# CVEs published 2020-10-14

51 CVEs were published on October 14, 2020: 1 critical, 11 high. Days are UTC.

- [CVE-2020-8349](https://cve.now/CVE-2020-8349.md): An internal security review has identified an unauthenticated remote code execution vulnerability in Cloud Networking Operating System (CNOS (CVSS 9.8, Lenovo Cloud Networking Operating System)
- [CVE-2020-8350](https://cve.now/CVE-2020-8350.md): An authentication bypass vulnerability was reported in Lenovo ThinkPad Stack Wireless Router firmware version 1.1.3.4 that could allow escal (CVSS 8.8, Lenovo ThinkPad Stack WIreless Router firmware)
- [CVE-2020-8338](https://cve.now/CVE-2020-8338.md): A DLL search path vulnerability was reported in Lenovo Diagnostics prior to version 4.35.4 that could allow a user with local access to exec (CVSS 7.8, Lenovo Diagnostics)
- [CVE-2020-8345](https://cve.now/CVE-2020-8345.md): A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version (CVSS 7.3, Lenovo Vantage HardwareScan Plugin)
- [CVE-2020-8332](https://cve.now/CVE-2020-8332.md): A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x serve (CVSS 6.4, Lenovo System x · IBM System x)
- [CVE-2020-7383](https://cve.now/CVE-2020-7383.md): SQL Injection in Rapid7 Nexpose (CVSS 6.5, Rapid7 Nexpose)
- [CVE-2020-15229](https://cve.now/CVE-2020-15229.md): Path traversal and files overwrite with unsquashfs (CVSS 8.2, hpcng singularity · github.com/sylabs/singularity)
- [CVE-2020-15224](https://cve.now/CVE-2020-15224.md): Socket syscalls can leak enclave memory contents in Open Enclave (CVSS 6.8, openenclave)
- [CVE-2020-7317](https://cve.now/CVE-2020-7317.md): ePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerability (CVSS 4.6, McAfee ePolicy Orchistrator)
- [CVE-2020-7318](https://cve.now/CVE-2020-7318.md): ePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerability (CVSS 4.6, McAfee ePolicy Orchistrator)
- [CVE-2020-3427](https://cve.now/CVE-2020-3427.md): Duo Authentication for Windows Logon and RDP Privilege Escalation Vulnerability (CVSS 6.6, Cisco Duo Authentication for Windows Logon and RDP)
- [CVE-2020-15253](https://cve.now/CVE-2020-15253.md): Stored XSS in Grocy (CVSS 7.3, grocy)
- [CVE-2020-3483](https://cve.now/CVE-2020-3483.md): Duo Network Gateway (DNG) Information Disclosure Vulnerability (CVSS 7.1, Cisco Duo Network Gateway)
- [CVE-2020-4395](https://cve.now/CVE-2020-4395.md): IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate (CVSS 6.3, IBM Security Access Manager Appliance)
- [CVE-2020-25778](https://cve.now/CVE-2020-25778.md): Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel poi (no CVSS, Trend Micro Antivirus for Mac)
- [CVE-2020-27013](https://cve.now/CVE-2020-27013.md): Trend Micro Antivirus for Mac 2020 (Consumer) contains a vulnerability in the product that occurs when a webserver is started that implement (no CVSS, Trend Micro Antivirus for Mac)
- [CVE-2020-25777](https://cve.now/CVE-2020-25777.md): Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a specific kernel extension request attack where an attacker could bypass the (no CVSS, Trend Micro Antivirus for Mac)
- [CVE-2020-25824](https://cve.now/CVE-2020-25824.md): Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. (no CVSS)
- [CVE-2020-6933](https://cve.now/CVE-2020-6933.md): An improper input validation vulnerability in the UEM Core of BlackBerry UEM version(s) 12.13.0, 12.12.1a QF2 (and earlier), and 12.11.1 QF3 (no CVSS, BlackBerry UEM)
- [CVE-2020-9746](https://cve.now/CVE-2020-9746.md): Exploitable NULL pointer deref could lead to arbitrary code execution (CVSS 7.0, Adobe Flash Player)
- [CVE-2020-0283](https://cve.now/CVE-2020-0283.md): There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-163008257 (no CVSS, Android)
- [CVE-2020-0371](https://cve.now/CVE-2020-0371.md): There is a possible out of bounds read due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-163008256 (no CVSS, Android)
- [CVE-2020-0376](https://cve.now/CVE-2020-0376.md): There is a possible out of bounds read due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-163003156 (no CVSS, Android)
- [CVE-2020-0339](https://cve.now/CVE-2020-0339.md): There is a possible out of bounds read due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-162980705 (no CVSS, Android)
- [CVE-2020-0367](https://cve.now/CVE-2020-0367.md): There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-162980455 (no CVSS, Android)
