LiveActive security incident?Get immediate response
CVE archive

September 2020

Browse CVE records published in September 2020, with severity, affected products, CWE, KEV, and source-backed vulnerability context.

Search all CVEsKnown exploited

Showing 50 of 1721 matching CVEs · Page 4 of 35.

High · CVSS 8.8

CVE-2020-0761: Active Directory Remote Code Execution Vulnerability

<p>A remote code execution vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory. An authenticated attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account</p> <p>To exploit the vulnerability, an authenticated attacker could send malicious requests to an Active Directory integrated DNS (ADIDNS) server.</p> <p>The update addresses the vulnerability by correcting how Active Directory integrated DNS (ADIDNS) handles objects in memory.</p>

Published Sep 11, 2020 · Updated Oct 1, 2024

Medium · CVSS 5.5

CVE-2020-16879: Projected Filesystem Information Disclosure Vulnerability

<p>An information disclosure vulnerability exists when a Windows Projected Filesystem improperly handles file redirections. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user's system</p> <p>To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability.</p> <p>The security update addresses the vulnerability by correcting how Windows Projected Filesystem handle file redirections.</p>

Published Sep 11, 2020 · Updated Oct 1, 2024

High · CVSS 7.8

CVE-2020-1039: Jet Database Engine Remote Code Execution Vulnerability

<p>A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.</p> <p>An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.</p> <p>The update addresses the vulnerability by correcting the way the Windows Jet Database Engine handles objects in memory.</p>

Published Sep 11, 2020 · Updated Oct 1, 2024

Medium · CVSS 6.5

CVE-2020-1097: Windows Graphics Component Information Disclosure Vulnerability

<p>An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise a user’s system.</p> <p>There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document or by convincing a user to visit an untrusted webpage.</p> <p>The update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory.</p>

Published Sep 11, 2020 · Updated Oct 1, 2024

Medium · CVSS 4.4

CVE-2020-1589: Windows Kernel Information Disclosure Vulnerability

<p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.</p>

Published Sep 11, 2020 · Updated Oct 1, 2024

Unknown · CVSS Not scored

CVE-2020-10129: CVE-2020-10129

SearchBlox before Version 9.2.1 is vulnerable to Privileged Escalation-Lower user is able to access Admin functionality.

Published Sep 6, 2023 · Updated Sep 26, 2024

Unknown · CVSS Not scored

CVE-2020-10130: CVE-2020-10130

SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system.

Published Sep 6, 2023 · Updated Sep 26, 2024

Unknown · CVSS Not scored

CVE-2020-10131: CVE-2020-10131

SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter.

Published Sep 6, 2023 · Updated Sep 26, 2024

Unknown · CVSS Not scored

CVE-2020-10132: CVE-2020-10132

SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration.

Published Sep 6, 2023 · Updated Sep 26, 2024

Unknown · CVSS Not scored

CVE-2020-36766: An issue was discovered in the Linux kernel before 5.8.6.

An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct.

Published Sep 18, 2023 · Updated Sep 25, 2024

Medium · CVSS 5.4

CVE-2020-4516: IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnera...

IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182371.

Published Sep 8, 2020 · Updated Sep 17, 2024

Critical · CVSS 9

CVE-2020-9742: Reflected XSS in AEM Inbox module

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below) and 6.3.3.8 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Inbox calendar feature. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

Published Sep 10, 2020 · Updated Sep 17, 2024

Medium · CVSS 6.6

CVE-2020-12776: Openfind Mail2000 - Broken Access Control

Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie.

Published Sep 1, 2020 · Updated Sep 17, 2024

High · CVSS 7.8

CVE-2020-9727: Out-of-bounds memory access could lead to code execution

A memory corruption vulnerability exists in InDesign 15.1.1 (and earlier versions). Insecure handling of a malicious indd file could be abused to cause an out-of-bounds memory access, potentially resulting in code execution in the context of the current user.

Published Sep 10, 2020 · Updated Sep 17, 2024

High · CVSS 7.8

CVE-2020-9731: Out-of-bounds memory access could lead to code execution

A memory corruption vulnerability exists in InDesign 15.1.1 (and earlier versions). Insecure handling of a malicious indd file could be abused to cause an out-of-bounds memory access, potentially resulting in code execution in the context of the current user.

