Multiple vulnerabilities were discovered in Citrix Endpoint Management (CEM) on-premise instances, also referred to as XenMobile Server. The following CVEs are part of the [CTX277457](https://support.citrix.com/article/CTX277457) security bulletin: CVE-2020-8208, CVE-2020-8209, CVE-2020-8210, CVE-2020-8211, and CVE-2020-8212. Of these, CVEs 2020-8208 and 2020-8209 are considered critical. Details on CVE-2020-8209 are [available from Positive Technologies here](https://www.ptsecurity.com/ww-en/about/news/citrix-fixes-xenmobile-vulnerability-found-by-positive-technologies/).

fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.

Multiple vulnerabilities were discovered in Citrix Endpoint Management (CEM) on-premise instances, also referred to as XenMobile Server. The following CVEs are part of the [CTX277457](https://support.citrix.com/article/CTX277457) security bulletin: CVE-2020-8208, CVE-2020-8209, CVE-2020-8210, CVE-2020-8211, and CVE-2020-8212. Of these, CVEs 2020-8208 and 2020-8209 are considered critical. Details on CVE-2020-8209 are [available from Positive Technologies here](https://www.ptsecurity.com/ww-en/about/news/citrix-fixes-xenmobile-vulnerability-found-by-positive-technologies/).

Multiple vulnerabilities were discovered in Citrix Endpoint Management (CEM) on-premise instances, also referred to as XenMobile Server. The following CVEs are part of the [CTX277457](https://support.citrix.com/article/CTX277457) security bulletin: CVE-2020-8208, CVE-2020-8209, CVE-2020-8210, CVE-2020-8211, and CVE-2020-8212. Of these, CVEs 2020-8208 and 2020-8209 are considered critical. Details on CVE-2020-8209 are [available from Positive Technologies here](https://www.ptsecurity.com/ww-en/about/news/citrix-fixes-xenmobile-vulnerability-found-by-positive-technologies/).

Multiple vulnerabilities were discovered in Citrix Endpoint Management (CEM) on-premise instances, also referred to as XenMobile Server. The following CVEs are part of the [CTX277457](https://support.citrix.com/article/CTX277457) security bulletin: CVE-2020-8208, CVE-2020-8209, CVE-2020-8210, CVE-2020-8211, and CVE-2020-8212. Of these, CVEs 2020-8208 and 2020-8209 are considered critical. Details on CVE-2020-8209 are [available from Positive Technologies here](https://www.ptsecurity.com/ww-en/about/news/citrix-fixes-xenmobile-vulnerability-found-by-positive-technologies/).

Multiple vulnerabilities were discovered in Citrix Endpoint Management (CEM) on-premise instances, also referred to as XenMobile Server. The following CVEs are part of the [CTX277457](https://support.citrix.com/article/CTX277457) security bulletin: CVE-2020-8208, CVE-2020-8209, CVE-2020-8210, CVE-2020-8211, and CVE-2020-8212. Of these, CVEs 2020-8208 and 2020-8209 are considered critical. Details on CVE-2020-8209 are [available from Positive Technologies here](https://www.ptsecurity.com/ww-en/about/news/citrix-fixes-xenmobile-vulnerability-found-by-positive-technologies/).

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service (DoS) condition.