CVEs published October 22, 2020
99 CVEs were published on October 22, 2020: 0 critical, 1 high.
- Published
- 99
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 96
- Now in CISA KEV
- 0
- Fix available
- 73
Most affected products
- Apple macOS
- 21
- Apple iOS · Apple macOS +4
- 13
- Apple iOS · Apple macOS +2
- 12
- Apple iOS · Apple macOS +1
- 9
- Mozilla Firefox
- 4
- Mozilla NSS
- 3
- Apple iOS · Apple macOS
- 1
- Apple macOS · Apple watchOS
- 1
- Elasticsearch · org.elasticsearch:elasticsearch
- 1
- fabric8-maven-plugin · io.fabric8:fabric8-maven-plugin
- 1
High 1
Medium, low and unrated 98
- CVE-2020-15270Improper session expiration in Parse Serverparse-community parse-server · parse-server
- CVE-2020-27670An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak,
- CVE-2020-27671An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause
- CVE-2020-27672An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or
- CVE-2020-27673An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x.
- CVE-2020-27674An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents
- CVE-2020-27675An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x.
- CVE-2020-15680If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken imMozilla Firefox
- CVE-2020-15681When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten anothMozilla Firefox
- CVE-2020-15682When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in.Mozilla Firefox
- CVE-2020-15683Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3.Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-15684Mozilla developers reported memory safety bugs present in Firefox 81.Mozilla Firefox
- CVE-2019-17007In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of serviceMozilla NSS
- CVE-2020-18129A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.
- CVE-2019-17006In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks.Mozilla NSS
- CVE-2020-3996Velero (prior to 1.4.3 and 1.5.2) in some instances doesn’t properly manage volume identifiers which may result in information leakage to unVelero
- CVE-2018-18508In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulMozilla NSS
- CVE-2020-25186An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, which may allow file dWECON Technology Co., Ltd (WECON) LeviStudioU
- CVE-2020-13327An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions starting from 13.3.0 bGitLab Runner
- CVE-2020-10721A flaw was found in the fabric8-maven-plugin 4.0.0 and later.fabric8-maven-plugin · io.fabric8:fabric8-maven-plugin
- CVE-2019-16128Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 1 of 2).
- CVE-2019-16129Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 2 of 2).
- CVE-2020-27664admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.strapi
- CVE-2020-27665In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.strapi-plugin-content-type-builder
- CVE-2020-27666Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.strapi-plugin-content-manager
- CVE-2019-16127Atmel Advanced Software Framework (ASF) 4 has an Integer Overflow.
- CVE-2020-9994A path handling issue was addressed with improved validation.Apple iOS · Apple macOS +2
- CVE-2020-9997An information disclosure issue was addressed with improved state management.Apple macOS · Apple watchOS
- CVE-2020-9985A buffer overflow issue was addressed with improved memory handling.Apple iOS · Apple macOS +1
- CVE-2020-9984An out-of-bounds read was addressed with improved input validation.Apple iOS · Apple macOS +4
- CVE-2020-9990A race condition was addressed with additional validation.Apple macOS
- CVE-2020-9986A file access issue existed with certain home folder files.Apple macOS
- CVE-2020-9937An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS · Apple macOS +4
- CVE-2020-9940A buffer overflow issue was addressed with improved memory handling.Apple iOS · Apple macOS +1
- CVE-2020-9927A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2020-9980An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS · Apple macOS +2
- CVE-2020-9939This issue was addressed with improved checks.Apple macOS
- CVE-2020-9938An out-of-bounds read was addressed with improved input validation.Apple iOS · Apple macOS +4
- CVE-2020-9935A logic issue was addressed with improved state management.Apple macOS
- CVE-2020-9924A logic issue was addressed with improved state management.Apple macOS
- CVE-2020-9929A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2020-9928Multiple memory corruption issues were addressed with improved memory handling.Apple macOS
- CVE-2020-9919A buffer overflow issue was addressed with improved memory handling.Apple iOS · Apple macOS +4
- CVE-2020-9920A path handling issue was addressed with improved validation.Apple iOS · Apple macOS +1