Published Sep 10, 2020 · Updated Sep 17, 2024

Medium · CVSS 6.1

CVE-2020-9726: FrameMaker File Parsing Out-Of-Bounds Read Vulnerability

Adobe FrameMaker version 2019.0.6 (and earlier versions) has an out-of-bounds read vulnerability that could be exploited to read past the end of an allocated buffer, possibly resulting in a crash or disclosure of sensitive information from other memory locations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious FrameMaker file.

Published Sep 10, 2020 · Updated Sep 17, 2024

High · CVSS 8.7

CVE-2020-5421: RFD Protection Bypass via jsessionid

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

Published Sep 19, 2020 · Updated Sep 17, 2024

Critical · CVSS 9.3

CVE-2020-8028: salt-api is accessible to every user on SUSE Manager Server

A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root on every system managed by SUSE manager. On the managing node itself code can be executed as user salt, potentially allowing for escalation to root there. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 google-gson versions prior to 2.8.5-3.4.3, httpcomponents-client-4.5.6-3.4.2, httpcomponents-. SUSE Manager Proxy 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Retail Branch Server 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Server 3.2 salt-netapi-client versions prior to 0.16.0-4.14.1, spacewalk-. SUSE Manager Server 4.0 release-notes-susemanager versions prior to 4.0.9-3.54.1.

Published Sep 17, 2020 · Updated Sep 17, 2024

Critical · CVSS 9.8

CVE-2020-7716: Prototype Pollution

All versions of package deeps are vulnerable to Prototype Pollution via the set function.

Published Sep 1, 2020 · Updated Sep 17, 2024

High · CVSS 7.8

CVE-2020-9725: FrameMaker File Parsing Stack-based Buffer Overflow

Adobe FrameMaker version 2019.0.6 (and earlier versions) lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. This could be exploited to execute arbitrary code with the privileges of the current user. User interaction is required to exploit this vulnerability in that the target must open a malicious FrameMaker file.

Published Sep 10, 2020 · Updated Sep 17, 2024

Critical · CVSS 9

CVE-2020-9734: Stored XSS in AEM Forms component

The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.1 (and below) is affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Forms component. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

Published Sep 10, 2020 · Updated Sep 17, 2024

Medium · CVSS 6.8

CVE-2020-9737: Stored XSS in AEM's Content Repository Development Environment

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with access to the Content Repository Development Environment to store malicious scripts in certain node fields. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

Published Sep 10, 2020 · Updated Sep 17, 2024

High · CVSS 7.8

CVE-2020-7312: DLL Search Order Hijacking in MA for Windows

DLL Search Order Hijacking Vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to execute arbitrary code and escalate privileges via execution from a compromised folder.

Published Sep 10, 2020 · Updated Sep 17, 2024

High · CVSS 7.8

CVE-2020-9729: Out-of-bounds memory access could lead to code execution

A memory corruption vulnerability exists in InDesign 15.1.1 (and earlier versions). Insecure handling of a malicious indd file could be abused to cause an out-of-bounds memory access, potentially resulting in code execution in the context of the current user.

Published Sep 10, 2020 · Updated Sep 17, 2024

Unknown · CVSS Not scored

CVE-2020-15709: add-apt-repository print ASNI terminal codes

Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.

Published Sep 5, 2020 · Updated Sep 17, 2024

Medium · CVSS 6.8

CVE-2020-9736: Stored XSS in AEM's Content Repository Development Environment

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with access to the Content Repository Development Environment to store malicious scripts in certain node fields. These scripts may be executed in a victim’s browser when browsing to the page containing the vulnerable field.

Published Sep 10, 2020 · Updated Sep 17, 2024

Medium · CVSS 5.5

CVE-2020-7325: Privilege Escalation vulnerability in MVISION Endpoint

Privilege Escalation vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to access files which the user otherwise would not have access to via manipulating symbolic links to redirect McAfee file operations to an unintended file.

Published Sep 9, 2020 · Updated Sep 17, 2024