544Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service VulnerabilityCisco Video Surveillance 8000 Series IP Cameras
- CVE-2020-3535Cisco Webex Teams Client for Windows DLL Hijacking VulnerabilityCisco Webex Teams
- CVE-2020-3467Cisco Identity Services Engine Authorization Bypass VulnerabilityCisco Identity Services Engine Software
Medium, low and unrated 45
- CVE-2019-19115An escalation of privilege vulnerability in Nahimic APO Software Component Driver 1.4.2, 1.5.0, 1.5.1, 1.6.1 and 1.6.2 allows an attacker to
- CVE-2020-15241Cross-Site Scripting in TYPO3 Fluid EngineTYPO3 Fluid · typo3fluid/fluid +2
- CVE-2020-26894LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in the folder of the vuln
- CVE-2020-15242Open Redirect in Next.jsvercel next.js · next
- CVE-2020-1914A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fFacebook Hermes · hermes-engine
- CVE-2020-10816Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestP
- CVE-2020-26802forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET re
- CVE-2020-13339An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview.GitLab
- CVE-2020-13344An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2.GitLab
- CVE-2020-15646If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanMozilla Thunderbird
- CVE-2020-24301Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allo
- CVE-2020-4280IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization ofIBM QRadar SIEM
- CVE-2020-2298Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Nerrvana Plugin · org.jenkins-ci.pl…
- CVE-2020-2296A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objJenkins project Jenkins Shared Objects Plugin · org.jenkins…
- CVE-2020-2297Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controlleJenkins project Jenkins SMS Notification Plugin · com.hoiio…
- CVE-2020-2294Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers withJenkins project Jenkins Maven Cascade Release Plugin · com.…
- CVE-2020-2295A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascadJenkins project Jenkins Maven Cascade Release Plugin · com.…
- CVE-2020-2291Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins conJenkins project Jenkins couchdb-statistics Plugin · org.jen…
- CVE-2020-2292Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (Jenkins project Jenkins Release Plugin · org.jenkins-ci.plu…
- CVE-2020-2293Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller.Jenkins project Jenkins Persona Plugin · org.jenkins-ci.plu…
- CVE-2020-2289Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-siteJenkins project Jenkins Active Choices Plugin · org.biouno:…
- CVE-2020-2290Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resJenkins project Jenkins Active Choices Plugin · org.biouno:…
- CVE-2020-2287Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths than the Stapler web Jenkins project Jenkins Audit Trail Plugin · org.jenkins-ci…
- CVE-2020-2288In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to Jenkins project Jenkins Audit Trail Plugin · org.jenkins-ci…
- CVE-2020-2286Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is cJenkins project Jenkins Role-based Authorization Strategy P…
- CVE-2020-25273In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or passw
- CVE-2020-25262PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.pyrocms/pyrocms
- CVE-2020-25263PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary pluginpyrocms/pyrocms
- CVE-2020-25270PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, or City.
- CVE-2020-25271PHPGurukul hospital-management-system-in-php 4.0 allows XSS via admin/patient-search.php, doctor/search.php, book-appointment.php, doctor/ap
- CVE-2020-25272In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in book_now.php.
- CVE-2020-26567An issue was discovered on D-Link DSR-250N before 3.17B devices.
- CVE-2020-3602Cisco StarOS Privilege Escalation VulnerabilityCisco ASR 5000 Series Software
- CVE-2020-3601Cisco StarOS Privilege Escalation VulnerabilityCisco ASR 5000 Series Software
- CVE-2020-3598Cisco Vision Dynamic Signage Director Missing Authentication VulnerabilityCisco Vision Dynamic Signage Director
- CVE-2020-3597Cisco Nexus Data Broker Software Path Traversal VulnerabilityCisco Nexus Data Broker
- CVE-2020-3596Cisco Expressway Series and TelePresence Video Communication Server Denial of Service VulnerabilityCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2020-3589Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2020-3568Cisco Email Security Appliance URL Filtering Bypass VulnerabilityCisco Email Security Appliance
- CVE-2020-3567Cisco Industrial Network Director Denial of Service VulnerabilityCisco Industrial Network Director
- CVE-2020-3543Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Memory Leak VulnerabilityCisco Video Surveillance 8000 Series IP Cameras
- CVE-2020-3536Cisco SD-WAN vManage Cross-Site Scripting VulnerabilityCisco SD-WAN vManage
- CVE-2020-3320Cisco Firepower Management Center Cross-Site Scripting VulnerabilityCisco Firepower Management Center
- CVE-2020-12400When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timMozilla Firefox
- CVE-2020-12401During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resultinMozilla Firefox