# CVEs published 2020-10-31

14 CVEs were published on October 31, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-5425](https://cve.now/CVE-2020-5425.md): User Impersonation possible in Tanzu SSO (CVSS 7.5, Single Sign-On for VMware Tanzu)
- [CVE-2020-27359](https://cve.now/CVE-2020-27359.md): A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Mes (no CVSS)
- [CVE-2020-27358](https://cve.now/CVE-2020-27358.md): An issue was discovered in REDCap 8.11.6 through 9.x before 10. (no CVSS)
- [CVE-2020-27992](https://cve.now/CVE-2020-27992.md): Dr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because %PROGRAMFILES(X86)%\\Wondershare\\dr.fone\\Lib (no CVSS)
- [CVE-2020-15703](https://cve.now/CVE-2020-15703.md): aptdaemon allows unprivileged users to test for the presence of local files via the transaction Locale property (CVSS 4.0, Canonical aptdaemon · aptdaemon)
- [CVE-2020-28032](https://cve.now/CVE-2020-28032.md): WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. (no CVSS)
- [CVE-2020-28033](https://cve.now/CVE-2020-28033.md): WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. (no CVSS)
- [CVE-2020-28034](https://cve.now/CVE-2020-28034.md): WordPress before 5.5.2 allows XSS associated with global variables. (no CVSS)
- [CVE-2020-28036](https://cve.now/CVE-2020-28036.md): wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. (no CVSS)
- [CVE-2020-28037](https://cve.now/CVE-2020-28037.md): is\_blog\_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which (no CVSS)
- [CVE-2020-28038](https://cve.now/CVE-2020-28038.md): WordPress before 5.5.2 allows stored XSS via post slugs. (no CVSS)
- [CVE-2020-28040](https://cve.now/CVE-2020-28040.md): WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. (no CVSS)
- [CVE-2020-28039](https://cve.now/CVE-2020-28039.md): is\_protected\_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine wh (no CVSS)
- [CVE-2020-28035](https://cve.now/CVE-2020-28035.md): WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.