Weekly Vulnerabilities Reports > August 24 to 30, 2020

Overview

279 new vulnerabilities reported during this period, including 17 critical vulnerabilities and 37 high severity vulnerabilities. This weekly summary report vulnerabilities in 333 products from 120 vendors including IBM, Cisco, F5, Dbhcms Project, and Parallels. Vulnerabilities are notably categorized as "Cross-site Scripting", "Information Exposure", "Path Traversal", "Improper Input Validation", and "SQL Injection".

  • 232 reported vulnerabilities are remotely exploitables.
  • 3 reported vulnerabilities have public exploit available.
  • 124 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 193 reported vulnerabilities are exploitable by an anonymous user.
  • IBM has the most reported vulnerabilities, with 35 reported vulnerabilities.
  • Marvell has the most reported critical vulnerabilities, with 8 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

17 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2020-08-26 CVE-2020-14498 HMS Networks Out-Of-Bounds Write vulnerability in Hms-Networks Ecatcher

HMS Industrial Networks AB eCatcher all versions prior to 6.5.5.

10.0
2020-08-25 CVE-2020-15639 Marvell Path Traversal vulnerability in Marvell Qconvergeconsole

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

10.0
2020-08-25 CVE-2020-14510 Secomea Off-By-One Error vulnerability in Secomea Gatemanager 8250 Firmware 9.2C

GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as root.

10.0
2020-08-24 CVE-2020-7376 Rapid7 Path Traversal vulnerability in Rapid7 Metasploit

The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can be exploited to write arbitrary files to arbitrary locations on the host filesystem when the module is run on a malicious host.

10.0
2020-08-26 CVE-2019-5321 Arubanetworks Incorrect Authorization vulnerability in Arubanetworks products

Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* before 16.09.0007, 16.10.* before 16.10.0003 are vulnerable to Remote Unauthorized Access in the WebUI.

9.3
2020-08-26 CVE-2020-5922 F5 Cross-Site Request Forgery (CSRF) vulnerability in F5 products

In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser.

9.3
2020-08-27 CVE-2020-3454 Cisco OS Command Injection vulnerability in Cisco Nx-Os

A vulnerability in the Call Home feature of Cisco NX-OS Software could allow an authenticated, remote attacker to inject arbitrary commands that could be executed with root privileges on the underlying operating system (OS).

9.0
2020-08-26 CVE-2019-4713 IBM OS Command Injection vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system.

9.0
2020-08-25 CVE-2020-17389 Marvell Path Traversal vulnerability in Marvell Qconvergeconsole

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

9.0
2020-08-25 CVE-2020-17388 Marvell Exposed Dangerous Method OR Function vulnerability in Marvell Qconvergeconsole

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

9.0
2020-08-25 CVE-2020-17387 Marvell Path Traversal vulnerability in Marvell Qconvergeconsole

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

9.0
2020-08-25 CVE-2020-15645 Marvell Unrestricted Upload of File With Dangerous Type vulnerability in Marvell Qconvergeconsole

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

9.0
2020-08-25 CVE-2020-15644 Marvell Path Traversal vulnerability in Marvell Qconvergeconsole

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

9.0
2020-08-25 CVE-2020-15643 Marvell Path Traversal vulnerability in Marvell Qconvergeconsole

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.

9.0
2020-08-25 CVE-2020-15642 Marvell Command Injection vulnerability in Marvell Qconvergeconsole

This vulnerability allows remote attackers to execute arbitrary code on affected installations of installations of Marvell QConvergeConsole 5.5.0.64.

9.0
2020-08-25 CVE-2020-17384 Cellopoint OS Command Injection vulnerability in Cellopoint Cellos 4.1.10

Cellopoint Cellos v4.1.10 Build 20190922 does not validate URL inputted properly.

9.0
2020-08-24 CVE-2020-24572 Raspap OS Command Injection vulnerability in Raspap 2.5

An issue was discovered in includes/webconsole.php in RaspAP 2.5.

9.0

37 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2020-08-30 CVE-2020-14352 Redhat
Opensuse
Fedoraproject
Path Traversal vulnerability in multiple products

A flaw was found in librepo in versions before 1.12.1.

8.5
2020-08-26 CVE-2020-3507 Cisco Improper Input Validation vulnerability in Cisco products

Multiple vulnerabilities in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP camera.

8.3
2020-08-26 CVE-2020-3506 Cisco Improper Input Validation vulnerability in Cisco products

Multiple vulnerabilities in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP camera.

8.3
2020-08-27 CVE-2020-3415 Cisco Out-Of-Bounds Write vulnerability in Cisco Nx-Os

A vulnerability in the Data Management Engine (DME) of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device.

7.9
2020-08-29 CVE-2020-3566 Cisco Resource Exhaustion vulnerability in Cisco IOS XR 6.4.2

A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device.

7.8
2020-08-27 CVE-2020-3517 Cisco Null Pointer Dereference vulnerability in Cisco Fxos and Nx-Os

A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to cause process crashes, which could result in a denial of service (DoS) condition on an affected device.

7.8
2020-08-29 CVE-2020-25020 Mpxj XXE vulnerability in Mpxj

MPXJ through 8.1.3 allows XXE attacks.

7.5
2020-08-28 CVE-2020-5624 Riken SQL Injection vulnerability in Riken Xoonips

SQL injection vulnerability in the XooNIps 3.48 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

7.5
2020-08-27 CVE-2020-24203 Projects World Travel Management System Project Unrestricted Upload of File With Dangerous Type vulnerability in Projects World Travel Management System Project Projects World Travel Management System 1.0

Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.

7.5
2020-08-27 CVE-2020-24202 Projectworlds Unrestricted Upload of File With Dangerous Type vulnerability in Projectworlds House Rental and Property Listing Project 1.0

File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regular users, which allows remote attackers to conduct code execution.

7.5
2020-08-27 CVE-2020-23979 13Enforme SQL Injection vulnerability in 13Enforme CMS 1.0

13enforme CMS 1.0 has SQL Injection via the 'content.php' id parameter.

