# CVEs published 2020-10-15

50 CVEs were published on October 15, 2020: 5 critical, 10 high. Days are UTC.

- [CVE-2020-14185](https://cve.now/CVE-2020-14185.md): Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the Actio (no CVSS, Atlassian Jira Server)
- [CVE-2019-17640](https://cve.now/CVE-2019-17640.md): In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, (no CVSS, The Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-web)
- [CVE-2020-1777](https://cve.now/CVE-2020-1777.md): Agent names disclosed in chat feature (CVSS 4.3, OTRS AG OTRS)
- [CVE-2020-7591](https://cve.now/CVE-2020-7591.md): A vulnerability has been identified in SIPORT MP (All versions \< 3.2.1). (no CVSS, Siemens SIPORT MP)
- [CVE-2020-15794](https://cve.now/CVE-2020-15794.md): A vulnerability has been identified in Desigo Insight (All versions). (no CVSS, Siemens Desigo Insight)
- [CVE-2020-15792](https://cve.now/CVE-2020-15792.md): A vulnerability has been identified in Desigo Insight (All versions). (no CVSS, Siemens Desigo Insight)
- [CVE-2020-15793](https://cve.now/CVE-2020-15793.md): A vulnerability has been identified in Desigo Insight (All versions). (no CVSS, Siemens Desigo Insight)
- [CVE-2020-12504](https://cve.now/CVE-2020-12504.md): Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products (CVSS 9.8, Pepperl+Fuchs P+F Comtrol RocketLinx · Korenix JetNet +1)
- [CVE-2020-12503](https://cve.now/CVE-2020-12503.md): Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products (CVSS 7.2, Pepperl+Fuchs P+F Comtrol RocketLinx · Korenix JetNet +1)
- [CVE-2020-12502](https://cve.now/CVE-2020-12502.md): Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products (CVSS 8.8, Pepperl+Fuchs P+F Comtrol RocketLinx · Korenix JetNet +1)
- [CVE-2020-12501](https://cve.now/CVE-2020-12501.md): Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products (CVSS 9.8, Pepperl+Fuchs P+F Comtrol RocketLinx · Korenix JetNet +1)
- [CVE-2020-12500](https://cve.now/CVE-2020-12500.md): Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products (CVSS 9.8, Pepperl+Fuchs P+F Comtrol RocketLinx · Korenix JetNet +1)
- [CVE-2020-25859](https://cve.now/CVE-2020-25859.md): The QCMAP\_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validatin (no CVSS, Qualcomm QCMAP)
- [CVE-2020-25858](https://cve.now/CVE-2020-25858.md): The QCMAP\_Web\_CLIENT binary in the Qualcomm QCMAP software suite prior to versions released in October 2020 does not validate the return val (no CVSS, Qualcomm QCMAP)
- [CVE-2020-11637](https://cve.now/CVE-2020-11637.md): Automation Runtime TFTP Service DoS Vulnerability (CVSS 5.8, B&R Automation Runtime)
- [CVE-2020-11646](https://cve.now/CVE-2020-11646.md): GateManager Log Information Disclosure Vulnerability (CVSS 4.3, B&R GateManager)
- [CVE-2020-11645](https://cve.now/CVE-2020-11645.md): GateManager Denial of Service Vulnerability (CVSS 6.5, B&R GateManager)
- [CVE-2020-21674](https://cve.now/CVE-2020-21674.md): Heap-based buffer overflow in archive\_string\_append\_from\_wcs() (archive\_string.c) in libarchive-3.4.1dev allows remote attackers to cause a (no CVSS)
- [CVE-2020-11642](https://cve.now/CVE-2020-11642.md): SiteManager Denial of Service via Local File Inclusion Vulnerability (CVSS 7.7, B&R SiteManager)
- [CVE-2020-11641](https://cve.now/CVE-2020-11641.md): SiteManager Local File Inclusion Vulnerability (CVSS 7.7, B&R SiteManager)
- [CVE-2020-11644](https://cve.now/CVE-2020-11644.md): GateManager Audit Message Spoofing Vulnerability (CVSS 6.5, B&R GateManager)
- [CVE-2020-11643](https://cve.now/CVE-2020-11643.md): GateManager Information Disclosure Vulnerability (CVSS 6.5, B&R GateManager)
- [CVE-2020-6106](https://cve.now/CVE-2020-6106.md): An exploitable information disclosure vulnerability exists in the init\_node\_manager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. (CVSS 4.4, F2fs-Tools)
- [CVE-2020-6105](https://cve.now/CVE-2020-6105.md): An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. (CVSS 8.2, F2fs-Tools)
- [CVE-2020-6104](https://cve.now/CVE-2020-6104.md): An exploitable information disclosure vulnerability exists in the get\_dnode\_of\_data functionality of F2fs-Tools F2fs.Fsck 1.13. (CVSS 4.4, F2FS-Tools)
