# CVEs published 2020-10-29

54 CVEs were published on October 29, 2020: 1 critical, 13 high. Days are UTC.

- [CVE-2020-27014](https://cve.now/CVE-2020-27014.md): Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, that (no CVSS, Trend Micro Antivirus for Mac)
- [CVE-2020-27015](https://cve.now/CVE-2020-27015.md): Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow (no CVSS, Trend Micro Antivirus for Mac)
- [CVE-2020-27885](https://cve.now/CVE-2020-27885.md): Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. (no CVSS)
- [CVE-2020-26205](https://cve.now/CVE-2020-26205.md): XSS in Sal (CVSS 7.6, salopensource Sal)
- [CVE-2020-25646](https://cve.now/CVE-2020-25646.md): A flaw was found in Ansible Collection community.crypto. (CVSS 7.5, Ansible Community Community Collections)
- [CVE-2020-27887](https://cve.now/CVE-2020-27887.md): An issue was discovered in EyesOfNetwork 5.3 through 5.3-8. (no CVSS)
- [CVE-2020-27886](https://cve.now/CVE-2020-27886.md): An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. (no CVSS)
- [CVE-2020-27747](https://cve.now/CVE-2020-27747.md): An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for enteri (no CVSS)
- [CVE-2020-27998](https://cve.now/CVE-2020-27998.md): An issue was discovered in FastReport before 2020.4.0. (no CVSS, FastReport.OpenSource)
- [CVE-2020-27996](https://cve.now/CVE-2020-27996.md): An issue was discovered in SmartStoreNET before 4.0.1. (no CVSS)
- [CVE-2020-27995](https://cve.now/CVE-2020-27995.md): SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage. (no CVSS)
- [CVE-2020-27744](https://cve.now/CVE-2020-27744.md): An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114. (no CVSS)
- [CVE-2020-25780](https://cve.now/CVE-2020-25780.md): In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal c (no CVSS)
- [CVE-2020-4864](https://cve.now/CVE-2020-4864.md): IBM Resilient SOAR V38.0 could allow an attacker on the internal net work to provide the server with a spoofed source IP address. (CVSS 4.3, IBM Resilient OnPrem)
- [CVE-2020-4724](https://cve.now/CVE-2020-4724.md): IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. (CVSS 7.8, IBM i2 Analyst Notebook)
- [CVE-2020-4723](https://cve.now/CVE-2020-4723.md): IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. (CVSS 7.8, IBM i2 Analyst Notebook)
- [CVE-2020-4722](https://cve.now/CVE-2020-4722.md): IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. (CVSS 7.8, IBM i2 Analyst Notebook)
- [CVE-2020-4721](https://cve.now/CVE-2020-4721.md): IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. (CVSS 7.8, IBM i2 Analyst Notebook)
- [CVE-2019-4563](https://cve.now/CVE-2019-4563.md): IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.7, IBM Security Directory Server)
- [CVE-2019-4547](https://cve.now/CVE-2019-4547.md): IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associat (CVSS 5.3, IBM Security Directory Server)
- [CVE-2020-5936](https://cve.now/CVE-2020-5936.md): On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel (TMM) process may c (no CVSS, BIG-IP LTM)
- [CVE-2020-5934](https://cve.now/CVE-2020-5934.md): On BIG-IP APM 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when multiple HTTP requests from the same client to configured SAML Sin (no CVSS, BIG-IP APM)
- [CVE-2020-5931](https://cve.now/CVE-2020-5931.md): On BIG-IP 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, Virtual servers with a OneConnect profile (no CVSS, BIG-IP)
- [CVE-2020-5932](https://cve.now/CVE-2020-5932.md): On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM Configuration utility response and blocki (no CVSS, BIG-IP ASM)
- [CVE-2020-5933](https://cve.now/CVE-2020-5933.md): On versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, when a BIG-IP system that has a virtual (no CVSS, BIG-IP)
- [CVE-2020-5935](https://cve.now/CVE-2020-5935.md): On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13 (no CVSS, BIG-IP)
- [CVE-2020-27993](https://cve.now/CVE-2020-27993.md): Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files. (no CVSS)
- [CVE-2020-7384](https://cve.now/CVE-2020-7384.md): Client-Side Command Injection in Rapid7 Metasploit (CVSS 7.0, Rapid7 Metasploit)
- [CVE-2020-21266](https://cve.now/CVE-2020-21266.md): Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting (XSS) due to a slow HTTP post vulnerability. (no CVSS)
- [CVE-2020-5937](https://cve.now/CVE-2020-5937.md): On BIG-IP AFM 15.1.0-15.1.0.5, the Traffic Management Microkernel (TMM) may produce a core file while processing layer 4 (L4) behavioral den (no CVSS, BIG-IP AFM)
- [CVE-2020-5938](https://cve.now/CVE-2020-5938.md): On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the pe (no CVSS, BIG-IP)
- [CVE-2020-25516](https://cve.now/CVE-2020-25516.md): WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks. (no CVSS)
- [CVE-2020-27656](https://cve.now/CVE-2020-27656.md): Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man- (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2020-27652](https://cve.now/CVE-2020-27652.md): Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attack (CVSS 8.3, Synology DiskStation Manager)
- [CVE-2020-27650](https://cve.now/CVE-2020-27650.md): Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes (CVSS 5.8, Synology DiskStation Manager)
- [CVE-2020-27648](https://cve.now/CVE-2020-27648.md): Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the (CVSS 8.3, Synology DiskStation Manager)
- [CVE-2020-27658](https://cve.now/CVE-2020-27658.md): Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which make (CVSS 7.1, Synology Router Manager)
- [CVE-2020-27657](https://cve.now/CVE-2020-27657.md): Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-m (CVSS 6.5, Synology Router Manager)
- [CVE-2020-27655](https://cve.now/CVE-2020-27655.md): Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resour (CVSS 6.5, Synology Router Manager)
- [CVE-2020-27654](https://cve.now/CVE-2020-27654.md): Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary (CVSS 9.8, Synology Router Manager)
- [CVE-2020-27653](https://cve.now/CVE-2020-27653.md): Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to s (CVSS 8.3, Synology Router Manager)
- [CVE-2020-27651](https://cve.now/CVE-2020-27651.md): Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easi (CVSS 5.8, Synology Router Manager)
- [CVE-2020-27649](https://cve.now/CVE-2020-27649.md): Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle (CVSS 8.3, Synology Router Manager)
- [CVE-2020-7746](https://cve.now/CVE-2020-7746.md): Prototype Pollution (CVSS 7.5, chart.js)
- [CVE-2020-11615](https://cve.now/CVE-2020-11615.md): NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-code (no CVSS, NVIDIA DGX Servers)
- [CVE-2020-11616](https://cve.now/CVE-2020-11616.md): NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random N (no CVSS, NVIDIA DGX Servers)
- [CVE-2020-11488](https://cve.now/CVE-2020-11488.md): NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain (no CVSS, NVIDIA DGX Servers)
- [CVE-2020-11489](https://cve.now/CVE-2020-11489.md): NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain (no CVSS, NVIDIA DGX Servers)
- [CVE-2020-11486](https://cve.now/CVE-2020-11486.md): NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software (no CVSS, NVIDIA DGX Servers)
- [CVE-2020-11487](https://cve.now/CVE-2020-11487.md): NVIDIA DGX servers, DGX-1 with BMC firmware versions prior to 3.38.30. (no CVSS, NVIDIA DGX Servers)
- [CVE-2020-11483](https://cve.now/CVE-2020-11483.md): NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain (no CVSS, NVIDIA DGX Servers)
- [CVE-2020-11484](https://cve.now/CVE-2020-11484.md): NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an atta (no CVSS, NVIDIA DGX Servers)
- [CVE-2020-11485](https://cve.now/CVE-2020-11485.md): NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery (CSRF) vulnerability in the (no CVSS, NVIDIA DGX Servers)
- [CVE-2020-14323](https://cve.now/CVE-2020-14323.md): A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. (CVSS 5.5, Samba)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.