7.5
2020-08-27 CVE-2020-23978 Soluzioneglobale SQL Injection vulnerability in Soluzioneglobale Ecommerce CMS 1.0

SQL injection can occur in Soluzione Globale Ecommerce CMS v1 via the parameter " offerta.php"

7.5
2020-08-27 CVE-2020-23976 Webexcels SQL Injection vulnerability in Webexcels Ecommerce CMS

Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has SQL Injection via the 'content.php' id parameter.

7.5
2020-08-27 CVE-2020-23973 Kandnconcepts Club CMS Project SQL Injection vulnerability in Kandnconcepts Club CMS Project Kandnconcepts Club CMS 1.1/1.2

KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter.

7.5
2020-08-27 CVE-2020-23980 Designmasterevents SQL Injection vulnerability in Designmasterevents Conference Management 1.0.0

DesignMasterEvents Conference management 1.0.0 allows SQL Injection via the username field on the administrator login page.

7.5
2020-08-26 CVE-2019-4694 IBM USE of Hard-Coded Credentials vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

7.5
2020-08-26 CVE-2020-15158 MZ Automation Heap-Based Buffer Overflow vulnerability in Mz-Automation Libiec61850

In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap buffer overflow.

7.5
2020-08-26 CVE-2020-3446 Cisco USE of Hard-Coded Credentials vulnerability in Cisco products

A vulnerability in Cisco Virtual Wide Area Application Services (vWAAS) with Cisco Enterprise NFV Infrastructure Software (NFVIS)-bundled images for Cisco ENCS 5400-W Series and CSP 5000-W Series appliances could allow an unauthenticated, remote attacker to log into the NFVIS CLI of an affected device by using accounts that have a default, static password.

7.5
2020-08-26 CVE-2020-16251 Hashicorp Improper Authentication vulnerability in Hashicorp Vault

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass.

7.5
2020-08-26 CVE-2020-16250 Hashicorp Improper Authentication vulnerability in Hashicorp Vault

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass.

7.5
2020-08-26 CVE-2020-24007 Umanni Improper Restriction of Excessive Authentication Attempts vulnerability in Umanni Human Resources 1.0

Umanni RH 1.0 does not limit the number of authentication attempts.

7.5
2020-08-26 CVE-2019-18847 Akamai Improper Certificate Validation vulnerability in Akamai Enterprise Application Access

Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1.

7.5
2020-08-25 CVE-2020-16245 Advantech Path Traversal vulnerability in Advantech Iview 5.6

Advantech iView, Versions 5.7 and prior.

7.5
2020-08-25 CVE-2020-14524 Softing Out-Of-Bounds Write vulnerability in Softing OPC

Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.

7.5
2020-08-25 CVE-2020-14508 Secomea Off-By-One Error vulnerability in Secomea Gatemanager 8250 Firmware 9.2C

GateManager versions prior to 9.2c, The affected product is vulnerable to an off-by-one error, which may allow an attacker to remotely execute arbitrary code or cause a denial-of-service condition.

7.5
2020-08-25 CVE-2020-14500 Secomea Null Pointer Dereference vulnerability in Secomea Gatemanager 8250 Firmware 9.2C

Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.

7.5
2020-08-24 CVE-2020-6637 Os4Ed SQL Injection vulnerability in Os4Ed Opensis 7.3

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.

7.5
2020-08-24 CVE-2020-24186 Gvectors Unrestricted Upload of File With Dangerous Type vulnerability in Gvectors Wpdiscuz

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.

7.5
2020-08-27 CVE-2020-24717 Openzfs Incorrect Default Permissions vulnerability in Openzfs

OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777.

7.2
2020-08-27 CVE-2020-3394 Cisco Missing Authorization vulnerability in Cisco Nx-Os

A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to issue the enable command and get full administrative privileges.

7.2
2020-08-26 CVE-2020-3152 Cisco Incorrect Default Permissions vulnerability in Cisco Connected Mobile Experiences 10.6.0/10.6.1/10.6.2

A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to execute arbitrary commands with root privileges.

7.2
2020-08-26 CVE-2020-15483 Niscomed Insufficiently Protected Credentials vulnerability in Niscomed M1000 Multipara Patient Monitor Firmware

An issue was discovered on Nescomed Multipara Monitor M1000 devices.

7.2
2020-08-26 CVE-2020-15482 Niscomed Insufficiently Protected Credentials vulnerability in Niscomed M1000 Multipara Patient Monitor Firmware

An issue was discovered on Nescomed Multipara Monitor M1000 devices.

7.2
2020-08-24 CVE-2020-4587 IBM Out-Of-Bounds Write vulnerability in IBM Connect:Direct and Sterling Connect:Direct

IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, 6.0.0, and 6.1.0 is vulnerable to a stack based buffer ovreflow, caused by improper bounds checking.

7.2
2020-08-27 CVE-2020-3397 Cisco Improper Input Validation vulnerability in Cisco Nx-Os

A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition.

7.1
2020-08-25 CVE-2020-24240 GNU USE After Free vulnerability in GNU Bison 3.7

GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered.

7.1
2020-08-24 CVE-2020-24606 Squid Cache
Canonical
Debian
Fedoraproject
Opensuse
Improper Input Validation vulnerability in multiple products

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message.

7.1

166 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2020-08-27 CVE-2020-24715 Scalyr Improper Certificate Validation vulnerability in Scalyr Agent

The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName.

6.8
2020-08-27 CVE-2020-24714 Scalyr Improper Certificate Validation vulnerability in Scalyr Agent

The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verify_hostname option.

6.8
2020-08-27 CVE-2020-24705 Wso2 Unspecified vulnerability in Wso2 products

An issue was discovered in certain WSO2 products.

6.8
2020-08-27 CVE-2020-24703 Wso2 Unspecified vulnerability in Wso2 products

An issue was discovered in certain WSO2 products.

