# CVEs published 2020-10-12

60 CVEs were published on October 12, 2020: 3 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-17444](https://cve.now/CVE-2019-17444.md): JFrog Artifactory does not enforce default admin password change (CVSS 9.8, Jfrog Artifactory)
- [CVE-2020-15012](https://cve.now/CVE-2020-15012.md): A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. (no CVSS)
- [CVE-2020-26546](https://cve.now/CVE-2020-26546.md): An issue was discovered in HelpDeskZ 1.0.2. (CVSS 7.5)
- [CVE-2020-15250](https://cve.now/CVE-2020-15250.md): Information disclosure in JUnit4 (CVSS 4.4, junit-team junit4 · junit:junit)
- [CVE-2020-25825](https://cve.now/CVE-2020-25825.md): In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs. (no CVSS)
- [CVE-2020-12670](https://cve.now/CVE-2020-12670.md): XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to sav (no CVSS)
- [CVE-2020-8821](https://cve.now/CVE-2020-8821.md): An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. (no CVSS)
- [CVE-2020-8820](https://cve.now/CVE-2020-8820.md): An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. (no CVSS)
- [CVE-2020-9240](https://cve.now/CVE-2020-9240.md): Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a buffer overflow vulnerability. (no CVSS, Taurus-AN00B)
- [CVE-2020-9110](https://cve.now/CVE-2020-9110.md): Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an information disclosure vulnerability. (no CVSS, Taurus-AN00B)
- [CVE-2020-9091](https://cve.now/CVE-2020-9091.md): Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an out-of-bounds read and write vulnerability. (no CVSS, Taurus-AN00B)
- [CVE-2020-26867](https://cve.now/CVE-2020-26867.md): ARC Informatique PcVue Deserialization of Untrusted Data (CVSS 9.8, ARC Informatique PcVue)
- [CVE-2020-26869](https://cve.now/CVE-2020-26869.md): ARC Informatique PcVue Exposure of Sensitive Information to an Unauthorized Actor (CVSS 7.5, ARC Informatique PcVue)
- [CVE-2020-26868](https://cve.now/CVE-2020-26868.md): ARC Informatique PcVue Access to Critical Private Variable via Public Method (CVSS 7.5, ARC Informatique PcVue)
- [CVE-2020-13943](https://cve.now/CVE-2020-13943.md): If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum nu (no CVSS, Apache Tomcat · tomcat +1)
- [CVE-2020-9106](https://cve.now/CVE-2020-9106.md): HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have a path traversal vulnerability. (no CVSS, HUAWEI P30 Pro)
- [CVE-2020-9123](https://cve.now/CVE-2020-9123.md): HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) and versions earlier than 10.1.0.160(C01E160R2P8) have a buffer overflow vulner (no CVSS, HUAWEI P30 Pro)
- [CVE-2020-9109](https://cve.now/CVE-2020-9109.md): There is an information disclosure vulnerability in several smartphones. (no CVSS, HUAWEI Mate 20;HUAWEI Mate 20 X;HUAWEI P30 Pro;Laya-AL00EP;…)
- [CVE-2020-9122](https://cve.now/CVE-2020-9122.md): Some Huawei products have an insufficient input verification vulnerability. (no CVSS, HiRouter-CD30-10;HiRouter-CT31-10;WS5200-12;WS5281-10;WS580…)
- [CVE-2020-9107](https://cve.now/CVE-2020-9107.md): HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have an out-of-bounds read and write vulnerability. (no CVSS, HUAWEI P30 Pro)
- [CVE-2020-9087](https://cve.now/CVE-2020-9087.md): Taurus-AL00A version 10.0.0.1(C00E1R1P1) has an out-of-bounds read vulnerability in XFRM module. (no CVSS, Taurus-AL00A)
- [CVE-2020-9090](https://cve.now/CVE-2020-9090.md): FusionAccess version 6.5.1 has an improper authorization vulnerability. (no CVSS, FusionAccess)
- [CVE-2020-9108](https://cve.now/CVE-2020-9108.md): HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have an out-of-bounds read and write vulnerability. (no CVSS, HUAWEI P30 Pro)
- [CVE-2020-9230](https://cve.now/CVE-2020-9230.md): WS5800-10 version 10.0.3.25 has a denial of service vulnerability. (no CVSS, WS5800-10)
- [CVE-2020-9238](https://cve.now/CVE-2020-9238.md): Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a buffer overflow vulnerability. (no CVSS, Taurus-AN00B)
- [CVE-2020-4741](https://cve.now/CVE-2020-4741.md): IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM InfoSphere Information Server)
- [CVE-2020-4740](https://cve.now/CVE-2020-4740.md): IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. (CVSS 5.2, IBM InfoSphere Information Server)
- [CVE-2020-4689](https://cve.now/CVE-2020-4689.md): IBM Security Guardium 11.2 is vulnerable to CVS Injection. (CVSS 6.8, IBM Security Guardium)
- [CVE-2020-4681](https://cve.now/CVE-2020-4681.md): IBM Security Guardium 11.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Guardium)
- [CVE-2020-4680](https://cve.now/CVE-2020-4680.md): IBM Security Guardium 11.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Guardium)
