CVEs published October 23, 2020
28 CVEs were published on October 23, 2020: 0 critical, 0 high.
- Published
- 28
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- NVIDIA GeForce Experience Software
- 3
- The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty… +1
- 1
- VMware Horizon Client for Windows
- 1
- VMware Horizon Server
- 1
- yourls/yourls
- 1
Medium, low and unrated 28
- CVE-2020-27678An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 2020102
- CVE-2020-27388Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10.yourls/yourls
- CVE-2020-24848FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL].
- CVE-2020-24847A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4.
- CVE-2020-5978NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in its services in which a folder is created by nvcontaNVIDIA GeForce Experience Software
- CVE-2020-5990NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local priNVIDIA GeForce Experience Software
- CVE-2020-5977NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncoNVIDIA GeForce Experience Software
- CVE-2020-25483An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access
- CVE-2020-25466A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remot
- CVE-2020-3998VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure vulnerability.VMware Horizon Client for Windows
- CVE-2020-3997VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability.VMware Horizon Server
- CVE-2020-26561Belkin LINKSYS WRT160NL 1.0.04.002_US_20130619 devices have a stack-based buffer overflow vulnerability because of sprintf in create_dir in
- CVE-2019-14715Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation.
- CVE-2020-26887FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of a DNS Rebinding protection mechanism.
- CVE-2020-15004OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS.
- CVE-2020-15003OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (
- CVE-2020-15002OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.
- CVE-2020-9331CryptoPro CSP through 5.0.0.10004 on 32-bit platforms allows Local Privilege Escalation (by local users with the SeChangeNotifyPrivilege rig
- CVE-2020-9361CryptoPro CSP through 5.0.0.10004 on 64-bit platforms allows local users with the SeChangeNotifyPrivilege right to cause denial of service b
- CVE-2019-14716Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out).
- CVE-2019-14717Verifone Verix OS on VerixV Pinpad Payment Terminals with QT000530 have a Buffer Overflow via the Run system call.
- CVE-2019-14718Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svc_netcontrol arbitrary command i
- CVE-2019-14719Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file man
- CVE-2019-14713Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages.
- CVE-2019-14712Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file generation.
- CVE-2019-14711Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have a race condition for RBAC bypass.
- CVE-2018-8062A cross-site scripting (XSS) vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04_R02.A2pD035g.d23i firmware allows remote attac
- CVE-2020-27216In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like sysThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty… +1