# CVEs published 2020-10-19

96 CVEs were published on October 19, 2020: 0 critical, 6 high. Days are UTC.

- [CVE-2020-15261](https://cve.now/CVE-2020-15261.md): Unquoted service path vulnerability on Veyon (CVSS 8.0, veyon)
- [CVE-2020-15256](https://cve.now/CVE-2020-15256.md): Prototype pollution in object-path (CVSS 7.7, mariocasciaro object-path · object-path)
- [CVE-2020-15245](https://cve.now/CVE-2020-15245.md): Email verification bypass in Sylius (CVSS 4.3, Sylius · sylius/sylius)
- [CVE-2020-6085](https://cve.now/CVE-2020-6085.md): An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-A (CVSS 7.5, Allen Bradley)
- [CVE-2020-6084](https://cve.now/CVE-2020-6084.md): An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-A (CVSS 7.5, Allen-Bradley)
- [CVE-2020-10746](https://cve.now/CVE-2020-10746.md): A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both RES (no CVSS, Infinispan)
- [CVE-2020-15263](https://cve.now/CVE-2020-15263.md): XSS in platform (CVSS 8.0, orchidsoftware platform · orchid/platform)
- [CVE-2020-13937](https://cve.now/CVE-2020-13937.md): Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3 (no CVSS, Apache Kylin · org.apache.kylin:kylin)
- [CVE-2020-15262](https://cve.now/CVE-2020-15262.md): Invalid integrity hashes in webpack-subresource-integrity (CVSS 3.7, waysact webpack-subresource-integrity · webpack-subresource…)
- [CVE-2020-9111](https://cve.now/CVE-2020-9111.md): E6878-370 versions 10.0.3.1(H557SP27C233),10.0.3.1(H563SP21C233) and E6878-870 versions 10.0.3.1(H557SP27C233),10.0.3.1(H563SP11C233) have a (no CVSS, E6878-370;E6878-870)
- [CVE-2020-9113](https://cve.now/CVE-2020-9113.md): HUAWEI Mate 20 versions earlier than 10.0.0.188(C00E74R3P8) have a buffer overflow vulnerability in the Bluetooth module. (no CVSS, HUAWEI Mate)
- [CVE-2020-9263](https://cve.now/CVE-2020-9263.md): HUAWEI Mate 30 versions earlier than 10.1.0.150(C00E136R5P3) and HUAWEI P30 version earlier than 10.1.0.160(C00E160R2P11) have a use after f (no CVSS, HUAWEI Mate 30;HUAWEI P30)
- [CVE-2020-24388](https://cve.now/CVE-2020-24388.md): An issue was discovered in the \_send\_secure\_msg() function of yubihsm-shell through 2.0.2. (no CVSS)
- [CVE-2020-24387](https://cve.now/CVE-2020-24387.md): An issue was discovered in the yh\_create\_session() function of yubihsm-shell through 2.0.2. (no CVSS)
- [CVE-2020-9092](https://cve.now/CVE-2020-9092.md): HUAWEI Mate 20 versions earlier than 10.1.0.163(C00E160R3P8) have a JavaScript injection vulnerability. (no CVSS, HUAWEI Mate)
- [CVE-2020-9112](https://cve.now/CVE-2020-9112.md): Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a privilege elevation vulnerability. (no CVSS, Taurus-AN00B)
- [CVE-2019-13633](https://cve.now/CVE-2019-13633.md): Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. (no CVSS)
- [CVE-2020-11496](https://cve.now/CVE-2020-11496.md): Sprecher SPRECON-E firmware prior to 8.64b might allow local attackers with access to engineering data to insert arbitrary code. (no CVSS)
- [CVE-2020-15822](https://cve.now/CVE-2020-15822.md): In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped. (no CVSS)
- [CVE-2020-24375](https://cve.now/CVE-2020-24375.md): A DNS rebinding vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3. (no CVSS)
- [CVE-2020-16161](https://cve.now/CVE-2020-16161.md): GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMF\_ScaledData(). (no CVSS)
- [CVE-2020-16160](https://cve.now/CVE-2020-16160.md): GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMF\_Decompress(). (no CVSS)
- [CVE-2020-16159](https://cve.now/CVE-2020-16159.md): GoPro gpmf-parser 1.5 has a heap out-of-bounds read and segfault in GPMF\_ScaledData(). (no CVSS)
- [CVE-2020-7195](https://cve.now/CVE-2020-7195.md): A iccselectrules expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7194](https://cve.now/CVE-2020-7194.md): A perfaddormoddevicemonitor expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management C (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7193](https://cve.now/CVE-2020-7193.md): A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7192](https://cve.now/CVE-2020-7192.md): A devicethresholdconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Cente (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7191](https://cve.now/CVE-2020-7191.md): A devsoftsel expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) ver (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7190](https://cve.now/CVE-2020-7190.md): A deviceselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) v (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7189](https://cve.now/CVE-2020-7189.md): A faultflasheventselectfact expression language injectionremote code execution vulnerability was discovered in HPE Intelligent Management Ce (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7188](https://cve.now/CVE-2020-7188.md): A userselectpagingcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Cen (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7187](https://cve.now/CVE-2020-7187.md): A reportpage index expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iM (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7186](https://cve.now/CVE-2020-7186.md): A powershellconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Cen (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7185](https://cve.now/CVE-2020-7185.md): A tvxlanlegend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) v (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7184](https://cve.now/CVE-2020-7184.md): A viewbatchtaskresultdetailfact expression language injection remote code execution vulnerability was discovered in HPE Intelligent Manageme (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7183](https://cve.now/CVE-2020-7183.md): A forwardredirect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7182](https://cve.now/CVE-2020-7182.md): A sshconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) vers (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7181](https://cve.now/CVE-2020-7181.md): A smsrulesdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iM (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7180](https://cve.now/CVE-2020-7180.md): A ictexpertdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (i (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7179](https://cve.now/CVE-2020-7179.md): A thirdpartyperfselecttask expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Ce (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7178](https://cve.now/CVE-2020-7178.md): A mediaforaction expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7177](https://cve.now/CVE-2020-7177.md): A wmiconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iM (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-16158](https://cve.now/CVE-2020-16158.md): GoPro gpmf-parser through 1.5 has a stack out-of-bounds write vulnerability in GPMF\_ExpandComplexTYPE(). (no CVSS)
