# CVEs published 2020-10-20

49 CVEs were published on October 20, 2020: 1 critical, 15 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-24412](https://cve.now/CVE-2020-24412.md): Adobe Illustrator Memory Corruption Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2020-24414](https://cve.now/CVE-2020-24414.md): Adobe Illustrator Memory Corruption Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2020-24410](https://cve.now/CVE-2020-24410.md): Adobe Illustrator PDF File Parsing Out-Of-Bounds Read Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2020-24409](https://cve.now/CVE-2020-24409.md): Adobe Illustrator PDF File Parsing Out-Of-Bounds Read Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2020-24415](https://cve.now/CVE-2020-24415.md): Adobe Illustrator Memory Corruption Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2020-24413](https://cve.now/CVE-2020-24413.md): Adobe Illustrator Memory Corruption Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2020-24411](https://cve.now/CVE-2020-24411.md): Adobe Illustrator PDF File Parsing Out-Of-Bounds Write Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2020-24416](https://cve.now/CVE-2020-24416.md): Blind stored XSS in Marketo Sales insight plugin for SalesForce (CVSS 7.5, Adobe Marketo)
- [CVE-2020-25157](https://cve.now/CVE-2020-25157.md): The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database and (no CVSS, Advantech R-SeeNet)
- [CVE-2020-5791](https://cve.now/CVE-2020-5791.md): Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute op (no CVSS, Nagios XI)
- [CVE-2020-5790](https://cve.now/CVE-2020-5790.md): Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users (no CVSS, Nagios XI)
- [CVE-2020-5792](https://cve.now/CVE-2020-5792.md): Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitra (no CVSS, Nagios XI)
- [CVE-2020-9417](https://cve.now/CVE-2020-9417.md): TIBCO Foresight SQL Injection (CVSS 7.6, TIBCO Software TIBCO Foresight Archive and Retrieval Sys… +1)
- [CVE-2020-15264](https://cve.now/CVE-2020-15264.md): Privilege Escalation in Boxstarter (CVSS 8.0, chocolatey boxstarter)
- [CVE-2020-15269](https://cve.now/CVE-2020-15269.md): Expired token reuse in Spree (CVSS 7.4, spree)
- [CVE-2020-15931](https://cve.now/CVE-2020-15931.md): Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain (no CVSS)
- [CVE-2020-24765](https://cve.now/CVE-2020-24765.md): InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monit (no CVSS)
- [CVE-2019-9080](https://cve.now/CVE-2019-9080.md): DomainMOD before 4.14.0 uses MD5 without a salt for password storage. (no CVSS)
- [CVE-2020-7371](https://cve.now/CVE-2020-7371.md): Raise IT Solutions RITS Browser Address Bar Spooofing (CVSS 4.3, Raise IT Solutions RITS Browser)
- [CVE-2020-7370](https://cve.now/CVE-2020-7370.md): Danyil Vasilenko Bolt Browser Address Bar Spooofing (CVSS 4.3, Danyil Vasilenko Bolt Browser)
- [CVE-2020-7369](https://cve.now/CVE-2020-7369.md): Yandex Browser Address Bar Spooofing (CVSS 4.3, Yandex Browser)
- [CVE-2020-7364](https://cve.now/CVE-2020-7364.md): UCWeb UC Browser Address Bar Spooofing (CVSS 4.3, UCWeb UC Browser)
- [CVE-2020-7363](https://cve.now/CVE-2020-7363.md): UCWeb UC Browser Address Bar Spooofing (CVSS 4.3, UCWeb UC Browser)
- [CVE-2020-3995](https://cve.now/CVE-2020-3995.md): In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11. (no CVSS, VMware ESXi, Workstation, Fusion)
- [CVE-2020-3994](https://cve.now/CVE-2020-3994.md): VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Manageme (no CVSS, vCenter Server)
- [CVE-2020-3993](https://cve.now/CVE-2020-3993.md): VMware NSX-T (3.x before 3.0.2, 2.5.x before 2.5.2.2.0) contains a security vulnerability that exists in the way it allows a KVM host to dow (no CVSS, VMware NSX-T)
