CVEs published in October 2020
1,695 vulnerabilities, 205 critical, 15 exploited.
- mpd project mpd, stormshield network security +1 moreThe PPP implementation of MPD before 5.9 allows a remote attacker who can send specifically...7.5 High
- mpd project mpd, stormshield network security +1 moreThe L2TP implementation of MPD before 5.9 allows a remote attacker who can send specifically...9.8 Critical
- szuray iptv\/h.264 video encoder firmware, iptv\/h.265 video encoder firmware +1 moreAn issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can...7.5 High
- szuray iptv\/h.264 video encoder firmware, iptv\/h.265 video encoder firmware +1 moreAn issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can...9.8 Critical
- jtechdigital h.264 iptv encoder 1080p\@60hz firmware, provideoinstruments vecaster-4k-hevc firmware, vecaster-hd-h264 firmware +4 more +6 moreAn issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders...9.8 Critical
- jtechdigital h.264 iptv encoder 1080p\@60hz firmware, provideoinstruments vecaster-4k-hevc firmware, vecaster-hd-h264 firmware +4 more +6 moreAn issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders...7.5 High
- jtechdigital h.264 iptv encoder 1080p\@60hz firmware, provideoinstruments vecaster-4k-hevc firmware, vecaster-hd-h264 firmware +4 more +6 moreAn issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders...9.8 Critical
- jtechdigital h.264 iptv encoder 1080p\@60hz firmware, provideoinstruments vecaster-4k-hevc firmware, vecaster-hd-h264 firmware +4 more +6 moreAn issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders...9.8 Critical
- car rental management system project rental management systemA Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car...6.1 Medium
- monocmsCross Site Request Forgery (CSRF) vulnerability in MonoCMS Blog version as of 29-09-2020 allows...6.5 Medium
- monocmsMonoCMS Blog version as of 29-09-2020 stores hard-coded admin hashes in the log.xml file in the...7.5 High
- gnu glibcmanual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the...9.8 Critical
- red hat, inc. spice, canonical ubuntu linux, debian linux +7 more +9 moreMultiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the...6.6 Medium
- elecom wrc-1167gst2 firmware, wrc-1750gst2 firmware, wrc-1900gst2 firmware +2 more +4 moreELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions...8.8 High
- nec infocage siteshell, nec corporation infocage siteshell series +1 moreInfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell...7.8 High
- cmonos, cmonos co. ltd. cmonos.jp +1 moreStored cross-site scripting vulnerability in CMONOS.JP ver2.0.20191009 and earlier allows remote...6.1 Medium
- opensc project opensc, debian linux, fedoraproject fedora +2 moreThe Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer...5.5 Medium
- opensc project opensc, debian linux, fedoraproject fedora +2 moreThe gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer...5.5 Medium
- opensc project opensc, debian linux, fedoraproject fedora +2 moreThe TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow...5.5 Medium
openscOSS-FuzzHeap-buffer-overflow in sc_oberthur_parse_privateinfoNo score- redhat wildfly openssl, netapp oncommand insight, oncommand workflow automation +7 more +9 moreWildfly-OpenSSL memory leak flaw7.5 High
- debian linux, linux kernel, netapp h410c firmware +3 more +5 moreA flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory...7.2 High
- mitsubishi electric conveyor tracking application, d55up12-v, fr-a800-e series +149 more +151 moreMitsubishi Electric Multiple Products9.8 Critical
- shrinerb shrineTiming attack in Shrine5.9 Medium
- jumpmind symmetricdsSymmetric DS <3.12.0 uses mx4j to provide access to JMX over HTTP. mx4j, by default, has no auth...9.8 Critical
- opnsense coreSensitive data exposure in RACTF5.9 Medium
- requarks wiki, wiki.js +1 moreDirectory Traversal in Wiki.js8.6 High
- zte zxone 19700 snpe firmwareA ZTE product is impacted by the improper access control vulnerability. Due to lack of an...9.8 Critical
- cuppacmsThe file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload...8.8 High
- intel biosImproper conditions check in BIOS firmware for 8th Generation Intel(R) Core(TM) Processors and...5.5 Medium
- intel biosImproper initialization in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R...4.4 Medium
- intel biosInsufficient control flow management in BIOS firmware 8th, 9th Generation Intel(R) Core(TM)...5.5 Medium
- intel corporation intel(r) driver & support assistant, intel driver \& support assistant +1 moreImproper permissions in the Intel(R) Driver & Support Assistant before version 20.7.26.7 may...7.8 High
- intel biosBuffer overflow in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R)...8.0 High
- clickstudios passwordstateClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an...7.5 High
- ibm maximo asset managementIBM Maximo Asset Management 7.6.0 and 7.6.1 could allow an attacker to bypass authentication and...9.8 Critical
- redhat ansible, ansible community community collections +1 moreAnsible does not collect garbage after playbook run5.0 Medium
- nextcloud deckImproper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with...8.0 High
- hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreA logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users...6.5 Medium
- nextcloud deckMissing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference...4.3 Medium
- nextcloud preferred providers, opensuse backports sle, leap +2 moreA missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password...5.3 Medium
- redhat ansible, ansible community community collections +1 moreA flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have…6.6 Medium
- qdpmThe file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote...5.4 Medium
- manuelstofer json-pointerPrototype Pollution6.0 Medium
- oauth2-server project oauth2-serverCode Injection in oauth2-server7.5 High
- zabbix, debian linux, opensuse backports sle +1 more +3 moreZabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary...9.0 Critical
openscOSS-FuzzStack-buffer-overflow in fuzz_reader_transmitNo scorebcm43xx-firmwareopenSUSESecurity update for bcm43xx-firmwareNo scoreflacOSS-FuzzUse-of-uninitialized-value in FLAC::Decoder::FuzzerStream::write_callbackNo scorelibresslOSS-FuzzUNKNOWN READ in asn1_item_print_ctxNo score- Show moreLoading…