- [CVE-2020-7176](https://cve.now/CVE-2020-7176.md): A viewtaskresultdetailfact expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Ce (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7175](https://cve.now/CVE-2020-7175.md): A iccselectdymicparam expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7174](https://cve.now/CVE-2020-7174.md): A soapconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (i (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7173](https://cve.now/CVE-2020-7173.md): A actionselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7172](https://cve.now/CVE-2020-7172.md): A templateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7171](https://cve.now/CVE-2020-7171.md): A guidatadetail expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7170](https://cve.now/CVE-2020-7170.md): A select expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7169](https://cve.now/CVE-2020-7169.md): A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7168](https://cve.now/CVE-2020-7168.md): A selectusergroup expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7167](https://cve.now/CVE-2020-7167.md): A quicktemplateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7166](https://cve.now/CVE-2020-7166.md): A operatorgrouptreeselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Managem (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7165](https://cve.now/CVE-2020-7165.md): A iccselectcommand expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iM (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7164](https://cve.now/CVE-2020-7164.md): A operationselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7163](https://cve.now/CVE-2020-7163.md): A navigationto expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) v (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7162](https://cve.now/CVE-2020-7162.md): A operatorgroupselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7161](https://cve.now/CVE-2020-7161.md): A reporttaskselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iM (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7160](https://cve.now/CVE-2020-7160.md): A iccselectdeviceseries expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Cente (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7159](https://cve.now/CVE-2020-7159.md): A customtemplateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7158](https://cve.now/CVE-2020-7158.md): A perfselecttask expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7157](https://cve.now/CVE-2020-7157.md): A selviewnavcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (i (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7156](https://cve.now/CVE-2020-7156.md): A faultinfo\_content expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (i (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7155](https://cve.now/CVE-2020-7155.md): A select expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7154](https://cve.now/CVE-2020-7154.md): A ifviewselectpage expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iM (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7153](https://cve.now/CVE-2020-7153.md): A iccselectdevtype expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iM (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7152](https://cve.now/CVE-2020-7152.md): A faultparasset expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7151](https://cve.now/CVE-2020-7151.md): A faulttrapgroupselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7150](https://cve.now/CVE-2020-7150.md): A faultstatchoosefaulttype expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Ce (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7149](https://cve.now/CVE-2020-7149.md): A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7148](https://cve.now/CVE-2020-7148.md): A deployselectsoftware expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7147](https://cve.now/CVE-2020-7147.md): A deployselectbootrom expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7146](https://cve.now/CVE-2020-7146.md): A devgroupselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7145](https://cve.now/CVE-2020-7145.md): A chooseperfview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7144](https://cve.now/CVE-2020-7144.md): A comparefilesresult expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center ( (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7143](https://cve.now/CVE-2020-7143.md): A faultdevparasset expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iM (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7142](https://cve.now/CVE-2020-7142.md): A eventinfo\_content expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (i (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-7141](https://cve.now/CVE-2020-7141.md): A adddevicetoview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-24652](https://cve.now/CVE-2020-24652.md): A addvsiinterfaceinfo expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-24651](https://cve.now/CVE-2020-24651.md): A syslogtempletselectwin expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Cent (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-24650](https://cve.now/CVE-2020-24650.md): A legend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-24649](https://cve.now/CVE-2020-24649.md): A remote bytemessageresource transformentity" input validation code execution vulnerability was discovered in HPE Intelligent Management Cen (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-24648](https://cve.now/CVE-2020-24648.md): A accessmgrservlet classname deserialization of untrusted data remote code execution vulnerability was discovered in HPE Intelligent Managem (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-24647](https://cve.now/CVE-2020-24647.md): A remote accessmgrservlet classname input validation code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-24646](https://cve.now/CVE-2020-24646.md): A tftpserver stack-based buffer overflow remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) versi (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-24630](https://cve.now/CVE-2020-24630.md): A remote operatoronlinelist\_content privilege escalation vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-24629](https://cve.now/CVE-2020-24629.md): A remote urlaccesscontroller authentication bypass vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior (no CVSS, HPE Intelligent Management Center)
- [CVE-2020-26891](https://cve.now/CVE-2020-26891.md): AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. (no CVSS, matrix-synapse)
- [CVE-2020-24266](https://cve.now/CVE-2020-24266.md): An issue was discovered in tcpreplay tcpprep v4.3.3. (no CVSS)
- [CVE-2020-24265](https://cve.now/CVE-2020-24265.md): An issue was discovered in tcpreplay tcpprep v4.3.3. (no CVSS)
- [CVE-2020-15909](https://cve.now/CVE-2020-15909.md): SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. (no CVSS)
- [CVE-2020-15910](https://cve.now/CVE-2020-15910.md): SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. (no CVSS)
- [CVE-2020-13778](https://cve.now/CVE-2020-13778.md): rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxA (no CVSS)
- [CVE-2020-8929](https://cve.now/CVE-2020-8929.md): Ciphertext integrity weakness in Tink (CVSS 5.3, Google Tink · tink +1)
- [CVE-2020-7745](https://cve.now/CVE-2020-7745.md): Malicious Package (CVSS 7.1, MintegralAdSDK)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.