22 October 2020

99 results · Feed

• Unscored —
  CVE-2020-9779

  An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A lo…

  Apple macOS macOS
  Oct 22, 2020
• Unscored —
  CVE-2020-3918

  An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, ma…

  Apple macOS watchOS tvOS macOS iOS
  Oct 22, 2020
• Unscored —
  CVE-2020-3898

  A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. An app…

  Apple macOS cups cups macOS Debian Ubuntu Alpine
  Oct 22, 2020
• Unscored —
  CVE-2020-3915

  A path handling issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A maliciou…

  Apple macOS macOS
  Oct 22, 2020
• Unscored —
  CVE-2020-15906 Public exploit Scanner template EPSS 27%

  tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.

  Oct 22, 2020
• Unscored —
  CVE-2020-27155

  An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted t…

  Oct 22, 2020
• Low 3.1
  CVE-2020-7020

  Privilege Context Switching Error in Elasticsearch

  Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the sear…

  Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven
  Oct 22, 2020
• Critical 9.1
  CVE-2020-27195

  Use After Free in HashiCorp Nomad

  HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6

  nomad github.com/hashicorp/nomad nomad Ubuntu Alpine Go
  Oct 22, 2020
• Unscored —
  CVE-2020-27533 Public exploit

  A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to…

  Oct 22, 2020
• Unscored —
  CVE-2020-26650

  AtomXCMS 2.0 is affected by Arbitrary File Read via admin/dump.php

  Oct 22, 2020
• Unscored —
  CVE-2020-26649

  AtomXCMS 2.0 is affected by Incorrect Access Control via admin/dump.php

  Oct 22, 2020
• Unscored —
  CVE-2020-24033 Public exploit

  An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token auth…

  Oct 22, 2020
• Unscored —
  CVE-2020-27646

  Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft.

  Oct 22, 2020
• Unscored —
  CVE-2020-27642

  A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Gr…

  Oct 22, 2020
• Unscored —
  CVE-2020-27638

  receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type …

  fastd fastd Debian Ubuntu
  Oct 22, 2020
• Unscored —
  CVE-2020-27620

  The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped.…

  Oct 22, 2020
• Unscored —
  CVE-2020-27621

  The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific …

  Oct 22, 2020
• Unscored —
  CVE-2020-27560

  ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of…

  imagemagick imagemagick imagemagick imagemagick6 Debian Ubuntu Alpine
  Oct 22, 2020
• Unscored —
  CVE-2020-27619

  In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via …

  python3.4 python3.5 python3.6 python3.8 Debian Ubuntu
  Oct 22, 2020