# CVEs published 2020-10-08

54 CVEs were published on October 8, 2020: 2 critical, 7 high. Days are UTC.

- [CVE-2020-15243](https://cve.now/CVE-2020-15243.md): WebApi Authentication attribute missing in Smartstore (CVSS 9.1, SmartStoreNET)
- [CVE-2019-19115](https://cve.now/CVE-2019-19115.md): An escalation of privilege vulnerability in Nahimic APO Software Component Driver 1.4.2, 1.5.0, 1.5.1, 1.6.1 and 1.6.2 allows an attacker to (no CVSS)
- [CVE-2020-15241](https://cve.now/CVE-2020-15241.md): Cross-Site Scripting in TYPO3 Fluid Engine (CVSS 4.7, TYPO3 Fluid · typo3fluid/fluid +2)
- [CVE-2020-26894](https://cve.now/CVE-2020-26894.md): LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in the folder of the vuln (no CVSS)
- [CVE-2020-15242](https://cve.now/CVE-2020-15242.md): Open Redirect in Next.js (CVSS 4.7, vercel next.js · next)
- [CVE-2020-1914](https://cve.now/CVE-2020-1914.md): A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7f (no CVSS, Facebook Hermes · hermes-engine)
- [CVE-2020-9048](https://cve.now/CVE-2020-9048.md): victor Web Client - Arbitrary File Deletion Vulnerability (CVSS 7.1, Johnson Controls victor Web Client)
- [CVE-2020-10816](https://cve.now/CVE-2020-10816.md): Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestP (no CVSS)
- [CVE-2020-26802](https://cve.now/CVE-2020-26802.md): forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET re (no CVSS)
- [CVE-2020-5389](https://cve.now/CVE-2020-5389.md): Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an information disc (CVSS 9.0, Dell OMIMSSC)
- [CVE-2020-13339](https://cve.now/CVE-2020-13339.md): An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. (CVSS 5.5, GitLab)
- [CVE-2020-13340](https://cve.now/CVE-2020-13340.md): An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log (CVSS 8.7, GitLab)
- [CVE-2020-13344](https://cve.now/CVE-2020-13344.md): An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. (CVSS 5.7, GitLab)
- [CVE-2020-15646](https://cve.now/CVE-2020-15646.md): If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechan (no CVSS, Mozilla Thunderbird)
- [CVE-2020-24301](https://cve.now/CVE-2020-24301.md): Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allo (no CVSS)
- [CVE-2020-4799](https://cve.now/CVE-2020-4799.md): IBM Informix spatial 14.10 could allow a local user to execute commands as a privileged user due to an out of bounds write vulnerability. (CVSS 7.8, IBM Informix Dynamic Server)
- [CVE-2020-4280](https://cve.now/CVE-2020-4280.md): IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of (CVSS 6.3, IBM QRadar SIEM)
- [CVE-2019-4545](https://cve.now/CVE-2019-4545.md): IBM QRadar SIEM 7.3 and 7.4 when configured to use Active Directory Authentication may be susceptible to spoofing attacks. (CVSS 7.5, IBM QRadar SIEM)
- [CVE-2020-2298](https://cve.now/CVE-2020-2298.md): Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Nerrvana Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2296](https://cve.now/CVE-2020-2296.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared obj (no CVSS, Jenkins project Jenkins Shared Objects Plugin · org.jenkins…)
- [CVE-2020-2297](https://cve.now/CVE-2020-2297.md): Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controlle (no CVSS, Jenkins project Jenkins SMS Notification Plugin · com.hoiio…)
- [CVE-2020-2294](https://cve.now/CVE-2020-2294.md): Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with (no CVSS, Jenkins project Jenkins Maven Cascade Release Plugin · com.…)
- [CVE-2020-2295](https://cve.now/CVE-2020-2295.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascad (no CVSS, Jenkins project Jenkins Maven Cascade Release Plugin · com.…)
- [CVE-2020-2291](https://cve.now/CVE-2020-2291.md): Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins con (no CVSS, Jenkins project Jenkins couchdb-statistics Plugin · org.jen…)
- [CVE-2020-2292](https://cve.now/CVE-2020-2292.md): Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting ( (no CVSS, Jenkins project Jenkins Release Plugin · org.jenkins-ci.plu…)
- [CVE-2020-2293](https://cve.now/CVE-2020-2293.md): Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller. (no CVSS, Jenkins project Jenkins Persona Plugin · org.jenkins-ci.plu…)
- [CVE-2020-2289](https://cve.now/CVE-2020-2289.md): Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site (no CVSS, Jenkins project Jenkins Active Choices Plugin · org.biouno:…)
