# CVEs published 2020-10-22 99 CVEs were published on October 22, 2020: 0 critical, 1 high. Days are UTC. - [CVE-2020-15270](https://cve.now/CVE-2020-15270.md): Improper session expiration in Parse Server (CVSS 4.3, parse-community parse-server · parse-server) - [CVE-2020-11853](https://cve.now/CVE-2020-11853.md): Arbitrary code execution vulnerability on multiple Micro Focus products (CVSS 8.8, Micro Focus Operation Bridge Manager · Micro Focus Appli… +5) - [CVE-2020-27670](https://cve.now/CVE-2020-27670.md): An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, (no CVSS) - [CVE-2020-27671](https://cve.now/CVE-2020-27671.md): An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause (no CVSS) - [CVE-2020-27672](https://cve.now/CVE-2020-27672.md): An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or (no CVSS) - [CVE-2020-27673](https://cve.now/CVE-2020-27673.md): An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. (no CVSS) - [CVE-2020-27674](https://cve.now/CVE-2020-27674.md): An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents (no CVSS) - [CVE-2020-27675](https://cve.now/CVE-2020-27675.md): An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. (no CVSS) - [CVE-2020-15680](https://cve.now/CVE-2020-15680.md): If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken im (no CVSS, Mozilla Firefox) - [CVE-2020-15681](https://cve.now/CVE-2020-15681.md): When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten anoth (no CVSS, Mozilla Firefox) - [CVE-2020-15682](https://cve.now/CVE-2020-15682.md): When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. (no CVSS, Mozilla Firefox) - [CVE-2020-15683](https://cve.now/CVE-2020-15683.md): Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1) - [CVE-2020-15684](https://cve.now/CVE-2020-15684.md): Mozilla developers reported memory safety bugs present in Firefox 81. (no CVSS, Mozilla Firefox) - [CVE-2019-17007](https://cve.now/CVE-2019-17007.md): In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service (no CVSS, Mozilla NSS) - [CVE-2020-18129](https://cve.now/CVE-2020-18129.md): A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php. (no CVSS) - [CVE-2019-17006](https://cve.now/CVE-2019-17006.md): In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. (no CVSS, Mozilla NSS) - [CVE-2020-3996](https://cve.now/CVE-2020-3996.md): Velero (prior to 1.4.3 and 1.5.2) in some instances doesn’t properly manage volume identifiers which may result in information leakage to un (no CVSS, Velero) - [CVE-2018-18508](https://cve.now/CVE-2018-18508.md): In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resul (no CVSS, Mozilla NSS) - [CVE-2020-25186](https://cve.now/CVE-2020-25186.md): An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, which may allow file d (no CVSS, WECON Technology Co., Ltd (WECON) LeviStudioU) - [CVE-2020-13327](https://cve.now/CVE-2020-13327.md): An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions starting from 13.3.0 b (CVSS 6.0, GitLab Runner) - [CVE-2020-10721](https://cve.now/CVE-2020-10721.md): A flaw was found in the fabric8-maven-plugin 4.0.0 and later. (no CVSS, fabric8-maven-plugin · io.fabric8:fabric8-maven-plugin) - [CVE-2019-16128](https://cve.now/CVE-2019-16128.md): Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 1 of 2). (no CVSS) - [CVE-2019-16129](https://cve.now/CVE-2019-16129.md): Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 2 of 2). (no CVSS) - [CVE-2020-27664](https://cve.now/CVE-2020-27664.md): admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality. (no CVSS, strapi) - [CVE-2020-27665](https://cve.now/CVE-2020-27665.md): In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes. (no CVSS, strapi-plugin-content-type-builder) - [CVE-2020-27666](https://cve.now/CVE-2020-27666.md): Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature. (no CVSS, strapi-plugin-content-manager) - [CVE-2019-16127](https://cve.now/CVE-2019-16127.md): Atmel Advanced Software Framework (ASF) 4 has an Integer Overflow. (no CVSS) - [CVE-2020-9994](https://cve.now/CVE-2020-9994.md): A path handling issue was addressed with improved validation. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-9997](https://cve.now/CVE-2020-9997.md): An information disclosure issue was addressed with improved state management. (no CVSS, Apple macOS · Apple watchOS) - [CVE-2020-9985](https://cve.now/CVE-2020-9985.