# CVEs published 2020-10-30 26 CVEs were published on October 30, 2020: 0 critical, 4 high. Days are UTC. - [CVE-2020-28031](https://cve.now/CVE-2020-28031.md): eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users. (no CVSS) - [CVE-2020-5991](https://cve.now/CVE-2020-5991.md): NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write op (no CVSS, NVIDIA CUDA Toolkit) - [CVE-2020-28030](https://cve.now/CVE-2020-28030.md): In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. (no CVSS) - [CVE-2020-15273](https://cve.now/CVE-2020-15273.md): Cross-Site Scripting in baserCMS (CVSS 7.3, baserproject basercms · baserproject/basercms) - [CVE-2020-15276](https://cve.now/CVE-2020-15276.md): Cross Site Scripting in baserCMS (CVSS 7.7, baserproject basercms · baserproject/basercms) - [CVE-2020-8183](https://cve.now/CVE-2020-8183.md): A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call. (no CVSS, Nextcloud Server) - [CVE-2020-8173](https://cve.now/CVE-2020-8173.md): A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended. (no CVSS, Nextcloud Server) - [CVE-2020-8236](https://cve.now/CVE-2020-8236.md): A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification (no CVSS, Nextcloud Server) - [CVE-2020-15277](https://cve.now/CVE-2020-15277.md): Remote Code Execution in baserCMS (CVSS 7.2, baserproject basercms · baserproject/basercms) - [CVE-2020-7373](https://cve.now/CVE-2020-7373.md): vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget\_tabbedcontainer\_tab\_panel (no CVSS) - [CVE-2020-15914](https://cve.now/CVE-2020-15914.md): A cross-site scripting (XSS) vulnerability exists in the Origin Client for Mac and PC 10.5.86 or earlier that could allow a remote attacker (no CVSS) - [CVE-2020-27708](https://cve.now/CVE-2020-27708.md): A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or Sy (no CVSS, Origin) - [CVE-2020-6014](https://cve.now/CVE-2020-6014.md): Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E83.20, tries to load a (no CVSS, Check Point Endpoint Security Client for Windows) - [CVE-2020-4588](https://cve.now/CVE-2020-4588.md): IBM i2 iBase 8.9.13 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result (CVSS 7.7, IBM i2 iBase) - [CVE-2020-4584](https://cve.now/CVE-2020-4584.md): IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the (CVSS 3.3, IBM i2 iBase) - [CVE-2020-7760](https://cve.now/CVE-2020-7760.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, codemirror · org.apache.marmotta.webjars:codemirror) - [CVE-2020-7759](https://cve.now/CVE-2020-7759.md): SQL Injection (CVSS 6.5, pimcore/pimcore) - [CVE-2020-5657](https://cve.now/CVE-2020-5657.md): Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware (no CVSS, Mitsubishi Electric MELSEC iQ-R series) - [CVE-2020-5658](https://cve.now/CVE-2020-5658.md): Resource Management Errors vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network In (no CVSS, Mitsubishi Electric MELSEC iQ-R series) - [CVE-2020-5655](https://cve.now/CVE-2020-5655.md): NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Int (no CVSS, Mitsubishi Electric MELSEC iQ-R series) - [CVE-2020-5656](https://cve.now/CVE-2020-5656.md): Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Inter (no CVSS, Mitsubishi Electric MELSEC iQ-R series) - [CVE-2020-5653](https://cve.now/CVE-2020-5653.md): Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Mod (no CVSS, Mitsubishi Electric MELSEC iQ-R series) - [CVE-2020-5654](https://cve.now/CVE-2020-5654.md): Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Mo (no CVSS, Mitsubishi Electric MELSEC iQ-R series) - [CVE-2020-5652](https://cve.now/CVE-2020-5652.md): Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R, Q and L series CPU modules (R 00/01/02 CPU firmware version (no CVSS, Mitsubishi Electric MELSEC iQ-R, Q and L series) - [CVE-2020-28002](https://cve.now/CVE-2020-28002.md): In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. (no CVSS) - [CVE-2020-25689](https://cve.now/CVE-2020-25689.md): A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating n (CVSS 5.3, Red Hat wildfly-core · org.wildfly:wildfly-dist) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-10-30 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.