- [CVE-2020-0420](https://cve.now/CVE-2020-0420.md): In setUpdatableDriverPath of GpuService.cpp, there is a possible memory corruption due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0421](https://cve.now/CVE-2020-0421.md): In appendFormatV of String8.cpp, there is a possible out of bounds write due to incorrect error handling. (no CVSS, Android)
- [CVE-2020-0422](https://cve.now/CVE-2020-0422.md): In constructImportFailureNotification of NotificationImportExportListener.java, there is a possible permissions bypass due to an unsafe Pend (no CVSS, Android)
- [CVE-2020-0423](https://cve.now/CVE-2020-0423.md): In binder\_release\_work of binder.c, there is a possible use-after-free due to improper locking. (no CVSS, Android)
- [CVE-2020-0412](https://cve.now/CVE-2020-0412.md): In setProcessMemoryTrimLevel of ActivityManagerService.java, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0246](https://cve.now/CVE-2020-0246.md): In getCarrierPrivilegeStatus of UiccAccessRule.java, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0377](https://cve.now/CVE-2020-0377.md): In gatt\_process\_read\_by\_type\_rsp of gatt\_cl.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0413](https://cve.now/CVE-2020-0413.md): In gatt\_process\_read\_by\_type\_rsp of gatt\_cl.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0378](https://cve.now/CVE-2020-0378.md): In onWnmFrameReceived of PasspointManager.java, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0414](https://cve.now/CVE-2020-0414.md): In AudioFlinger::RecordThread::threadLoop of audioflinger/Threads.cpp, there is a possible non-silenced audio buffer due to a permissions by (no CVSS, Android)
- [CVE-2020-0408](https://cve.now/CVE-2020-0408.md): In remove of String16.cpp, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2020-0410](https://cve.now/CVE-2020-0410.md): In setNotification of SapServer.java, there is a possible permission bypass due to a PendingIntent error. (no CVSS, Android)
- [CVE-2020-0415](https://cve.now/CVE-2020-0415.md): In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0416](https://cve.now/CVE-2020-0416.md): In multiple settings screens, there are possible tapjacking attacks due to an insecure default value. (no CVSS, Android)
- [CVE-2020-0398](https://cve.now/CVE-2020-0398.md): In updateMwi of NotificationMgr.java, there is a possible permission bypass due to a PendingIntent error. (no CVSS, Android)
- [CVE-2020-0400](https://cve.now/CVE-2020-0400.md): In showDataRoamingNotification of NotificationMgr.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0411](https://cve.now/CVE-2020-0411.md): In ~AACExtractor() of AACExtractor.cpp, there is a possible out of bounds write due to uninitialized data. (no CVSS, Android)
- [CVE-2020-0419](https://cve.now/CVE-2020-0419.md): In generateInfo of PackageInstallerSession.java, there is a possible leak of cross-profile URI data during app installation due to a missing (no CVSS, Android)
- [CVE-2019-2194](https://cve.now/CVE-2019-2194.md): In SurfaceFlinger::createLayer of SurfaceFlinger.cpp, there is a possible arbitrary code execution due to improper casting. (no CVSS, Android)
- [CVE-2020-25188](https://cve.now/CVE-2020-25188.md): An attacker who convinces a valid user to open a specially crafted project file to exploit could execute code under the privileges of the ap (no CVSS, LAquis SCADA)
- [CVE-2020-6083](https://cve.now/CVE-2020-6083.md): An exploitable denial of service vulnerability exists in the ENIP Request Path Port Segment functionality of Allen-Bradley Flex IO 1794-AENT (CVSS 7.5, Allen Bradley)
- [CVE-2020-24551](https://cve.now/CVE-2020-24551.md): IProom MMC+ Server - URL Redirection to Untrusted Site (Open Redirect') (CVSS 6.1, IProom MMC+ Server)
- [CVE-2020-6087](https://cve.now/CVE-2020-6087.md): An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENT (CVSS 7.5, Allen Bradley)
- [CVE-2020-6086](https://cve.now/CVE-2020-6086.md): An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENT (CVSS 7.5, Allen Bradley)
- [CVE-2020-7330](https://cve.now/CVE-2020-7330.md): Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial (CVSS 7.5, McAfee Total Protection (MTP) Trial)
- [CVE-2020-24188](https://cve.now/CVE-2020-24188.md): Cross-site scripting (XSS) vulnerability in the search functionality in Intrexx before 9.4.0 allows remote attackers to inject arbitrary web (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.