# CVEs published 2020-10-09

41 CVEs were published on October 9, 2020: 16 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-13955](https://cve.now/CVE-2020-13955.md): HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-mi (no CVSS, Apache Calcite · org.apache.calcite:calcite-core +2)
- [CVE-2020-9105](https://cve.now/CVE-2020-9105.md): Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an insufficient input validation vulnerability. (no CVSS, Taurus-AN00B)
- [CVE-2020-26522](https://cve.now/CVE-2020-26522.md): A cross-site request forgery (CSRF) vulnerability in mod/user/act\_user.php in Garfield Petshop through 2020-10-01 allows remote attackers to (no CVSS)
- [CVE-2020-26162](https://cve.now/CVE-2020-26162.md): Xerox WorkCentre EC7836 before 073.050.059.25300 and EC7856 before 073.020.059.25300 devices allow XSS via Description pages. (no CVSS)
- [CVE-2020-15838](https://cve.now/CVE-2020-15838.md): The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the \_LTUPDATE folder has weak permissions. (no CVSS)
- [CVE-2020-26897](https://cve.now/CVE-2020-26897.md): Certain NETGEAR devices are affected by disclosure of administrative credentials. (CVSS 9.6)
- [CVE-2020-26898](https://cve.now/CVE-2020-26898.md): NETGEAR RAX40 devices before 1.0.3.80 are affected by incorrect configuration of security settings. (CVSS 9.6)
- [CVE-2020-26899](https://cve.now/CVE-2020-26899.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 9.6)
- [CVE-2020-26900](https://cve.now/CVE-2020-26900.md): Certain NETGEAR devices are affected by disclosure of administrative credentials. (CVSS 9.6)
- [CVE-2020-26901](https://cve.now/CVE-2020-26901.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 9.6)
- [CVE-2020-26902](https://cve.now/CVE-2020-26902.md): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. (CVSS 9.6)
- [CVE-2020-26903](https://cve.now/CVE-2020-26903.md): Certain NETGEAR devices are affected by disclosure of administrative credentials. (CVSS 9.6)
- [CVE-2020-26904](https://cve.now/CVE-2020-26904.md): Certain NETGEAR devices are affected by disclosure of administrative credentials. (CVSS 9.6)
- [CVE-2020-26905](https://cve.now/CVE-2020-26905.md): Certain NETGEAR devices are affected by disclosure of administrative credentials. (CVSS 9.6)
- [CVE-2020-26906](https://cve.now/CVE-2020-26906.md): Certain NETGEAR devices are affected by disclosure of administrative credentials. (CVSS 9.6)
- [CVE-2020-26907](https://cve.now/CVE-2020-26907.md): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. (CVSS 9.6)
- [CVE-2020-26908](https://cve.now/CVE-2020-26908.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 9.4)
- [CVE-2020-26909](https://cve.now/CVE-2020-26909.md): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2020-26910](https://cve.now/CVE-2020-26910.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 8.4)
- [CVE-2020-26911](https://cve.now/CVE-2020-26911.md): Certain NETGEAR devices are affected by lack of access control at the function level. (CVSS 8.3)
- [CVE-2020-26912](https://cve.now/CVE-2020-26912.md): Certain NETGEAR devices are affected by CSRF. (CVSS 7.5)
- [CVE-2020-26913](https://cve.now/CVE-2020-26913.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2020-26914](https://cve.now/CVE-2020-26914.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.7)
- [CVE-2020-26915](https://cve.now/CVE-2020-26915.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.0)
- [CVE-2020-26916](https://cve.now/CVE-2020-26916.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 5.4)
- [CVE-2020-26917](https://cve.now/CVE-2020-26917.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.1)
- [CVE-2020-26918](https://cve.now/CVE-2020-26918.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.1)
- [CVE-2020-26919](https://cve.now/CVE-2020-26919.md): NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. (CVSS 9.8, KEV)
- [CVE-2020-26920](https://cve.now/CVE-2020-26920.md): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2020-26921](https://cve.now/CVE-2020-26921.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 8.3)
- [CVE-2020-26922](https://cve.now/CVE-2020-26922.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.4)
- [CVE-2020-26923](https://cve.now/CVE-2020-26923.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.3)
- [CVE-2020-26924](https://cve.now/CVE-2020-26924.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 3.1)
- [CVE-2020-26925](https://cve.now/CVE-2020-26925.md): NETGEAR GS808E devices before 1.7.1.0 are affected by denial of service. (CVSS 3.2)
- [CVE-2020-26926](https://cve.now/CVE-2020-26926.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 9.6)
- [CVE-2020-26927](https://cve.now/CVE-2020-26927.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 9.4)
- [CVE-2020-26928](https://cve.now/CVE-2020-26928.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 9.6)
- [CVE-2020-26929](https://cve.now/CVE-2020-26929.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 7.3)
- [CVE-2020-26930](https://cve.now/CVE-2020-26930.md): NETGEAR EX7700 devices before 1.0.0.210 are affected by incorrect configuration of security settings. (CVSS 3.3)
- [CVE-2020-26931](https://cve.now/CVE-2020-26931.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 5.9)
- [CVE-2020-13626](https://cve.now/CVE-2020-13626.md): OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in orde (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.