CVEs published October 9, 2020
41 CVEs were published on October 9, 2020: 16 critical, 7 high. 1 is now in CISA KEV.
- Published
- 41
- Critical
- 16
- High
- 7
- Medium
- 9
- Low
- 3
- Unrated
- 6
- Now in CISA KEV
- 1
- Fix available
- 1
Most affected products
- Apache Calcite · org.apache.calcite:calcite-core +2
- 1
- Taurus-AN00B
- 1
Critical 16
- CVE-2020-26897Certain NETGEAR devices are affected by disclosure of administrative credentials.
- CVE-2020-26898NETGEAR RAX40 devices before 1.0.3.80 are affected by incorrect configuration of security settings.
- CVE-2020-26899Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2020-26900Certain NETGEAR devices are affected by disclosure of administrative credentials.
- CVE-2020-26901Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2020-26902Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2020-26903Certain NETGEAR devices are affected by disclosure of administrative credentials.
- CVE-2020-26904Certain NETGEAR devices are affected by disclosure of administrative credentials.
- CVE-2020-26905Certain NETGEAR devices are affected by disclosure of administrative credentials.
- CVE-2020-26906Certain NETGEAR devices are affected by disclosure of administrative credentials.
- CVE-2020-26907Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2020-26908Certain NETGEAR devices are affected by authentication bypass.
- CVE-2020-26919NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
- CVE-2020-26926Certain NETGEAR devices are affected by authentication bypass.
- CVE-2020-26927Certain NETGEAR devices are affected by authentication bypass.
- CVE-2020-26928Certain NETGEAR devices are affected by authentication bypass.
High 7
- CVE-2020-26909Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2020-26910Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2020-26911Certain NETGEAR devices are affected by lack of access control at the function level.
- CVE-2020-26912Certain NETGEAR devices are affected by CSRF.
- CVE-2020-26920Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2020-26921Certain NETGEAR devices are affected by authentication bypass.
- CVE-2020-26929Certain NETGEAR devices are affected by command injection by an authenticated user.
Medium, low and unrated 18
- CVE-2020-13955HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-miApache Calcite · org.apache.calcite:calcite-core +2
- CVE-2020-9105Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an insufficient input validation vulnerability.Taurus-AN00B
- CVE-2020-26522A cross-site request forgery (CSRF) vulnerability in mod/user/act_user.php in Garfield Petshop through 2020-10-01 allows remote attackers to
- CVE-2020-26162Xerox WorkCentre EC7836 before 073.050.059.25300 and EC7856 before 073.020.059.25300 devices allow XSS via Description pages.
- CVE-2020-15838The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions.
- CVE-2020-26913Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2020-26914Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2020-26915Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-26916Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2020-26917Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-26918Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-26922Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2020-26923Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-26924Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2020-26925NETGEAR GS808E devices before 1.7.1.0 are affected by denial of service.
- CVE-2020-26930NETGEAR EX7700 devices before 1.0.0.210 are affected by incorrect configuration of security settings.
- CVE-2020-26931Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2020-13626OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in orde