# CVEs published 2020-10-26 26 CVEs were published on October 26, 2020: 1 critical, 2 high. Days are UTC. - [CVE-2020-27743](https://cve.now/CVE-2020-27743.md): libtac in pam\_tacplus through 1.5.1 lacks a check for a failure of RAND\_bytes()/RAND\_pseudo\_bytes(). (no CVSS) - [CVE-2020-1915](https://cve.now/CVE-2020-1915.md): An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attac (no CVSS, Facebook Hermes · hermes-engine) - [CVE-2020-26879](https://cve.now/CVE-2020-26879.md): Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate\_token.py. (no CVSS) - [CVE-2020-26878](https://cve.now/CVE-2020-26878.md): Ruckus through 1.5.1.0.21 is affected by remote command injection. (no CVSS) - [CVE-2020-25034](https://cve.now/CVE-2020-25034.md): eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort, sort\_by, sea (no CVSS) - [CVE-2020-15274](https://cve.now/CVE-2020-15274.md): Stored XSS via search result in Wiki.js (CVSS 5.8, Requarks wiki.js) - [CVE-2020-15272](https://cve.now/CVE-2020-15272.md): Shell-injection in git-tag-annotation GitHub action (CVSS 8.7, ericcornelissen git-tag-annotation-action) - [CVE-2020-15271](https://cve.now/CVE-2020-15271.md): Shell Command Execution in lookatme (CVSS 9.3, d0c-s4vage lookatme · lookatme) - [CVE-2017-18925](https://cve.now/CVE-2017-18925.md): opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and allow a symlink atta (no CVSS) - [CVE-2020-26566](https://cve.now/CVE-2020-26566.md): A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation (no CVSS) - [CVE-2020-26161](https://cve.now/CVE-2020-26161.md): In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header. (no CVSS) - [CVE-2020-7752](https://cve.now/CVE-2020-7752.md): Command Injection (CVSS 8.8, systeminformation) - [CVE-2020-27187](https://cve.now/CVE-2020-27187.md): An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. (no CVSS) - [CVE-2020-6876](https://cve.now/CVE-2020-6876.md): A ZTE product is impacted by an XSS vulnerability. (no CVSS, eVDC) - [CVE-2020-18766](https://cve.now/CVE-2020-18766.md): A cross-site scripting (XSS) vulnerability AntSword v2.0.7 can remotely execute system commands. (no CVSS) - [CVE-2020-7127](https://cve.now/CVE-2020-7127.md): A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. (no CVSS, Aruba Airwave Software) - [CVE-2020-7126](https://cve.now/CVE-2020-7126.md): A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. (no CVSS, Aruba Airwave Software) - [CVE-2020-7125](https://cve.now/CVE-2020-7125.md): A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. (no CVSS, Aruba Airwave Software) - [CVE-2020-7124](https://cve.now/CVE-2020-7124.md): A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. (no CVSS, Aruba Airwave Software) - [CVE-2020-24632](https://cve.now/CVE-2020-24632.md): A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. (no CVSS, Aruba Airwave Software) - [CVE-2020-24631](https://cve.now/CVE-2020-24631.md): A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. (no CVSS, Aruba Airwave Software) - [CVE-2020-15897](https://cve.now/CVE-2020-15897.md): Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic (no CVSS) - [CVE-2020-7197](https://cve.now/CVE-2020-7197.md): SSMC3.7.0.0 is vulnerable to remote authentication bypass. (no CVSS, HPE 3PAR StoreServ Management and Core Software Media) - [CVE-2020-7196](https://cve.now/CVE-2020-7196.md): The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerb (no CVSS, BlueData EPIC Software; HPE Ezmeral Container Platform) - [CVE-2020-13100](https://cve.now/CVE-2020-13100.md): Arista’s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows r (no CVSS) - [CVE-2020-25470](https://cve.now/CVE-2020-25470.md): AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-10-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.