CVEs published October 29, 2020
54 CVEs were published on October 29, 2020: 1 critical, 13 high.
- Published
- 54
- Critical
- 1
- High
- 13
- Medium
- 8
- Low
- 1
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- NVIDIA DGX Servers
- 9
- Synology Router Manager
- 7
- BIG-IP
- 4
- IBM i2 Analyst Notebook
- 4
- Synology DiskStation Manager
- 4
- IBM Security Directory Server
- 2
- Trend Micro Antivirus for Mac
- 2
- Ansible Community Community Collections
- 1
- BIG-IP AFM
- 1
- BIG-IP APM
- 1
Critical 1
High 13
- CVE-2020-26205XSS in Salsalopensource Sal
- CVE-2020-25646A flaw was found in Ansible Collection community.crypto.Ansible Community Community Collections
- CVE-2020-4724IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption.IBM i2 Analyst Notebook
- CVE-2020-4723IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption.IBM i2 Analyst Notebook
- CVE-2020-4722IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption.IBM i2 Analyst Notebook
- CVE-2020-4721IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption.IBM i2 Analyst Notebook
- CVE-2020-7384Client-Side Command Injection in Rapid7 MetasploitRapid7 Metasploit
- CVE-2020-27652Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackSynology DiskStation Manager
- CVE-2020-27648Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-theSynology DiskStation Manager
- CVE-2020-27658Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makeSynology Router Manager
- CVE-2020-27653Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to sSynology Router Manager
- CVE-2020-27649Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle Synology Router Manager
- CVE-2020-7746Prototype Pollutionchart.js
Medium, low and unrated 40
- CVE-2020-27014Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, thatTrend Micro Antivirus for Mac
- CVE-2020-27015Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow Trend Micro Antivirus for Mac
- CVE-2020-27885Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0.
- CVE-2020-27887An issue was discovered in EyesOfNetwork 5.3 through 5.3-8.
- CVE-2020-27886An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8.
- CVE-2020-27747An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for enteri
- CVE-2020-27998An issue was discovered in FastReport before 2020.4.0.FastReport.OpenSource
- CVE-2020-27996An issue was discovered in SmartStoreNET before 4.0.1.
- CVE-2020-27995SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.
- CVE-2020-27744An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114.
- CVE-2020-25780In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal c
- CVE-2020-4864IBM Resilient SOAR V38.0 could allow an attacker on the internal net work to provide the server with a spoofed source IP address.IBM Resilient OnPrem
- CVE-2019-4563IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies.IBM Security Directory Server
- CVE-2019-4547IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associatIBM Security Directory Server
- CVE-2020-5936On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel (TMM) process may cBIG-IP LTM
- CVE-2020-5934On BIG-IP APM 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when multiple HTTP requests from the same client to configured SAML SinBIG-IP APM
- CVE-2020-5931On BIG-IP 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, Virtual servers with a OneConnect profileBIG-IP
- CVE-2020-5932On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM Configuration utility response and blockiBIG-IP ASM
- CVE-2020-5933On versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, when a BIG-IP system that has a virtualBIG-IP
- CVE-2020-5935On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13BIG-IP
- CVE-2020-27993Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files.
- CVE-2020-21266Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting (XSS) due to a slow HTTP post vulnerability.
- CVE-2020-5937On BIG-IP AFM 15.1.0-15.1.0.5, the Traffic Management Microkernel (TMM) may produce a core file while processing layer 4 (L4) behavioral denBIG-IP AFM
- CVE-2020-5938On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peBIG-IP
- CVE-2020-25516WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks.
- CVE-2020-27656Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-Synology DiskStation Manager
- CVE-2020-27650Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makesSynology DiskStation Manager
- CVE-2020-27657Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-mSynology Router Manager
- CVE-2020-27655Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resourSynology Router Manager
- CVE-2020-27651Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easiSynology Router Manager
- CVE-2020-11615NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-codeNVIDIA DGX Servers
- CVE-2020-11616NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random NNVIDIA DGX Servers
- CVE-2020-11488NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, containNVIDIA DGX Servers
- CVE-2020-11489NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, containNVIDIA DGX Servers
- CVE-2020-11486NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which softwareNVIDIA DGX Servers
- CVE-2020-11487NVIDIA DGX servers, DGX-1 with BMC firmware versions prior to 3.38.30.NVIDIA DGX Servers
- CVE-2020-11483NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, containNVIDIA DGX Servers
- CVE-2020-11484NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attaNVIDIA DGX Servers
- CVE-2020-11485NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery (CSRF) vulnerability in theNVIDIA DGX Servers
- CVE-2020-14323A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1.Samba