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +1) - [CVE-2020-9984](https://cve.now/CVE-2020-9984.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9990](https://cve.now/CVE-2020-9990.md): A race condition was addressed with additional validation. (no CVSS, Apple macOS) - [CVE-2020-9986](https://cve.now/CVE-2020-9986.md): A file access issue existed with certain home folder files. (no CVSS, Apple macOS) - [CVE-2020-9937](https://cve.now/CVE-2020-9937.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9940](https://cve.now/CVE-2020-9940.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +1) - [CVE-2020-9927](https://cve.now/CVE-2020-9927.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple macOS) - [CVE-2020-9980](https://cve.now/CVE-2020-9980.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-9939](https://cve.now/CVE-2020-9939.md): This issue was addressed with improved checks. (no CVSS, Apple macOS) - [CVE-2020-9938](https://cve.now/CVE-2020-9938.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9935](https://cve.now/CVE-2020-9935.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS) - [CVE-2020-9924](https://cve.now/CVE-2020-9924.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS) - [CVE-2020-9929](https://cve.now/CVE-2020-9929.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple macOS) - [CVE-2020-9928](https://cve.now/CVE-2020-9928.md): Multiple memory corruption issues were addressed with improved memory handling. (no CVSS, Apple macOS) - [CVE-2020-9919](https://cve.now/CVE-2020-9919.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9920](https://cve.now/CVE-2020-9920.md): A path handling issue was addressed with improved validation. (no CVSS, Apple iOS · Apple macOS +1) - [CVE-2020-9921](https://cve.now/CVE-2020-9921.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple macOS) - [CVE-2020-9902](https://cve.now/CVE-2020-9902.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-9904](https://cve.now/CVE-2020-9904.md): A memory corruption issue was addressed with improved state management. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-9908](https://cve.now/CVE-2020-9908.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS) - [CVE-2020-9905](https://cve.now/CVE-2020-9905.md): A buffer overflow was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +1) - [CVE-2020-9906](https://cve.now/CVE-2020-9906.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple iOS · Apple macOS +1) - [CVE-2020-9901](https://cve.now/CVE-2020-9901.md): An issue existed within the path validation logic for symlinks. (no CVSS, Apple iOS · Apple macOS +1) - [CVE-2020-9900](https://cve.now/CVE-2020-9900.md): An issue existed within the path validation logic for symlinks. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-9898](https://cve.now/CVE-2020-9898.md): This issue was addressed with improved entitlements. (no CVSS, Apple iOS · Apple macOS) - [CVE-2020-9892](https://cve.now/CVE-2020-9892.md): Multiple memory corruption issues were addressed with improved state management. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-9879](https://cve.now/CVE-2020-9879.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9882](https://cve.now/CVE-2020-9882.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +1) - [CVE-2020-9899](https://cve.now/CVE-2020-9899.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple macOS) - [CVE-2020-9880](https://cve.now/CVE-2020-9880.md): A buffer overflow was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-9883](https://cve.now/CVE-2020-9883.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9887](https://cve.now/CVE-2020-9887.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple macOS) - [CVE-2020-9881](https://cve.now/CVE-2020-9881.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +1) - [CVE-2020-9873](https://cve.now/CVE-2020-9873.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9877](https://cve.now/CVE-2020-9877.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9872](https://cve.now/CVE-2020-9872.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9875](https://cve.now/CVE-2020-9875.md): An integer overflow was addressed through improved input validation. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9876](https://cve.now/CVE-2020-9876.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9874](https://cve.now/CVE-2020-9874.