- [CVE-2020-6108](https://cve.now/CVE-2020-6108.md): An exploitable code execution vulnerability exists in the fsck\_chk\_orphan\_node functionality of F2fs-Tools F2fs.Fsck 1.13. (CVSS 8.2, F2fs-Tools)
- [CVE-2020-6107](https://cve.now/CVE-2020-6107.md): An exploitable information disclosure vulnerability exists in the dev\_read functionality of F2fs-Tools F2fs.Fsck 1.13. (CVSS 4.4, F2fs-Tools)
- [CVE-2020-4499](https://cve.now/CVE-2020-4499.md): IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or al (CVSS 7.3, IBM Security Verify Access · IBM Security Access Manager)
- [CVE-2019-4552](https://cve.now/CVE-2019-4552.md): IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP response splitting attacks. (CVSS 6.1, IBM Security Verify Access · IBM Security Access Manager)
- [CVE-2020-7744](https://cve.now/CVE-2020-7744.md): Information Exposure (CVSS 4.7, com.mintegral.msdk:alphab)
- [CVE-2020-7327](https://cve.now/CVE-2020-7327.md): McAfee MVEDR - Improperly implemented security check (CVSS 6.0, McAfee MVISION Endpoint Detection and Response)
- [CVE-2020-7326](https://cve.now/CVE-2020-7326.md): McAfee MAR - Improperly implemented security check (CVSS 6.0, McAfee Active Response)
- [CVE-2020-7334](https://cve.now/CVE-2020-7334.md): Improper privilege assignment vulnerability in the installer component of MACC (CVSS 7.7, McAfee Application and Change Control)
- [CVE-2020-27156](https://cve.now/CVE-2020-27156.md): Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. (CVSS 9.8)
- [CVE-2020-27157](https://cve.now/CVE-2020-27157.md): Veritas APTARE versions prior to 10.5 included code that bypassed the normal login process when specific authentication credentials were pro (CVSS 8.1)
- [CVE-2020-27153](https://cve.now/CVE-2020-27153.md): In BlueZ before 5.55, a double free was found in the gatttool disconnect\_cb() routine from shared/att.c. (CVSS 8.6)
- [CVE-2020-5642](https://cve.now/CVE-2020-5642.md): Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the (no CVSS, onWebChat Live Chat - Live support)
- [CVE-2020-6365](https://cve.now/CVE-2020-6365.md): SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect (CVSS 4.7, SAP SE SAP NetWeaver Application Server Java)
- [CVE-2020-6376](https://cve.now/CVE-2020-6376.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Hemisphere Binary (.rh) file received from untrusted s (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6374](https://cve.now/CVE-2020-6374.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Jupiter Tessallation(.jt) file received from untrusted sourc (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6375](https://cve.now/CVE-2020-6375.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Computer Graphics Metafile (.cgm) file received from u (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6373](https://cve.now/CVE-2020-6373.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6372](https://cve.now/CVE-2020-6372.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6371](https://cve.now/CVE-2020-6371.md): User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver (CVSS 4.3, SAP SE SAP NetWeaver Application Server ABAP)
- [CVE-2020-6364](https://cve.now/CVE-2020-6364.md): SAP Solution Manager and SAP Focused Run (update provided in WILY\_INTRO\_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a co (CVSS 10.0, SAP SE SAP Solution Manager (CA Introscope Enterprise Manag…)
- [CVE-2020-6368](https://cve.now/CVE-2020-6368.md): SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them (CVSS 5.4, SAP SE SAP Business Planning and Consolidation)
- [CVE-2020-6363](https://cve.now/CVE-2020-6363.md): SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. (no CVSS, SAP SE SAP Commerce Cloud)
- [CVE-2020-6319](https://cve.now/CVE-2020-6319.md): SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include (CVSS 6.1, SAP SE SAP NetWeaver Application Server Java)
- [CVE-2020-6272](https://cve.now/CVE-2020-6272.md): SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized (CVSS 5.4, SAP SE SAP Commerce Cloud)
- [CVE-2020-6323](https://cve.now/CVE-2020-6323.md): SAP NetWeaver Enterprise Portal (Fiori Framework Page) versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and (no CVSS, SAP SE SAP NetWeaver Enterprise Portal)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.