6.8
2020-08-26 CVE-2020-3490 Cisco Path Traversal vulnerability in Cisco Vision Dynamic Signage Director 6.2.0

A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrative privileges to conduct directory traversal attacks and obtain read access to sensitive files on an affected system.

6.8
2020-08-26 CVE-2020-24653 Expo Unspecified vulnerability in Expo

secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.

6.8
2020-08-25 CVE-2020-17404 Foxitsoftware Out-Of-Bounds Write vulnerability in Foxitsoftware Foxit Studio Photo

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.

6.8
2020-08-25 CVE-2020-17403 Foxitsoftware Out-Of-Bounds Write vulnerability in Foxitsoftware Foxit Studio Photo

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.

6.8
2020-08-25 CVE-2020-24616 Fasterxml
Netapp
Oracle
Debian
Code Injection vulnerability in multiple products

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

6.8
2020-08-24 CVE-2020-24364 Ethz Injection vulnerability in Ethz Minetime

MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting.

6.8
2020-08-24 CVE-2020-14043 Codiad Cross-Site Request Forgery (CSRF) vulnerability in Codiad

** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later.

6.8
2020-08-24 CVE-2020-7831 Inogard Download of Code Without Integrity Check vulnerability in Inogard Ebiz4U Cviewerobject1.0.5.1

A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file.

6.8
2020-08-24 CVE-2020-19889 Dbhcms Project Cross-Site Request Forgery (CSRF) vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcms_pid=-70 can add a user.

6.8
2020-08-30 CVE-2020-7712 Joyent OS Command Injection vulnerability in Joyent Json

This affects the package json before 10.0.0.

6.5
2020-08-29 CVE-2020-24972 Kleopatra Project Improper Encoding OR Escaping of Output vulnerability in Kleopatra Project Kleopatra

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options.

6.5
2020-08-27 CVE-2020-10518 Github Injection vulnerability in Github

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site.

6.5
2020-08-27 CVE-2020-8602 Trendmicro Incorrect Permission Assignment FOR Critical Resource vulnerability in Trendmicro Deep Security Manager and vulnerability Protection

A vulnerability in the management consoles of Trend Micro Deep Security 10.0-12.0 and Trend Micro Vulnerability Protection 2.0 SP2 may allow an authenticated attacker with full control privileges to bypass file integrity checks, leading to remote code execution.

6.5
2020-08-27 CVE-2020-24196 Online Bike Rental Project Unrestricted Upload of File With Dangerous Type vulnerability in Online Bike Rental Project Online Bike Rental 1.0

An Arbitrary File Upload in Vehicle Image Upload in Online Bike Rental v1.0 allows authenticated admin to conduct remote code execution.

6.5
2020-08-27 CVE-2020-4603 IBM Improper Privilege Management vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

6.5
2020-08-26 CVE-2020-17376 Openstack XXE vulnerability in Openstack Nova

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0.

6.5
2020-08-26 CVE-2020-12855 Seczetta Injection vulnerability in Seczetta Neprofile 3.3.11

A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11.

6.5
2020-08-26 CVE-2020-12456 Mitel Path Traversal vulnerability in Mitel Mivoice Connect 21.90.9743.0/214.100.1222.0

A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notification window, due to improper rendering of chat messages.

6.5
2020-08-26 CVE-2020-3522 Cisco Incorrect Authorization vulnerability in Cisco Data Center Network Manager

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to bypass authorization on an affected device and access sensitive information that is related to the device.

6.5
2020-08-26 CVE-2020-3485 Cisco Incorrect Default Permissions vulnerability in Cisco Vision Dynamic Signage Director 6.2.0

A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to perform.

6.5
2020-08-26 CVE-2020-3443 Cisco Missing Authorization vulnerability in Cisco Smart Software Manager On-Prem 8202004

A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and execute commands with higher privileges.

6.5
2020-08-25 CVE-2020-24614 Fossil SCM Code Injection vulnerability in Fossil-Scm Fossil

Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code.

6.5
2020-08-24 CVE-2020-14044 Codiad Server-Side Request Forgery (SSRF) vulnerability in Codiad

** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later.

6.5
2020-08-24 CVE-2020-19891 Dbhcms Project Out-Of-Bounds Write vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has an Arbitrary file write vulnerability in dbhcms\mod\mod.editor.php $_POST['updatefile'] is filename and $_POST['tinymce_content'] is file content, there is no filter function for security.

6.5
2020-08-30 CVE-2020-8244 Bufferlist Project Out-Of-Bounds Read vulnerability in Bufferlist Project Bufferlist

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

6.4
2020-08-29 CVE-2020-25016 RGB Rust Project Unspecified vulnerability in Rgb-Rust Project Rgb-Rust 0.4.0/0.8.14/0.8.16

A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory.

6.4
2020-08-28 CVE-2020-15165 Chameleon Mini Live Debugger Project Embedded Malicious Code vulnerability in Chameleon Mini Live Debugger Project Chameleon Mini Live Debugger 1.1.6

Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor.

6.4
2020-08-28 CVE-2020-15164 Scratch Wiki Improper Authentication vulnerability in Scratch-Wiki Scratch Login

in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki.

6.4
2020-08-27 CVE-2020-4167 IBM Improper Authentication vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 could allow an attacker to obtain sensitive information or perform unauthorized actions due to improper authenciation mechanisms.

6.4
2020-08-26 CVE-2020-3505 Cisco Resource Exhaustion vulnerability in Cisco products

A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a memory leak, which could lead to a denial of service (DoS) condition on an affected device.

6.1
2020-08-26 CVE-2019-14904 Redhat
Debian
OS Command Injection vulnerability in multiple products

A flaw was found in the solaris_zone module from the Ansible Community modules.

6.1
2020-08-28 CVE-2020-5623 Nitori Open Redirect vulnerability in Nitori 6.0.2/6.0.4

NITORI App for Android versions 6.0.4 and earlier and NITORI App for iOS versions 6.0.2 and earlier allow remote attackers to lead a user to access an arbitrary website via the vulnerable App.

