CVEs published October 20, 2020
49 CVEs were published on October 20, 2020: 1 critical, 15 high. 1 is now in CISA KEV.
- Published
- 49
- Critical
- 1
- High
- 15
- Medium
- 18
- Low
- 0
- Unrated
- 15
- Now in CISA KEV
- 1
- Fix available
- 11
Most affected products
- Adobe Illustrator
- 7
- IBM Spectrum Scale
- 4
- Nagios XI
- 3
- VMware ESXi, Workstation, Fusion
- 3
- SAP SE SAP NetWeaver
- 2
- UCWeb UC Browser
- 2
- @tsed/core
- 1
- Adobe Marketo
- 1
- Advantech R-SeeNet
- 1
- chocolatey boxstarter
- 1
Critical 1
High 15
- CVE-2020-24412Adobe Illustrator Memory Corruption VulnerabilityAdobe Illustrator
- CVE-2020-24414Adobe Illustrator Memory Corruption VulnerabilityAdobe Illustrator
- CVE-2020-24410Adobe Illustrator PDF File Parsing Out-Of-Bounds Read VulnerabilityAdobe Illustrator
- CVE-2020-24409Adobe Illustrator PDF File Parsing Out-Of-Bounds Read VulnerabilityAdobe Illustrator
- CVE-2020-24415Adobe Illustrator Memory Corruption VulnerabilityAdobe Illustrator
- CVE-2020-24413Adobe Illustrator Memory Corruption VulnerabilityAdobe Illustrator
- CVE-2020-24411Adobe Illustrator PDF File Parsing Out-Of-Bounds Write VulnerabilityAdobe Illustrator
- CVE-2020-24416Blind stored XSS in Marketo Sales insight plugin for SalesForceAdobe Marketo
- CVE-2020-9417TIBCO Foresight SQL InjectionTIBCO Software TIBCO Foresight Archive and Retrieval Sys… +1
- CVE-2020-15264Privilege Escalation in Boxstarterchocolatey boxstarter
- CVE-2020-15269Expired token reuse in Spreespree
- CVE-2020-6367There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40,SAP SE SAP NetWeaver Composite Application Framework
- CVE-2020-6369SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackeSAP SE CA Introscope Enterprise Manager
- CVE-2020-6366SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents.SAP SE SAP NetWeaver
- CVE-2020-7749Server-side Request Forgery (SSRF)osm-static-maps
Medium, low and unrated 33
- CVE-2020-25157The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database andAdvantech R-SeeNet
- CVE-2020-5791Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute opNagios XI
- CVE-2020-5790Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate usersNagios XI
- CVE-2020-5792Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitraNagios XI
- CVE-2020-15931Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain
- CVE-2020-24765InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monit
- CVE-2019-9080DomainMOD before 4.14.0 uses MD5 without a salt for password storage.
- CVE-2020-7371Raise IT Solutions RITS Browser Address Bar SpooofingRaise IT Solutions RITS Browser
- CVE-2020-7370Danyil Vasilenko Bolt Browser Address Bar SpooofingDanyil Vasilenko Bolt Browser
- CVE-2020-7369Yandex Browser Address Bar SpooofingYandex Browser
- CVE-2020-7364UCWeb UC Browser Address Bar SpooofingUCWeb UC Browser
- CVE-2020-7363UCWeb UC Browser Address Bar SpooofingUCWeb UC Browser
- CVE-2020-3995In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11.VMware ESXi, Workstation, Fusion
- CVE-2020-3994VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance ManagemevCenter Server
- CVE-2020-3993VMware NSX-T (3.x before 3.0.2, 2.5.x before 2.5.2.2.0) contains a security vulnerability that exists in the way it allows a KVM host to dowVMware NSX-T
- CVE-2020-3982VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), FusiVMware ESXi, Workstation, Fusion
- CVE-2020-3981VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), FusiVMware ESXi, Workstation, Fusion
- CVE-2020-16246GE Reason S20 Ethernet SwitchGeneral Electric Reason S20 Ethernet Switch
- CVE-2020-4756IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 coulIBM Elastic Storage Server · IBM Spectrum Scale
- CVE-2020-4755IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting.IBM Spectrum Scale
- CVE-2020-4749IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies.IBM Spectrum Scale
- CVE-2020-4748IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting.IBM Spectrum Scale
- CVE-2020-4564IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 are vulnerable toIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2020-4491IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial of service by sendiIBM Spectrum Scale
- CVE-2019-4680IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.2.2 is vulnerable to SQL injection.IBM Sterling B2B Integrator
- CVE-2020-6370SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, reSAP SE SAP NetWeaver
- CVE-2020-6362SAP Banking Services version 500, use an incorrect authorization object in some of its reports.SAP SE SAP Banking Services
- CVE-2020-6308SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2020-6315SAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which can lead to leakage of SAP SE SAP 3D Visual Enterprise Viewer
- CVE-2020-7748Prototype Pollution@tsed/core
- CVE-2020-7747Cross-site Scripting (XSS)lightning-server
- CVE-2020-5640Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execute arbitrary code or SpiQe Software OneThird CMS
- CVE-2020-25648A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3.nss