CVEs published October 14, 2020
51 CVEs were published on October 14, 2020: 1 critical, 11 high.
- Published
- 51
- Critical
- 1
- High
- 11
- Medium
- 8
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Android
- 24
- Allen Bradley
- 3
- Trend Micro Antivirus for Mac
- 3
- McAfee ePolicy Orchistrator
- 2
- Adobe Flash Player
- 1
- BlackBerry UEM
- 1
- Cisco Duo Authentication for Windows Logon and RDP
- 1
- Cisco Duo Network Gateway
- 1
- grocy
- 1
- hpcng singularity · github.com/sylabs/singularity
- 1
Critical 1
High 11
- CVE-2020-8350An authentication bypass vulnerability was reported in Lenovo ThinkPad Stack Wireless Router firmware version 1.1.3.4 that could allow escalLenovo ThinkPad Stack WIreless Router firmware
- CVE-2020-8338A DLL search path vulnerability was reported in Lenovo Diagnostics prior to version 4.35.4 that could allow a user with local access to execLenovo Diagnostics
- CVE-2020-8345A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to versionLenovo Vantage HardwareScan Plugin
- CVE-2020-15229Path traversal and files overwrite with unsquashfshpcng singularity · github.com/sylabs/singularity
- CVE-2020-15253Stored XSS in Grocygrocy
- CVE-2020-3483Duo Network Gateway (DNG) Information Disclosure VulnerabilityCisco Duo Network Gateway
- CVE-2020-9746Exploitable NULL pointer deref could lead to arbitrary code executionAdobe Flash Player
- CVE-2020-6083An exploitable denial of service vulnerability exists in the ENIP Request Path Port Segment functionality of Allen-Bradley Flex IO 1794-AENTAllen Bradley
- CVE-2020-6087An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENTAllen Bradley
- CVE-2020-6086An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENTAllen Bradley
- CVE-2020-7330Privilege Escalation vulnerability in McAfee Total Protection (MTP) trialMcAfee Total Protection (MTP) Trial
Medium, low and unrated 39
- CVE-2020-8332A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x serveLenovo System x · IBM System x
- CVE-2020-7383SQL Injection in Rapid7 NexposeRapid7 Nexpose
- CVE-2020-15224Socket syscalls can leak enclave memory contents in Open Enclaveopenenclave
- CVE-2020-7317ePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerabilityMcAfee ePolicy Orchistrator
- CVE-2020-7318ePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerabilityMcAfee ePolicy Orchistrator
- CVE-2020-3427Duo Authentication for Windows Logon and RDP Privilege Escalation VulnerabilityCisco Duo Authentication for Windows Logon and RDP
- CVE-2020-4395IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate IBM Security Access Manager Appliance
- CVE-2020-25778Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel poiTrend Micro Antivirus for Mac
- CVE-2020-27013Trend Micro Antivirus for Mac 2020 (Consumer) contains a vulnerability in the product that occurs when a webserver is started that implementTrend Micro Antivirus for Mac
- CVE-2020-25777Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a specific kernel extension request attack where an attacker could bypass theTrend Micro Antivirus for Mac
- CVE-2020-25824Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard.
- CVE-2020-6933An improper input validation vulnerability in the UEM Core of BlackBerry UEM version(s) 12.13.0, 12.12.1a QF2 (and earlier), and 12.11.1 QF3BlackBerry UEM
- CVE-2020-0283There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-163008257Android
- CVE-2020-0371There is a possible out of bounds read due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-163008256Android
- CVE-2020-0376There is a possible out of bounds read due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-163003156Android
- CVE-2020-0339There is a possible out of bounds read due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-162980705Android
- CVE-2020-0367There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-162980455Android
- CVE-2020-0420In setUpdatableDriverPath of GpuService.cpp, there is a possible memory corruption due to a missing permission check.Android
- CVE-2020-0421In appendFormatV of String8.cpp, there is a possible out of bounds write due to incorrect error handling.Android
- CVE-2020-0422In constructImportFailureNotification of NotificationImportExportListener.java, there is a possible permissions bypass due to an unsafe PendAndroid
- CVE-2020-0423In binder_release_work of binder.c, there is a possible use-after-free due to improper locking.Android
- CVE-2020-0412In setProcessMemoryTrimLevel of ActivityManagerService.java, there is a missing permission check.Android
- CVE-2020-0246In getCarrierPrivilegeStatus of UiccAccessRule.java, there is a missing permission check.Android
- CVE-2020-0377In gatt_process_read_by_type_rsp of gatt_cl.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0413In gatt_process_read_by_type_rsp of gatt_cl.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0378In onWnmFrameReceived of PasspointManager.java, there is a missing permission check.Android
- CVE-2020-0414In AudioFlinger::RecordThread::threadLoop of audioflinger/Threads.cpp, there is a possible non-silenced audio buffer due to a permissions byAndroid
- CVE-2020-0408In remove of String16.cpp, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2020-0410In setNotification of SapServer.java, there is a possible permission bypass due to a PendingIntent error.Android
- CVE-2020-0415In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0416In multiple settings screens, there are possible tapjacking attacks due to an insecure default value.Android
- CVE-2020-0398In updateMwi of NotificationMgr.java, there is a possible permission bypass due to a PendingIntent error.Android
- CVE-2020-0400In showDataRoamingNotification of NotificationMgr.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0411In ~AACExtractor() of AACExtractor.cpp, there is a possible out of bounds write due to uninitialized data.Android
- CVE-2020-0419In generateInfo of PackageInstallerSession.java, there is a possible leak of cross-profile URI data during app installation due to a missingAndroid
- CVE-2019-2194In SurfaceFlinger::createLayer of SurfaceFlinger.cpp, there is a possible arbitrary code execution due to improper casting.Android
- CVE-2020-25188An attacker who convinces a valid user to open a specially crafted project file to exploit could execute code under the privileges of the apLAquis SCADA
- CVE-2020-24551IProom MMC+ Server - URL Redirection to Untrusted Site (Open Redirect')IProom MMC+ Server
- CVE-2020-24188Cross-site scripting (XSS) vulnerability in the search functionality in Intrexx before 9.4.0 allows remote attackers to inject arbitrary web