5.8
2020-08-26 CVE-2020-24598 Joomla Open Redirect vulnerability in Joomla Joomla!

An issue was discovered in Joomla! before 3.9.21.

5.8
2020-08-26 CVE-2020-5913 F5 Improper Certificate Validation vulnerability in F5 products

In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profile ignores revoked certificates, even when a valid CRL is present.

5.8
2020-08-25 CVE-2020-5541 Cybersolutions Open Redirect vulnerability in Cybersolutions Cybermail 6.0/7.0

Open redirect vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to redirect users to arbitrary sites and conduct phishing attacks via a specially crafted URL.

5.8
2020-08-24 CVE-2020-7705 Mintegral Improper Restriction of Rendered UI Layers OR Frames vulnerability in Mintegral Mintegraladsdk

This affects the package MintegralAdSDK from 0.0.0.

5.8
2020-08-24 CVE-2020-4598 IBM Open Redirect vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.

5.8
2020-08-26 CVE-2020-13863 Mitel Injection vulnerability in Mitel Micollab

The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improper handling of input parameters.

5.5
2020-08-26 CVE-2020-3519 Cisco Improper Input Validation vulnerability in Cisco Data Center Network Manager

A vulnerability in a specific REST API method of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device.

5.5
2020-08-27 CVE-2020-15605 Trendmicro Improper Authentication vulnerability in Trendmicro Deep Security Manager and vulnerability Protection

If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection 2.0 SP2 could allow an unauthenticated attacker with prior knowledge of the targeted organization to bypass manager authentication.

5.1
2020-08-27 CVE-2020-15601 Trendmicro Improper Authentication vulnerability in Trendmicro Deep Security Manager and vulnerability Protection

If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Deep Security 10.x-12.x could allow an unauthenticated attacker with prior knowledge of the targeted organization to bypass manager authentication.

5.1
2020-08-29 CVE-2020-24928 Premid Information Exposure vulnerability in Premid

managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server (port 3020) open to all origins, which allows attackers to obtain sensitive Discord user information.

5.0
2020-08-28 CVE-2020-9298 Spinnaker Server-Side Request Forgery (SSRF) vulnerability in Spinnaker Orca

The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.

5.0
2020-08-28 CVE-2020-4559 IBM Improper Input Validation vulnerability in IBM Spectrum Protect

IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input.

5.0
2020-08-27 CVE-2020-5383 Dell Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Dell EMC Isilon and EMC Powerscale Onefs

Dell EMC Isilon OneFS version 8.2.2 and Dell EMC PowerScale OneFS version 9.0.0 contains a buffer overflow vulnerability in the Likewise component.

5.0
2020-08-27 CVE-2020-3338 Cisco Improper Resource Shutdown OR Release vulnerability in Cisco Nx-Os

A vulnerability in the Protocol Independent Multicast (PIM) feature for IPv6 networks (PIM6) of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

5.0
2020-08-27 CVE-2020-23972 Gmapfp Unrestricted Upload of File With Dangerous Type vulnerability in Gmapfp J3.5

In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload files which due to issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions.

5.0
2020-08-27 CVE-2020-4174 IBM USE of A Broken OR Risky Cryptographic Algorithm vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

5.0
2020-08-27 CVE-2020-4172 IBM Insecure Storage of Sensitive Information vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters.

5.0
2020-08-27 CVE-2020-4169 IBM USE of A Broken OR Risky Cryptographic Algorithm vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

5.0
2020-08-27 CVE-2020-4166 IBM Information Exposure Through AN Error Message vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.

5.0
2020-08-26 CVE-2020-24548 Ericom Server-Side Request Forgery (SSRF) vulnerability in Ericom Access Server 9.2.0

Ericom Access Server 9.2.0 (for AccessNow and Ericom Blaze) allows SSRF to make outbound WebSocket connection requests on arbitrary TCP ports, and provides "Cannot connect to" error messages to inform the attacker about closed ports.

5.0
2020-08-26 CVE-2020-11797 Mitel Missing Authentication FOR Critical Function vulnerability in Mitel Micollab Audio, web & Video Conferencing 9.0

An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an unauthenticated attacker to gain access to unauthorized information due to insufficient access validation.

5.0
2020-08-26 CVE-2020-11497 Woocommerce Improper Validation of Integrity Check Value vulnerability in Woocommerce NAB Transact 2.1.0

An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress.

5.0
2020-08-26 CVE-2019-4701 IBM Information Exposure vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is deployed with active debugging code that can create unintended entry points.

5.0
2020-08-26 CVE-2019-4698 IBM Weak Password Requirements vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

5.0
2020-08-26 CVE-2019-4692 IBM Information Exposure vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 discloses sensitive information to unauthorized users.

5.0
2020-08-26 CVE-2019-4689 IBM Information Exposure vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security.

5.0
2020-08-26 CVE-2019-4686 IBM Information Exposure vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies.

5.0
2020-08-26 CVE-2018-1501 IBM Missing Authentication FOR Critical Function vulnerability in IBM Security Guardium 10.5/10.6/11.0

IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to missing security controls.

5.0
2020-08-26 CVE-2020-13617 Mitel Improper Restriction of Excessive Authentication Attempts vulnerability in Mitel products

The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker to expose sensitive information due to improper memory handling during failed login attempts.

5.0
2020-08-26 CVE-2020-3496 Cisco Improper Input Validation vulnerability in Cisco products

A vulnerability in the IPv6 packet processing engine of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

5.0
2020-08-26 CVE-2020-3484 Cisco Incorrect Default Permissions vulnerability in Cisco Vision Dynamic Signage Director 6.2(0)

A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to view potentially sensitive information on an affected device.

5.0
2020-08-26 CVE-2020-5926 F5 Improper Resource Shutdown OR Release vulnerability in F5 products

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server with a Session Initiation Protocol (SIP) ALG profile, parsing SIP messages that contain a multi-part MIME payload with certain boundary strings can cause TMM to free memory to the wrong cache.