- [CVE-2020-2290](https://cve.now/CVE-2020-2290.md): Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, res (no CVSS, Jenkins project Jenkins Active Choices Plugin · org.biouno:…)
- [CVE-2020-2287](https://cve.now/CVE-2020-2287.md): Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths than the Stapler web (no CVSS, Jenkins project Jenkins Audit Trail Plugin · org.jenkins-ci…)
- [CVE-2020-2288](https://cve.now/CVE-2020-2288.md): In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to (no CVSS, Jenkins project Jenkins Audit Trail Plugin · org.jenkins-ci…)
- [CVE-2020-2286](https://cve.now/CVE-2020-2286.md): Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is c (no CVSS, Jenkins project Jenkins Role-based Authorization Strategy P…)
- [CVE-2020-25273](https://cve.now/CVE-2020-25273.md): In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or passw (no CVSS)
- [CVE-2020-25262](https://cve.now/CVE-2020-25262.md): PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted. (no CVSS, pyrocms/pyrocms)
- [CVE-2020-25263](https://cve.now/CVE-2020-25263.md): PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary plugin (no CVSS, pyrocms/pyrocms)
- [CVE-2020-25270](https://cve.now/CVE-2020-25270.md): PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, or City. (no CVSS)
- [CVE-2020-25271](https://cve.now/CVE-2020-25271.md): PHPGurukul hospital-management-system-in-php 4.0 allows XSS via admin/patient-search.php, doctor/search.php, book-appointment.php, doctor/ap (no CVSS)
- [CVE-2020-25272](https://cve.now/CVE-2020-25272.md): In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in book\_now.php. (no CVSS)
- [CVE-2020-26567](https://cve.now/CVE-2020-26567.md): An issue was discovered on D-Link DSR-250N before 3.17B devices. (no CVSS)
- [CVE-2020-3602](https://cve.now/CVE-2020-3602.md): Cisco StarOS Privilege Escalation Vulnerability (CVSS 6.3, Cisco ASR 5000 Series Software)
- [CVE-2020-3601](https://cve.now/CVE-2020-3601.md): Cisco StarOS Privilege Escalation Vulnerability (CVSS 4.4, Cisco ASR 5000 Series Software)
- [CVE-2020-3598](https://cve.now/CVE-2020-3598.md): Cisco Vision Dynamic Signage Director Missing Authentication Vulnerability (CVSS 6.5, Cisco Vision Dynamic Signage Director)
- [CVE-2020-3597](https://cve.now/CVE-2020-3597.md): Cisco Nexus Data Broker Software Path Traversal Vulnerability (CVSS 5.4, Cisco Nexus Data Broker)
- [CVE-2020-3596](https://cve.now/CVE-2020-3596.md): Cisco Expressway Series and TelePresence Video Communication Server Denial of Service Vulnerability (CVSS 5.9, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2020-3589](https://cve.now/CVE-2020-3589.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2020-3568](https://cve.now/CVE-2020-3568.md): Cisco Email Security Appliance URL Filtering Bypass Vulnerability (CVSS 5.8, Cisco Email Security Appliance)
- [CVE-2020-3567](https://cve.now/CVE-2020-3567.md): Cisco Industrial Network Director Denial of Service Vulnerability (CVSS 6.5, Cisco Industrial Network Director)
- [CVE-2020-3544](https://cve.now/CVE-2020-3544.md): Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service Vulnerability (CVSS 8.8, Cisco Video Surveillance 8000 Series IP Cameras)
- [CVE-2020-3543](https://cve.now/CVE-2020-3543.md): Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Memory Leak Vulnerability (CVSS 6.5, Cisco Video Surveillance 8000 Series IP Cameras)
- [CVE-2020-3536](https://cve.now/CVE-2020-3536.md): Cisco SD-WAN vManage Cross-Site Scripting Vulnerability (CVSS 6.4, Cisco SD-WAN vManage)
- [CVE-2020-3535](https://cve.now/CVE-2020-3535.md): Cisco Webex Teams Client for Windows DLL Hijacking Vulnerability (CVSS 7.8, Cisco Webex Teams)
- [CVE-2020-3467](https://cve.now/CVE-2020-3467.md): Cisco Identity Services Engine Authorization Bypass Vulnerability (CVSS 7.7, Cisco Identity Services Engine Software)
- [CVE-2020-3320](https://cve.now/CVE-2020-3320.md): Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Firepower Management Center)
- [CVE-2020-12400](https://cve.now/CVE-2020-12400.md): When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible tim (no CVSS, Mozilla Firefox)
- [CVE-2020-12401](https://cve.now/CVE-2020-12401.md): During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resultin (no CVSS, Mozilla Firefox)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.