- [CVE-2020-3992](https://cve.now/CVE-2020-3992.md): OpenSLP as used in VMware ESXi (7.0 before ESXi\_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a (CVSS 9.8, KEV, VMware ESXi)
- [CVE-2020-3982](https://cve.now/CVE-2020-3982.md): VMware ESXi (7.0 before ESXi\_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusi (no CVSS, VMware ESXi, Workstation, Fusion)
- [CVE-2020-3981](https://cve.now/CVE-2020-3981.md): VMware ESXi (7.0 before ESXi\_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusi (no CVSS, VMware ESXi, Workstation, Fusion)
- [CVE-2020-16246](https://cve.now/CVE-2020-16246.md): GE Reason S20 Ethernet Switch (no CVSS, General Electric Reason S20 Ethernet Switch)
- [CVE-2020-4756](https://cve.now/CVE-2020-4756.md): IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 coul (CVSS 6.2, IBM Elastic Storage Server · IBM Spectrum Scale)
- [CVE-2020-4755](https://cve.now/CVE-2020-4755.md): IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Spectrum Scale)
- [CVE-2020-4749](https://cve.now/CVE-2020-4749.md): IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. (CVSS 4.3, IBM Spectrum Scale)
- [CVE-2020-4748](https://cve.now/CVE-2020-4748.md): IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Spectrum Scale)
- [CVE-2020-4564](https://cve.now/CVE-2020-4564.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 are vulnerable to (CVSS 5.4, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2020-4491](https://cve.now/CVE-2020-4491.md): IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial of service by sendi (CVSS 4.0, IBM Spectrum Scale)
- [CVE-2019-4680](https://cve.now/CVE-2019-4680.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.2.2 is vulnerable to SQL injection. (CVSS 6.3, IBM Sterling B2B Integrator)
- [CVE-2020-6370](https://cve.now/CVE-2020-6370.md): SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, re (CVSS 4.8, SAP SE SAP NetWeaver)
- [CVE-2020-6367](https://cve.now/CVE-2020-6367.md): There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, (CVSS 8.2, SAP SE SAP NetWeaver Composite Application Framework)
- [CVE-2020-6362](https://cve.now/CVE-2020-6362.md): SAP Banking Services version 500, use an incorrect authorization object in some of its reports. (CVSS 4.3, SAP SE SAP Banking Services)
- [CVE-2020-6308](https://cve.now/CVE-2020-6308.md): SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arb (CVSS 5.3, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2020-6369](https://cve.now/CVE-2020-6369.md): SAP Solution Manager and SAP Focused Run (update provided in WILY\_INTRO\_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attacke (CVSS 7.5, SAP SE CA Introscope Enterprise Manager)
- [CVE-2020-6366](https://cve.now/CVE-2020-6366.md): SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. (CVSS 7.6, SAP SE SAP NetWeaver)
- [CVE-2020-6315](https://cve.now/CVE-2020-6315.md): SAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which can lead to leakage of (CVSS 5.7, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-7749](https://cve.now/CVE-2020-7749.md): Server-side Request Forgery (SSRF) (CVSS 7.6, osm-static-maps)
- [CVE-2020-7748](https://cve.now/CVE-2020-7748.md): Prototype Pollution (CVSS 5.6, @tsed/core)
- [CVE-2020-7747](https://cve.now/CVE-2020-7747.md): Cross-site Scripting (XSS) (CVSS 6.3, lightning-server)
- [CVE-2020-5640](https://cve.now/CVE-2020-5640.md): Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execute arbitrary code or (no CVSS, SpiQe Software OneThird CMS)
- [CVE-2020-25648](https://cve.now/CVE-2020-25648.md): A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. (no CVSS, nss)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.