5.0
2020-08-26 CVE-2020-5921 F5 Resource Exhaustion vulnerability in F5 products

in BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, Syn flood causes large number of MCPD context messages destined to secondary blades consuming memory leading to MCPD failure.

5.0
2020-08-26 CVE-2020-5924 F5 Missing Release of Resource After Effective Lifetime vulnerability in F5 Big-Ip Access Policy Manager

In BIG-IP APM versions 12.1.0-12.1.5.1 and 11.6.1-11.6.5.2, RADIUS authentication leaks memory when the username for authentication is not set.

5.0
2020-08-26 CVE-2020-5919 F5 Unspecified vulnerability in F5 Big-Ip Access Policy Manager

In versions 15.1.0-15.1.0.4, rendering of certain session variables by BIG-IP APM UI-based agents in an access profile configured with Modern customization, may cause the Traffic Management Microkernel (TMM) to stop responding.

5.0
2020-08-26 CVE-2020-5918 F5 Resource Exhaustion vulnerability in F5 products

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic when traffic volume is high.

5.0
2020-08-26 CVE-2020-5914 F5 Improper Input Validation vulnerability in F5 Big-Ip Application Security Manager

In BIG-IP ASM versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed server cookie scenario may cause BD to restart under some circumstances.

5.0
2020-08-26 CVE-2020-15484 Niscomed Cleartext Storage of Sensitive Information vulnerability in Niscomed M1000 Multipara Patient Monitor Firmware

An issue was discovered on Nescomed Multipara Monitor M1000 devices.

5.0
2020-08-26 CVE-2020-13410 Aedes Project Improper Handling of Exceptional Conditions vulnerability in Aedes Project Aedes 0.42.0

An issue was discovered in MoscaJS Aedes 0.42.0.

5.0
2020-08-26 CVE-2020-24315 Wordpress Poll Project SQL Injection vulnerability in Wordpress Poll Project Wordpress Poll 36.0

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping.

5.0
2020-08-26 CVE-2020-24008 Umanni Information Exposure vulnerability in Umanni Human Resources 1.0

Umanni RH 1.0 has a user enumeration vulnerability.

5.0
2020-08-26 CVE-2020-24312 Webdesi9 Information Exposure vulnerability in Webdesi9 File Manager

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file.

5.0
2020-08-25 CVE-2020-15641 Marvell Path Traversal vulnerability in Marvell Qconvergeconsole

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64.

5.0
2020-08-25 CVE-2020-15640 Marvell Path Traversal vulnerability in Marvell Qconvergeconsole

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64.

5.0
2020-08-25 CVE-2020-14522 Softing Resource Exhaustion vulnerability in Softing OPC

Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to uncontrolled resource consumption, which may allow an attacker to cause a denial-of-service condition.

5.0
2020-08-25 CVE-2020-14512 Secomea USE of Password Hash With Insufficient Computational Effort vulnerability in Secomea Gatemanager 8250 Firmware

GateManager versions prior to 9.2c, The affected product uses a weak hash type, which may allow an attacker to view user passwords.

5.0
2020-08-25 CVE-2020-17385 Cellopoint Path Traversal vulnerability in Cellopoint Cellos 4.1.10

Cellopoint Cellos v4.1.10 Build 20190922 does not validate URL inputted properly, which allows unauthorized user to launch Path Traversal attack and access arbitrate file on the system.

5.0
2020-08-24 CVE-2020-7377 Rapid7 Path Traversal vulnerability in Rapid7 Metasploit

The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write arbitrary files to arbitrary locations on the host file system when the module is run on a malicious HTTP server.

5.0
2020-08-24 CVE-2020-19878 Dbhcms Project Information Exposure vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthenticated attacker can exploit this vulnerability to get path information.

5.0
2020-08-24 CVE-2020-19877 Dbhcms Project Path Traversal vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/.

5.0
2020-08-24 CVE-2020-13101 Oasis Open Improper Verification of Cryptographic Signature vulnerability in Oasis-Open Oasis Digital Signature Services 1.0

In OASIS Digital Signature Services (DSS) 1.0, an attacker can control the validation outcome (i.e., trigger either a valid or invalid outcome for a valid or invalid signature) via a crafted XML signature, when the InlineXML option is used.

5.0
2020-08-27 CVE-2020-14728 Oracle Unspecified vulnerability in Oracle Suitecommerce Advanced

Vulnerability in the SuiteCommerce Advanced (SCA) component of Oracle NetSuite service.

4.9
2020-08-24 CVE-2020-24613 Wolfssl Improper Certificate Validation vulnerability in Wolfssl

wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c.

4.9
2020-08-24 CVE-2018-1985 IBM
Apple
Classic Buffer Overflow vulnerability in IBM Security Rapport 3.6.1908.22/3.6.1908.26

IBM Trusteer Rapport/Apex 3.6.1908.22 contains an unused legacy driver which could allow a user with administrator privileges to cause a buffer overflow that would result in a kernel panic.

4.9
2020-08-26 CVE-2020-5923 F5 Unspecified vulnerability in F5 products

In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 and BIG-IQ versions 5.4.0-7.0.0, Self-IP port-lockdown bypass via IPv6 link-local addresses.

4.8
2020-08-30 CVE-2020-8097 Bitdefender Improper Authentication vulnerability in Bitdefender Endpoint Security and Endpoint Security Tools

An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings.

4.6
2020-08-28 CVE-2020-15159 Basercms Cross-Site Scripting vulnerability in Basercms

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).

4.6
2020-08-27 CVE-2020-24716 Openzfs Incorrect Permission Assignment FOR Critical Resource vulnerability in Openzfs

OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories.

4.6
2020-08-25 CVE-2020-15777 Gradle Deserialization of Untrusted Data vulnerability in Gradle Maven

An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise.