- CVE-2020-9921A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2020-9902An out-of-bounds read was addressed with improved bounds checking.Apple iOS · Apple macOS +2
- CVE-2020-9904A memory corruption issue was addressed with improved state management.Apple iOS · Apple macOS +2
- CVE-2020-9908An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2020-9905A buffer overflow was addressed with improved bounds checking.Apple iOS · Apple macOS +1
- CVE-2020-9906A memory corruption issue was addressed with improved input validation.Apple iOS · Apple macOS +1
- CVE-2020-9901An issue existed within the path validation logic for symlinks.Apple iOS · Apple macOS +1
- CVE-2020-9900An issue existed within the path validation logic for symlinks.Apple iOS · Apple macOS +2
- CVE-2020-9898This issue was addressed with improved entitlements.Apple iOS · Apple macOS
- CVE-2020-9892Multiple memory corruption issues were addressed with improved state management.Apple iOS · Apple macOS +2
- CVE-2020-9879An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS · Apple macOS +4
- CVE-2020-9882A buffer overflow issue was addressed with improved memory handling.Apple iOS · Apple macOS +1
- CVE-2020-9899A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2020-9880A buffer overflow was addressed with improved bounds checking.Apple iOS · Apple macOS +2
- CVE-2020-9883A buffer overflow issue was addressed with improved memory handling.Apple iOS · Apple macOS +4
- CVE-2020-9887A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2020-9881A buffer overflow issue was addressed with improved memory handling.Apple iOS · Apple macOS +1
- CVE-2020-9873An out-of-bounds read was addressed with improved input validation.Apple iOS · Apple macOS +4
- CVE-2020-9877An out-of-bounds read was addressed with improved bounds checking.Apple iOS · Apple macOS +4
- CVE-2020-9872An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS · Apple macOS +4
- CVE-2020-9875An integer overflow was addressed through improved input validation.Apple iOS · Apple macOS +4
- CVE-2020-9876An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS · Apple macOS +4
- CVE-2020-9874An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS · Apple macOS +4
- CVE-2020-9871An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS · Apple macOS +4
- CVE-2020-9868A certificate validation issue existed when processing administrator added certificates.Apple iOS · Apple macOS +2
- CVE-2020-9863A memory initialization issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2020-9869A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2020-9854A logic issue was addressed with improved validation.Apple iOS · Apple macOS +1
- CVE-2020-9828An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2020-9853A memory corruption issue was addressed with improved validation.Apple macOS
- CVE-2020-9772A logic issue was addressed with improved restrictions.Apple iOS · Apple macOS +2
- CVE-2020-9787A logic issue was addressed with improved restrictions.Apple iOS · Apple macOS +2
- CVE-2020-9796A race condition was addressed with improved state handling.Apple macOS
- CVE-2020-9771This issue was addressed with a new entitlement.Apple macOS
- CVE-2020-9810A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2020-9779An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2020-3918An access issue was addressed with additional sandbox restrictions.Apple iOS · Apple macOS +2
- CVE-2020-3898A memory corruption issue was addressed with improved validation.Apple macOS
- CVE-2020-3915A path handling issue was addressed with improved validation.Apple macOS
- CVE-2020-15906tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.
- CVE-2020-27155An issue was discovered in Octopus Deploy through 2020.4.4.
- CVE-2020-7020Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used.Elasticsearch · org.elasticsearch:elasticsearch
- CVE-2020-27195HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or argithub.com/hashicorp/nomad
- CVE-2020-27533A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web
- CVE-2020-26650AtomXCMS 2.0 is affected by Arbitrary File Read via admin/dump.php
- CVE-2020-26649AtomXCMS 2.0 is affected by Incorrect Access Control via admin/dump.php
- CVE-2020-24033An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier.
- CVE-2020-27646Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft.
- CVE-2020-27642A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6.
- CVE-2020-27638receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.
- CVE-2020-27620The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped.
- CVE-2020-27621The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address.
- CVE-2020-27560ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
- CVE-2020-27619In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.libpython · python +1