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9871](https://cve.now/CVE-2020-9871.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple iOS · Apple macOS +4) - [CVE-2020-9868](https://cve.now/CVE-2020-9868.md): A certificate validation issue existed when processing administrator added certificates. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-9863](https://cve.now/CVE-2020-9863.md): A memory initialization issue was addressed with improved memory handling. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-9869](https://cve.now/CVE-2020-9869.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple macOS) - [CVE-2020-9854](https://cve.now/CVE-2020-9854.md): A logic issue was addressed with improved validation. (no CVSS, Apple iOS · Apple macOS +1) - [CVE-2020-9828](https://cve.now/CVE-2020-9828.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS) - [CVE-2020-9853](https://cve.now/CVE-2020-9853.md): A memory corruption issue was addressed with improved validation. (no CVSS, Apple macOS) - [CVE-2020-9772](https://cve.now/CVE-2020-9772.md): A logic issue was addressed with improved restrictions. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-9787](https://cve.now/CVE-2020-9787.md): A logic issue was addressed with improved restrictions. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-9796](https://cve.now/CVE-2020-9796.md): A race condition was addressed with improved state handling. (no CVSS, Apple macOS) - [CVE-2020-9771](https://cve.now/CVE-2020-9771.md): This issue was addressed with a new entitlement. (no CVSS, Apple macOS) - [CVE-2020-9810](https://cve.now/CVE-2020-9810.md): A logic issue was addressed with improved restrictions. (no CVSS, Apple macOS) - [CVE-2020-9779](https://cve.now/CVE-2020-9779.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS) - [CVE-2020-3918](https://cve.now/CVE-2020-3918.md): An access issue was addressed with additional sandbox restrictions. (no CVSS, Apple iOS · Apple macOS +2) - [CVE-2020-3898](https://cve.now/CVE-2020-3898.md): A memory corruption issue was addressed with improved validation. (no CVSS, Apple macOS) - [CVE-2020-3915](https://cve.now/CVE-2020-3915.md): A path handling issue was addressed with improved validation. (no CVSS, Apple macOS) - [CVE-2020-15906](https://cve.now/CVE-2020-15906.md): tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts. (no CVSS) - [CVE-2020-27155](https://cve.now/CVE-2020-27155.md): An issue was discovered in Octopus Deploy through 2020.4.4. (no CVSS) - [CVE-2020-7020](https://cve.now/CVE-2020-7020.md): Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch) - [CVE-2020-27195](https://cve.now/CVE-2020-27195.md): HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or ar (no CVSS, github.com/hashicorp/nomad) - [CVE-2020-27533](https://cve.now/CVE-2020-27533.md): A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web (no CVSS) - [CVE-2020-26650](https://cve.now/CVE-2020-26650.md): AtomXCMS 2.0 is affected by Arbitrary File Read via admin/dump.php (no CVSS) - [CVE-2020-26649](https://cve.now/CVE-2020-26649.md): AtomXCMS 2.0 is affected by Incorrect Access Control via admin/dump.php (no CVSS) - [CVE-2020-24033](https://cve.now/CVE-2020-24033.md): An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. (no CVSS) - [CVE-2020-27646](https://cve.now/CVE-2020-27646.md): Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft. (no CVSS) - [CVE-2020-27642](https://cve.now/CVE-2020-27642.md): A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6. (no CVSS) - [CVE-2020-27638](https://cve.now/CVE-2020-27638.md): receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code. (no CVSS) - [CVE-2020-27620](https://cve.now/CVE-2020-27620.md): The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. (no CVSS) - [CVE-2020-27621](https://cve.now/CVE-2020-27621.md): The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. (no CVSS) - [CVE-2020-27560](https://cve.now/CVE-2020-27560.md): ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service. (no CVSS) - [CVE-2020-27619](https://cve.now/CVE-2020-27619.md): In Python 3 through 3.9.0, the Lib/test/multibytecodec\_support.py CJK codec tests call eval() on content retrieved via HTTP. (no CVSS, libpython · python +1) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-10-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.