CVEs published October 26, 2020
26 CVEs were published on October 26, 2020: 1 critical, 2 high.
- Published
- 26
- Critical
- 1
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Aruba Airwave Software
- 6
- BlueData EPIC Software; HPE Ezmeral Container Platform
- 1
- d0c-s4vage lookatme · lookatme
- 1
- ericcornelissen git-tag-annotation-action
- 1
- eVDC
- 1
- Facebook Hermes · hermes-engine
- 1
- HPE 3PAR StoreServ Management and Core Software Media
- 1
- Requarks wiki.js
- 1
- systeminformation
- 1
Critical 1
High 2
Medium, low and unrated 23
- CVE-2020-27743libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes().
- CVE-2020-1915An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attacFacebook Hermes · hermes-engine
- CVE-2020-26879Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py.
- CVE-2020-26878Ruckus through 1.5.1.0.21 is affected by remote command injection.
- CVE-2020-25034eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort, sort_by, sea
- CVE-2020-15274Stored XSS via search result in Wiki.jsRequarks wiki.js
- CVE-2017-18925opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and allow a symlink atta
- CVE-2020-26566A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation
- CVE-2020-26161In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header.
- CVE-2020-27187An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0.
- CVE-2020-6876A ZTE product is impacted by an XSS vulnerability.eVDC
- CVE-2020-18766A cross-site scripting (XSS) vulnerability AntSword v2.0.7 can remotely execute system commands.
- CVE-2020-7127A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.Aruba Airwave Software
- CVE-2020-7126A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.Aruba Airwave Software
- CVE-2020-7125A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.Aruba Airwave Software
- CVE-2020-7124A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.Aruba Airwave Software
- CVE-2020-24632A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.Aruba Airwave Software
- CVE-2020-24631A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.Aruba Airwave Software
- CVE-2020-15897Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic
- CVE-2020-7197SSMC3.7.0.0 is vulnerable to remote authentication bypass.HPE 3PAR StoreServ Management and Core Software Media
- CVE-2020-7196The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive KerbBlueData EPIC Software; HPE Ezmeral Container Platform
- CVE-2020-13100Arista’s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows r
- CVE-2020-25470AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion.