CVEs published October 30, 2020
26 CVEs were published on October 30, 2020: 0 critical, 4 high.
- Published
- 26
- Critical
- 0
- High
- 4
- Medium
- 3
- Low
- 1
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Mitsubishi Electric MELSEC iQ-R series
- 6
- baserproject basercms · baserproject/basercms
- 3
- Nextcloud Server
- 3
- IBM i2 iBase
- 2
- Check Point Endpoint Security Client for Windows
- 1
- codemirror · org.apache.marmotta.webjars:codemirror
- 1
- Mitsubishi Electric MELSEC iQ-R, Q and L series
- 1
- NVIDIA CUDA Toolkit
- 1
- Origin
- 1
- pimcore/pimcore
- 1
High 4
- CVE-2020-15273Cross-Site Scripting in baserCMSbaserproject basercms · baserproject/basercms
- CVE-2020-15276Cross Site Scripting in baserCMSbaserproject basercms · baserproject/basercms
- CVE-2020-15277Remote Code Execution in baserCMSbaserproject basercms · baserproject/basercms
- CVE-2020-4588IBM i2 iBase 8.9.13 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could resultIBM i2 iBase
Medium, low and unrated 22
- CVE-2020-28031eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users.
- CVE-2020-5991NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write opNVIDIA CUDA Toolkit
- CVE-2020-28030In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash.
- CVE-2020-8183A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.Nextcloud Server
- CVE-2020-8173A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.Nextcloud Server
- CVE-2020-8236A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification Nextcloud Server
- CVE-2020-7373vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel
- CVE-2020-15914A cross-site scripting (XSS) vulnerability exists in the Origin Client for Mac and PC 10.5.86 or earlier that could allow a remote attacker
- CVE-2020-27708A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or SyOrigin
- CVE-2020-6014Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E83.20, tries to load aCheck Point Endpoint Security Client for Windows
- CVE-2020-4584IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in theIBM i2 iBase
- CVE-2020-7760Regular Expression Denial of Service (ReDoS)codemirror · org.apache.marmotta.webjars:codemirror
- CVE-2020-7759SQL Injectionpimcore/pimcore
- CVE-2020-5657Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmwareMitsubishi Electric MELSEC iQ-R series
- CVE-2020-5658Resource Management Errors vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network InMitsubishi Electric MELSEC iQ-R series
- CVE-2020-5655NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network IntMitsubishi Electric MELSEC iQ-R series
- CVE-2020-5656Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network InterMitsubishi Electric MELSEC iQ-R series
- CVE-2020-5653Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface ModMitsubishi Electric MELSEC iQ-R series
- CVE-2020-5654Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface MoMitsubishi Electric MELSEC iQ-R series
- CVE-2020-5652Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R, Q and L series CPU modules (R 00/01/02 CPU firmware versionMitsubishi Electric MELSEC iQ-R, Q and L series
- CVE-2020-28002In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner.
- CVE-2020-25689A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating nRed Hat wildfly-core · org.wildfly:wildfly-dist