- [CVE-2020-4679](https://cve.now/CVE-2020-4679.md): IBM Security Guardium 11.2 is vulnerable to cross-site scripting. (CVSS 4.8, IBM Security Guardium)
- [CVE-2020-4678](https://cve.now/CVE-2020-4678.md): IBM Security Guardium 11.2 could allow an attacker with admin access to obtain and read files that they normally would not have access to. (CVSS 4.9, IBM Security Guardium)
- [CVE-2020-4388](https://cve.now/CVE-2020-4388.md): IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in a servlet also exposi (CVSS 6.5, IBM Cognos Analytics)
- [CVE-2020-4302](https://cve.now/CVE-2020-4302.md): IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. (CVSS 5.5, IBM Cognos Analytics)
- [CVE-2020-13341](https://cve.now/CVE-2020-13341.md): An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. (CVSS 4.9, GitLab)
- [CVE-2020-7811](https://cve.now/CVE-2020-7811.md): Samsung Update Local Privilege Escalation Vulnerability (CVSS 6.2, Samsung Electronics Samsung Update)
- [CVE-2020-4781](https://cve.now/CVE-2020-4781.md): An improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which co (CVSS 6.5, IBM Curam SPM)
- [CVE-2020-4780](https://cve.now/CVE-2020-4780.md): OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10 (CVSS 4.3, IBM Curam SPM)
- [CVE-2020-4779](https://cve.now/CVE-2020-4779.md): A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. (CVSS 8.1, IBM Curam SPM)
- [CVE-2020-4778](https://cve.now/CVE-2020-4778.md): IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default (CVSS 5.9, IBM Curam SPM)
- [CVE-2020-4776](https://cve.now/CVE-2020-4776.md): A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a remote attacker to trave (CVSS 5.3, IBM Curam SPM)
- [CVE-2020-4775](https://cve.now/CVE-2020-4775.md): A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. (CVSS 5.4, IBM Curam SPM)
- [CVE-2020-4774](https://cve.now/CVE-2020-4774.md): An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied inp (CVSS 5.4, IBM Curam SPM)
- [CVE-2020-4773](https://cve.now/CVE-2020-4773.md): A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that f (CVSS 6.5, IBM Curam SPM)
- [CVE-2020-4772](https://cve.now/CVE-2020-4772.md): An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. (CVSS 7.1, IBM Curam SPM)
- [CVE-2020-4699](https://cve.now/CVE-2020-4699.md): IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channe (CVSS 5.3, IBM Security Access Manager · IBM Security Verify Access)
- [CVE-2020-4661](https://cve.now/CVE-2020-4661.md): IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channe (CVSS 5.3, IBM Security Access Manager · IBM Security Verify Access)
- [CVE-2020-4660](https://cve.now/CVE-2020-4660.md): IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channe (CVSS 5.3, IBM Security Access Manager · IBM Security Verify Access)
- [CVE-2020-5143](https://cve.now/CVE-2020-5143.md): SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based o (no CVSS, SonicWall SonicOS)
- [CVE-2020-5141](https://cve.now/CVE-2020-5141.md): A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. (no CVSS, SonicWall SonicOS)
- [CVE-2020-5142](https://cve.now/CVE-2020-5142.md): A stored cross-site scripting (XSS) vulnerability exists in the SonicOS SSLVPN web interface. (no CVSS, SonicWall SonicOS)
- [CVE-2020-5138](https://cve.now/CVE-2020-5138.md): A Heap Overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVP (no CVSS, SonicWall SonicOS)
- [CVE-2020-5139](https://cve.now/CVE-2020-5139.md): A vulnerability in SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS) due to the release of In (no CVSS, SonicWall SonicOS)
- [CVE-2020-5140](https://cve.now/CVE-2020-5140.md): A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service by sendi (no CVSS, SonicWall SonicOS)
- [CVE-2020-5136](https://cve.now/CVE-2020-5136.md): A buffer overflow vulnerability in SonicOS allows an authenticated attacker to cause Denial of Service (DoS) in the SSL-VPN and virtual assi (no CVSS, SonicWall SonicOS)
- [CVE-2020-5137](https://cve.now/CVE-2020-5137.md): A buffer overflow vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN (no CVSS, SonicWall SonicOS)
- [CVE-2020-5134](https://cve.now/CVE-2020-5134.md): A vulnerability in SonicOS allows an authenticated attacker to cause out-of-bound invalid file reference leads to a firewall crash. (no CVSS, SonicWall SonicOS)
- [CVE-2020-5135](https://cve.now/CVE-2020-5135.md): A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code (CVSS 9.8, KEV, SonicWall SonicOS)
- [CVE-2020-5133](https://cve.now/CVE-2020-5133.md): A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service due to buffer overflow, which leads to a fire (no CVSS, SonicWall SonicOS)
- [CVE-2020-14184](https://cve.now/CVE-2020-14184.md): Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vu (no CVSS, Atlassian Jira Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.