4.6
2020-08-25 CVE-2020-17400 Parallels Improper Validation of Array Index vulnerability in Parallels Desktop

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.

4.6
2020-08-25 CVE-2020-17399 Parallels Improper Validation of Array Index vulnerability in Parallels Desktop

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.

4.6
2020-08-25 CVE-2020-17397 Parallels Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Parallels Desktop

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.

4.6
2020-08-25 CVE-2020-17396 Parallels Integer Overflow OR Wraparound vulnerability in Parallels Desktop

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.

4.6
2020-08-25 CVE-2020-17395 Parallels Integer Underflow (Wrap OR Wraparound) vulnerability in Parallels Desktop

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.

4.6
2020-08-25 CVE-2020-17392 Parallels Untrusted Pointer Dereference vulnerability in Parallels Desktop

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.3-47255.

4.6
2020-08-25 CVE-2020-17390 Parallels Out-Of-Bounds Read vulnerability in Parallels Desktop

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123.

4.6
2020-08-24 CVE-2020-14349 Postgresql
Opensuse
Uncontrolled Search Path Element vulnerability in multiple products

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication.

4.6
2020-08-24 CVE-2020-14350 Postgresql
Debian
Opensuse
Untrusted Search Path vulnerability in multiple products

It was found that some PostgreSQL extensions did not use search_path safely in their installation script.

4.4
2020-08-30 CVE-2020-24104 PIX Link Cross-Site Scripting vulnerability in Pix-Link Lv-Wr07 Firmware 28K.Router.20170904

XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials without being connected to the network.

4.3
2020-08-30 CVE-2020-24223 Mara CMS Project Cross-Site Scripting vulnerability in Mara CMS Project Mara CMS 7.5

Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.

4.3
2020-08-30 CVE-2020-24917 Osticket Cross-Site Scripting vulnerability in Osticket

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.

4.3
2020-08-29 CVE-2020-25019 Jitsi Insufficient Verification of Data Authenticity vulnerability in Jitsi Meet Electron

jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.

4.3
2020-08-28 CVE-2020-16610 Hoosk Cross-Site Request Forgery (CSRF) vulnerability in Hoosk

Hoosk Codeigniter CMS before 1.7.2 is affected by a Cross Site Request Forgery (CSRF).

4.3
2020-08-28 CVE-2020-5625 Riken Cross-Site Scripting vulnerability in Riken Xoonips

Cross-site scripting vulnerability in XooNIps 3.48 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.

4.3
2020-08-28 CVE-2020-5621 Netgear Cross-Site Request Forgery (CSRF) vulnerability in Netgear Gs716Tv2 Firmware and Gs724Tv3 Firmware

Cross-site request forgery (CSRF) vulnerability in NETGEAR switching hubs (GS716Tv2 Firmware version 5.4.2.30 and earlier, and GS724Tv3 Firmware version 5.4.2.30 and earlier) allow remote attackers to hijack the authentication of administrators and alter the settings of the device via unspecified vectors.

4.3
2020-08-27 CVE-2020-3398 Cisco Improper Input Validation vulnerability in Cisco Nx-Os

A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a BGP session to repeatedly reset, causing a partial denial of service (DoS) condition due to the BGP session being down.

4.3
2020-08-27 CVE-2020-24706 Wso2 Cross-Site Scripting vulnerability in Wso2 products

An issue was discovered in certain WSO2 products.

4.3
2020-08-27 CVE-2020-24704 Wso2 Cross-Site Scripting vulnerability in Wso2 products

An issue was discovered in certain WSO2 products.

4.3
2020-08-27 CVE-2020-24390 Eyesofnetwork Cross-Site Scripting vulnerability in Eyesofnetwork 5.0

eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS during login/logout logs recording.

4.3
2020-08-27 CVE-2020-23982 Designmasterevents Cross-Site Scripting vulnerability in Designmasterevents Conference Management CMS 1.0.0

DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php'

4.3
2020-08-27 CVE-2020-23981 13Enforme Cross-Site Scripting vulnerability in 13Enforme CMS 1.0

13enforme CMS 1.0 has Cross Site Scripting via the "content.php" id parameter.

4.3
2020-08-27 CVE-2020-23977 Kandnconcepts Club CMS Project Cross-Site Scripting vulnerability in Kandnconcepts Club CMS Project Kandnconcepts Club CMS 1.1/1.2

KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the 'team.php,player.php,club.php' id parameter.

4.3
2020-08-27 CVE-2020-23975 Webexcels Cross-Site Scripting vulnerability in Webexcels Ecommerce CMS

Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter.

4.3
2020-08-27 CVE-2020-4575 IBM Cross-Site Scripting vulnerability in IBM Websphere Application Server

IBM WebSphere Application Server ND 8.5 and 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting when High Availability Deployment Manager is configured.

4.3
2020-08-27 CVE-2020-4175 IBM Information Exposure vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security.

4.3
2020-08-26 CVE-2019-5320 Arubanetworks Cross-Site Scripting vulnerability in Arubanetworks products

Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* before 16.09.0007, 16.10.* before 16.10.0003 are vulnerable to Cross Site Scripting in the web UI, leading to injection of code.

4.3
2020-08-26 CVE-2020-24599 Joomla Cross-Site Scripting vulnerability in Joomla Joomla!

An issue was discovered in Joomla! before 3.9.21.

4.3
2020-08-26 CVE-2020-15156 Nodebb Cross-Site Request Forgery (CSRF) vulnerability in Nodebb Blog Comments

In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum.

4.3
2020-08-26 CVE-2019-4688 IBM Reliance ON Cookies Without Validation and Integrity Checking vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies.

4.3
2020-08-26 CVE-2020-13767 Mitel Missing Authentication FOR Critical Function vulnerability in Mitel Micollab

The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access control.

4.3
2020-08-26 CVE-2020-3466 Cisco Cross-Site Scripting vulnerability in Cisco DNA Center

Multiple vulnerabilities in the web-based management interface of Cisco DNA Center software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device.

