CVE-2020-15166

Denial of Service in ZeroMQ

In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed

Vendors

Debian Fedoraproject Zeromq

Products

Debian Linux Fedora Libzmq

CVE-2020-15165

Potentially tampered sources on Play Store for Chameleon Mini Live Debugger

Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHub Security Advisory.

CVSS 3.1 · 9.3 Critical EPSS 1.3% KEV · Not listed

Vendors

Chameleon Mini Live Debugger Project

Products

Chameleon Mini Live Debugger

CVE-2020-15164

Authentication Bypass in Scratch Login (mediawiki-scratch-login)

in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki. This affects all users on any wiki using this extension. Since version 1.1, comments by users whose usernames would be trimmed on MediaWiki are ignored when searching for the verification code.

CVSS 3.1 · 10 Critical EPSS 1.2% KEV · Not listed

Vendors

Scratch-wiki

Products

Scratch Login

CVE-2020-15163

Invalid root may become trusted root in The Update Framework (TUF)

Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Linuxfoundation

Products

The Update Framework

CVE-2020-15162

Stored XSS in PrestaShop

In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Prestashop

Products

Prestashop

CVE-2020-15161

Potential XSS in PrestaShop

In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Prestashop

Products

Prestashop

CVE-2020-15160

Blind SQL Injection in PrestaShop

PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8

CVSS 3.1 · 9.8 Critical EPSS 10.8% KEV · Not listed

Vendors

Prestashop

Products

Prestashop

CVE-2020-15159

Cross Site Scripting leading to RCE in baserCMS

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.

CVSS 3.1 · 7.6 High EPSS 2.2% KEV · Not listed

Vendors

Basercms

Products

Basercms

CVE-2020-15158

Heap buffer overflow in libIEC61850

In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap buffer overflow. This can cause an application crash or on some platforms even the execution of remote code. If your application is used in open networks or there are untrusted nodes in the network it is highly recommend to apply the patch. This was patched with commit 033ab5b. Users of version 1.4.x should upgrade to version 1.4.3 when available. As a workaround changes of commit 033ab5b can be applied to older versions.

CVSS 3.1 · 7.7 High EPSS 2.0% KEV · Not listed

Vendors

Mz-automation

Products

Libiec61850

CVE-2020-15157

containerd can be coerced into leaking credentials during image pull

In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources. Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected.

CVSS 3.1 · 6.1 Medium EPSS 2.3% KEV · Not listed

Vendors

Canonical Debian Linuxfoundation and 1 more

Products

Ubuntu Linux Debian Linux Containerd and 1 more

CVE-2020-15156

XSS due to lack of CSRF validation for replying/publishing

In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Nodebb

Products

Blog Comments

CVE-2020-15155

Cross-Site Scripting in baserCMS

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7.

CVSS 3.1 · 7.3 High EPSS 1.3% KEV · Not listed

Vendors

Basercms

Products

Basercms

CVE-2020-15154

Cross Site Scripting in baserCMS

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components are: content_fields.php, content_info.php, content_options.php, content_related.php, index_list_tree.php, jquery.bcTree.js. The issue is fixed in version 4.3.7.

CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed

Vendors

Basercms

Products

Basercms

CVE-2020-15153

Unauthenticated SQL injection in Ampache

Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for details and a workaround. This is fixed in version 4.2.2 and the development branch.

CVSS 3.1 · 8.2 High EPSS 2.4% KEV · Not listed

Vendors

Ampache

Products

Ampache

CVE-2020-15152

Server-Side Request Forgery in ftp-srv

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.

CVSS 3.1 · 9.1 Critical EPSS 1.9% KEV · Not listed

Vendors

Ftp-srv Project

Products

Ftp-srv

CVE-2020-15151

Observable Timing Discrepancy in OpenMage LTS

OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Magento Openmage

Products

Magento Openmage Long Term Support

CVE-2020-15150

Remote Code Execution in paginator(hex)

There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the paginate() function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5.

CVSS 3.1 · 9 Critical EPSS 3.3% KEV · Not listed

Vendors

Duffel

Products

Paginator

CVE-2020-15149

Account takeover in NodeBB

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3.

CVSS 3.1 · 9.9 Critical EPSS 2.4% KEV · Not listed

Vendors

Nodebb

Products

Nodebb

CVE-2020-15148

Unsafe deserialization in Yii 2

Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.

CVSS 3.1 · 8.9 High EPSS 77.5% KEV · Not listed

Vendors

Yiiframework

Products

Yii

CVE-2020-15147

Remote Code Execution in Red Discord Bot

Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue.

CVSS 3.1 · 8.5 High EPSS 2.6% KEV · Not listed

Vendors

Cogboard

Products

Red Discord Bot