# CVEs published 2020-10-23

28 CVEs were published on October 23, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-27678](https://cve.now/CVE-2020-27678.md): An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 2020102 (no CVSS)
- [CVE-2020-27388](https://cve.now/CVE-2020-27388.md): Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. (no CVSS, yourls/yourls)
- [CVE-2020-24848](https://cve.now/CVE-2020-24848.md): FruityWifi through 2.4 has an unsafe Sudo configuration \[(ALL : ALL) NOPASSWD: ALL\]. (no CVSS)
- [CVE-2020-24847](https://cve.now/CVE-2020-24847.md): A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. (no CVSS)
- [CVE-2020-5978](https://cve.now/CVE-2020-5978.md): NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in its services in which a folder is created by nvconta (no CVSS, NVIDIA GeForce Experience Software)
- [CVE-2020-5990](https://cve.now/CVE-2020-5990.md): NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local pri (no CVSS, NVIDIA GeForce Experience Software)
- [CVE-2020-5977](https://cve.now/CVE-2020-5977.md): NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an unco (no CVSS, NVIDIA GeForce Experience Software)
- [CVE-2020-25483](https://cve.now/CVE-2020-25483.md): An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access (no CVSS)
- [CVE-2020-25466](https://cve.now/CVE-2020-25466.md): A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remot (no CVSS)
- [CVE-2020-3998](https://cve.now/CVE-2020-3998.md): VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure vulnerability. (no CVSS, VMware Horizon Client for Windows)
- [CVE-2020-3997](https://cve.now/CVE-2020-3997.md): VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. (no CVSS, VMware Horizon Server)
- [CVE-2020-26561](https://cve.now/CVE-2020-26561.md): Belkin LINKSYS WRT160NL 1.0.04.002\_US\_20130619 devices have a stack-based buffer overflow vulnerability because of sprintf in create\_dir in (no CVSS)
- [CVE-2019-14715](https://cve.now/CVE-2019-14715.md): Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation. (no CVSS)
- [CVE-2020-26887](https://cve.now/CVE-2020-26887.md): FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of a DNS Rebinding protection mechanism. (no CVSS)
- [CVE-2020-15004](https://cve.now/CVE-2020-15004.md): OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS. (no CVSS)
- [CVE-2020-15003](https://cve.now/CVE-2020-15003.md): OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user ( (no CVSS)
- [CVE-2020-15002](https://cve.now/CVE-2020-15002.md): OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API. (no CVSS)
- [CVE-2020-9331](https://cve.now/CVE-2020-9331.md): CryptoPro CSP through 5.0.0.10004 on 32-bit platforms allows Local Privilege Escalation (by local users with the SeChangeNotifyPrivilege rig (no CVSS)
- [CVE-2020-9361](https://cve.now/CVE-2020-9361.md): CryptoPro CSP through 5.0.0.10004 on 64-bit platforms allows local users with the SeChangeNotifyPrivilege right to cause denial of service b (no CVSS)
- [CVE-2019-14716](https://cve.now/CVE-2019-14716.md): Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out). (no CVSS)
- [CVE-2019-14717](https://cve.now/CVE-2019-14717.md): Verifone Verix OS on VerixV Pinpad Payment Terminals with QT000530 have a Buffer Overflow via the Run system call. (no CVSS)
- [CVE-2019-14718](https://cve.now/CVE-2019-14718.md): Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svc\_netcontrol arbitrary command i (no CVSS)
- [CVE-2019-14719](https://cve.now/CVE-2019-14719.md): Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file man (no CVSS)
- [CVE-2019-14713](https://cve.now/CVE-2019-14713.md): Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages. (no CVSS)
- [CVE-2019-14712](https://cve.now/CVE-2019-14712.md): Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file generation. (no CVSS)
- [CVE-2019-14711](https://cve.now/CVE-2019-14711.md): Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have a race condition for RBAC bypass. (no CVSS)
- [CVE-2018-8062](https://cve.now/CVE-2018-8062.md): A cross-site scripting (XSS) vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04\_R02.A2pD035g.d23i firmware allows remote attac (no CVSS)
- [CVE-2020-27216](https://cve.now/CVE-2020-27216.md): In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like sys (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty… +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.