4.3
2020-08-26 CVE-2020-3440 Cisco Path Traversal vulnerability in Cisco Webex Meetings

A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an unauthenticated, remote attacker to overwrite arbitrary files on an end-user system.

4.3
2020-08-26 CVE-2020-5927 F5 Cross-Site Scripting vulnerability in F5 Big-Ip Application Security Manager

In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, BIG-IP ASM Configuration utility Stored-Cross Site Scripting.

4.3
2020-08-26 CVE-2020-5925 F5 Improper Check FOR Unusual OR Exceptional Conditions vulnerability in F5 products

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed internally generated UDP traffic may cause the Traffic Management Microkernel (TMM) to restart under some circumstances.

4.3
2020-08-26 CVE-2020-5917 F5 Inadequate Encryption Strength vulnerability in F5 products

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versions 5.2.0-7.0.0, the host OpenSSH servers utilize keys of less than 2048 bits which are no longer considered secure.

4.3
2020-08-26 CVE-2020-5915 F5 Cross-Site Scripting vulnerability in F5 products

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed TMUI page contains a vulnerability which allows a stored XSS when BIG-IP systems are setup in a device trust.

4.3
2020-08-26 CVE-2020-24316 Admin Menu Project Cross-Site Scripting vulnerability in Admin Menu Project Admin Menu 1.1

WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user.

4.3
2020-08-26 CVE-2020-24314 RSS Feed Widget Project Cross-Site Scripting vulnerability in RSS Feed Widget Project RSS Feed Widget

Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag.

4.3
2020-08-26 CVE-2020-24313 Etoilewebdesign Cross-Site Scripting vulnerability in Etoilewebdesign Ultimate Appointment Booking & Scheduling

Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointment_ID" GET parameter before echoing it back out inside an input tag.

4.3
2020-08-26 CVE-2020-15499 Asus Cross-Site Scripting vulnerability in Asus Rt-Ac1900P Firmware 3.0.0.4.385.10000/3.0.0.4.385.20252

An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253.

4.3
2020-08-26 CVE-2020-15498 Asus Improper Certificate Validation vulnerability in Asus Rt-Ac1900P Firmware 3.0.0.4.385.10000/3.0.0.4.385.20252

An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253.

4.3
2020-08-26 CVE-2020-24656 Maltego XXE vulnerability in Maltego

Maltego before 4.2.12 allows XXE attacks.

4.3
2020-08-25 CVE-2020-24609 Techkshetrainfo Cross-Site Scripting vulnerability in Techkshetrainfo Savsoft Quiz 5.0

TechKshetra Info Solutions Pvt.

4.3
2020-08-25 CVE-2020-14042 Codiad Cross-Site Scripting vulnerability in Codiad

** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later.

4.3
2020-08-25 CVE-2020-24242 Nasm Unspecified vulnerability in Nasm Netwide Assembler 2.15

In Netwide Assembler (NASM) 2.15rc10, SEGV can be triggered in tok_text in asm/preproc.c by accessing READ memory.

4.3
2020-08-25 CVE-2020-24241 Nasm USE After Free vulnerability in Nasm Netwide Assembler 2.15

In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.

4.3
2020-08-25 CVE-2020-5540 Cybersolutions Cross-Site Scripting vulnerability in Cybersolutions Cybermail 6.0/7.0

Cross-site scripting vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to inject arbitrary script or HTML via a specially crafted URL.

4.3
2020-08-24 CVE-2020-4170 IBM Cross-Site Request Forgery (CSRF) vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

4.3
2020-08-24 CVE-2020-19888 Dbhcms Project Incorrect Authorization vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation.

4.3
2020-08-24 CVE-2020-19886 Dbhcms Project Cross-Site Request Forgery (CSRF) vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for an /index.php?dbhcms_pid=-80&deletemenu=9 can delete any menu.

4.3
2020-08-24 CVE-2020-19880 Dbhcms Project Cross-Site Scripting vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthenticated attacker can exploit this vulnerability to hijack other users.

4.3
2020-08-24 CVE-2020-19879 Dbhcms Project Cross-Site Scripting vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $_GET['dbhcms_pid'] variable in dbhcms\page.php line 107,

4.3
2020-08-29 CVE-2020-24898 Stiltsoft Server-Side Request Forgery (SSRF) vulnerability in Stiltsoft Table Filter and Charts FOR Confluence Server

The Table Filter and Charts for Confluence Server app before 5.3.26 (for Atlassian Confluence) allows SSRF via the "Table from CSV" macro (URL parameter).

4.0
2020-08-28 CVE-2019-4579 IBM
Redhat
Unspecified vulnerability in IBM Resilient Security Orchestration Automation and Response 38.0

IBM Resilient SOAR 38 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity.

4.0
2020-08-28 CVE-2019-4533 IBM
Redhat
Improper Input Validation vulnerability in IBM Resilient Security Orchestration Automation and Response 38.0

IBM Resilient SOAR V38.0 users may experience a denial of service of the SOAR Platform due to a insufficient input validation.

4.0
2020-08-28 CVE-2019-19499 Grafana Information Exposure vulnerability in Grafana

Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.

4.0
2020-08-27 CVE-2020-10517 Github Incorrect Permission Assignment FOR Critical Resource vulnerability in Github

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of unauthorized private repositories given their numerical IDs.

4.0
2020-08-27 CVE-2020-24618 Jetbrains Incorrect Authorization vulnerability in Jetbrains Youtrack

In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can retrieve an issue description without appropriate access.

4.0
2020-08-27 CVE-2020-4171 IBM Information Exposure vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system.

4.0
2020-08-26 CVE-2019-4699 IBM Information Exposure Through AN Error Message vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data.

4.0
2020-08-26 CVE-2019-4697 IBM Insufficiently Protected Credentials vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated user.

4.0
2020-08-26 CVE-2020-3521 Cisco Improper Input Validation vulnerability in Cisco Data Center Network Manager

A vulnerability in a specific REST API of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device.

