CVEs published in October 2020
1,695 vulnerabilities, 205 critical, 15 exploited.
- vmware tanzu single sign-on for vmware tanzu, vmware single sign-on for tanzu +1 more User Impersonation possible in Tanzu SSO 7.5 High
- evms redcap A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to... 5.4 Medium
- vanderbilt redcap An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that... 4.3 Medium
- wondershare dr.fone Dr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because ... 7.8 High
- atomic-option project atomic-option Data race in atomic-option 5.9 Medium
- futures-intrusive project futures-intrusive Data races in futures-intrusive 5.5 Medium
- wordpress, debian linux, fedoraproject fedora +2 more WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility... 9.8 Critical
- wordpress, debian linux, fedoraproject fedora +2 more WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as... 7.5 High
- wordpress, debian linux, fedoraproject fedora +2 more WordPress before 5.5.2 allows XSS associated with global variables. 6.1 Medium
- wordpress, debian linux, fedoraproject fedora +2 more wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain... 9.8 Critical
- wordpress, debian linux, fedoraproject fedora +2 more is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines... 9.8 Critical
- wordpress, debian linux, fedoraproject fedora +2 more WordPress before 5.5.2 allows stored XSS via post slugs. 6.1 Medium
- wordpress, canonical ubuntu linux, debian linux +2 more WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. 4.3 Medium
- wordpress, canonical ubuntu linux, debian linux +2 more is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file... 9.1 Critical
- wordpress, debian linux, fedoraproject fedora +2 more WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. 9.8 Critical
-
crasOSS-Fuzz Heap-buffer-overflow in ccr_handle_message_from_client No score -
simdjsonOSS-Fuzz Stack-buffer-overflow in simdjson::internal::decimal_right_shift No score -
tzdataDebian tzdata - new upstream version No score - eramba eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf... 4.3 Medium
- nvidia cuda toolkit NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library... 7.8 High
- wireshark, debian linux, fedoraproject fedora +2 more In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan... 7.5 High
- basercms Cross-Site Scripting in baserCMS 7.3 High
- basercms Cross Site Scripting in baserCMS 7.7 High
- hackerone nextcloud server, nextcloud server +1 more A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed... 2.2 Low
- hackerone nextcloud server, nextcloud server +1 more A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless... 6.8 Medium
- basercms Remote Code Execution in baserCMS 7.2 High
- vbulletin vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an... 9.8 Critical
- ea origin client A cross-site scripting (XSS) vulnerability exists in the Origin Client that could allow a remote... 5.4 Medium
- ea origin A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate... 7.8 High
- check point endpoint security client for windows, checkpoint endpoint security +1 more Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades... 6.5 Medium
- ibm i2 ibase IBM i2 iBase 8.9.13 could allow an attacker to upload arbitrary executable files which, when... 7.7 High
- ibm i2 ibase IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed... 3.3 Low
- codemirror, oracle application express, enterprise manager express user interface +3 more +5 more Regular Expression Denial of Service (ReDoS) 5.3 Medium
- pimcore, pimcore pimcore/pimcore +1 more SQL Injection 6.5 Medium
- mitsubishi electric corporation melsec iq-r series, mitsubishielectric melsec iq-rd81dl96 firmware, melsec iq-rd81mes96n firmware +3 more +5 more Resource Management Errors vulnerability in TCP/IP function included in the firmware of MELSEC iQ... 7.5 High
- mitsubishi electric corporation melsec iq-r series, mitsubishielectric melsec iq-rd81dl96 firmware, melsec iq-rd81mes96n firmware +3 more +5 more Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability... 6.5 Medium
- mitsubishi electric corporation melsec iq-r series, mitsubishielectric melsec iq-rd81dl96 firmware, melsec iq-rd81mes96n firmware +3 more +5 more Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R... 9.8 Critical
- mitsubishi electric corporation melsec iq-r series, mitsubishielectric melsec iq-rd81dl96 firmware, melsec iq-rd81mes96n firmware +3 more +5 more NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ... 7.5 High
- mitsubishi electric corporation melsec iq-r series, mitsubishielectric melsec iq-rd81dl96 firmware, melsec iq-rd81mes96n firmware +3 more +5 more Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series ... 7.5 High
- mitsubishi electric corporation melsec iq-r series, mitsubishielectric melsec iq-rd81dl96 firmware, melsec iq-rd81mes96n firmware +3 more +5 more Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series ... 9.8 Critical
- mitsubishi electric corporation melsec iq-r, q and l series, mitsubishielectric melsec iq-r00cpu firmware, melsec iq-r01cpu firmware +49 more +51 more Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R, Q and L series... 7.5 High
- sonarsource sonarqube In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through... 5.3 Medium
-
openh264OSS-Fuzz Heap-buffer-overflow in WelsDec::ParseIntra4x4Mode No score - openldap, netapp cloud backup, solidfire baseboard management controller firmware +4 more +6 more A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during... 7.5 High
- redhat wildfly, netapp active iq unified manager, oncommand insight +8 more +10 more Uncontrolled Resource Consumption in WildFly 5.3 Medium
- trendmicro antivirus, trend micro antivirus for mac (consumer) +1 more Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure... 4.4 Medium
- trendmicro antivirus, trend micro antivirus for mac (consumer) +1 more Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web... 6.4 Medium
- wso2 api manager Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site... 6.1 Medium
- sal project sal XSS in Sal 7.6 High
- ansible collections project community.crypto, ansible community community collections +1 more A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private... 7.5 High
- Show olderLoading…