4.0
2020-08-26 CVE-2020-5920 F5 SQL Injection vulnerability in F5 Big-Ip Advanced Firewall Manager

In versions 15.0.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a vulnerability in the BIG-IP AFM Configuration utility may allow any authenticated BIG-IP user to perform a read-only blind SQL injection attack.

4.0
2020-08-26 CVE-2020-5916 F5 Information Exposure vulnerability in F5 products

In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory.

4.0
2020-08-25 CVE-2020-7824 Ericssonlg Incorrect Default Permissions vulnerability in Ericssonlg Ipecs

A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission.

4.0
2020-08-25 CVE-2020-24622 Sonatype Information Exposure vulnerability in Sonatype Nexus 3.26.1

In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.

4.0
2020-08-25 CVE-2020-16197 Octopus Improper Certificate Validation vulnerability in Octopus Deploy and Server

An issue was discovered in Octopus Deploy 3.4.

4.0
2020-08-25 CVE-2020-17386 Cellopoint Server-Side Request Forgery (SSRF) vulnerability in Cellopoint Cellos 4.1.10

Cellopoint Cellos v4.1.10 Build 20190922 does not validate URL inputted properly.

4.0
2020-08-24 CVE-2020-4383 IBM Improper Input Validation vulnerability in IBM Elastic Storage Server

IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment while configuring some of the network services.

4.0
2020-08-24 CVE-2020-19890 Dbhcms Project Information Exposure vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $_GET['file'] is filename,and as there is no filter function for security, you can read any file's content.

4.0

59 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2020-08-27 CVE-2020-14729 Oracle Unspecified vulnerability in Oracle Suitecommerce Advanced

Vulnerability in SuiteCommerce Advanced (SCA) Sites component of Oracle NetSuite service.

3.6
2020-08-26 CVE-2020-3151 Cisco Improper Authentication vulnerability in Cisco Connected Mobile Experiences 10.6.0/10.6.1/10.6.2

A vulnerability in the CLI of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to bypass restrictions on the CLI.

3.6
2020-08-26 CVE-2020-5912 F5 Improper Input Validation vulnerability in F5 products

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow current best coding practices and may overwrite arbitrary files.

3.6
2020-08-24 CVE-2020-14367 Tuxfamily
Fedoraproject
Link Following vulnerability in multiple products

A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder.

3.6
2020-08-29 CVE-2020-24897 Stiltsoft Cross-Site Scripting vulnerability in Stiltsoft Table Filter and Charts FOR Confluence Server

The Table Filter and Charts for Confluence Server app before 5.3.25 (for Atlassian Confluence) allow remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) through the provided Markdown markup to the "Table from CSV" macro.

3.5
2020-08-27 CVE-2020-23576 Laborator Cross-Site Scripting vulnerability in Laborator Neon 3.0

Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.

3.5
2020-08-27 CVE-2020-23984 Online Hotel Booking System PRO Project Cross-Site Scripting vulnerability in Online Hotel Booking System PRO Project Online Hotel Booking System PRO 1.3

Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags.

3.5
2020-08-27 CVE-2020-23983 Ichat Project Cross-Site Scripting vulnerability in Ichat Project Ichat 1.6

Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags.

3.5
2020-08-27 CVE-2020-23974 Create Project Manager Project Cross-Site Scripting vulnerability in Create-Project Manager Project Create-Project Manager 1.07

Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), Add new client (all-tags).

3.5
2020-08-26 CVE-2019-4691 IBM Cross-Site Scripting vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is vulnerable to cross-site scripting.

3.5
2020-08-26 CVE-2020-23660 Webtareas Project Cross-Site Scripting vulnerability in Webtareas Project Webtareas 2.1

webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search."

3.5
2020-08-26 CVE-2020-23659 Webport Project Cross-Site Scripting vulnerability in Webport Project Webport 1.19.17121

WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature.

3.5
2020-08-26 CVE-2020-23658 PHP Fusion Cross-Site Scripting vulnerability in PHP-Fusion 9.03.60

PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.

3.5
2020-08-26 CVE-2020-3523 Cisco Cross-Site Scripting vulnerability in Cisco Data Center Network Manager

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

3.5
2020-08-26 CVE-2020-3518 Cisco Cross-Site Scripting vulnerability in Cisco Data Center Network Manager

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of the affected software.

3.5
2020-08-26 CVE-2020-3491 Cisco Cross-Site Scripting vulnerability in Cisco Vision Dynamic Signage Director 6.2.0

A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrative privileges to conduct a cross-site scripting (XSS) attack against a user of the interface on an affected device.

3.5
2020-08-26 CVE-2020-3439 Cisco Cross-Site Scripting vulnerability in Cisco Data Center Network Manager

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

3.5
2020-08-26 CVE-2020-23657 Naviwebs Cross-Site Scripting vulnerability in Naviwebs Navigatecms 2.9

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."

3.5
2020-08-26 CVE-2020-23656 Naviwebs Cross-Site Scripting vulnerability in Naviwebs Navigatecms 2.9

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."

3.5
2020-08-26 CVE-2020-23655 Naviwebs Cross-Site Scripting vulnerability in Naviwebs Navigatecms 2.9

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."

3.5
2020-08-26 CVE-2020-23654 Naviwebs Cross-Site Scripting vulnerability in Naviwebs Navigatecms 2.9

NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."

3.5
2020-08-26 CVE-2020-13821 Hivemq Cross-Site Scripting vulnerability in Hivemq Broker Control Center 4.3.2

An issue was discovered in HiveMQ Broker Control Center 4.3.2.

3.5
2020-08-26 CVE-2020-19007 Halo Cross-Site Scripting vulnerability in Halo 1.2.0

Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments.

3.5
2020-08-26 CVE-2020-16193 Osticket Cross-Site Scripting vulnerability in Osticket

osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call.

3.5
2020-08-26 CVE-2020-7309 Mcafee Cross-Site Scripting vulnerability in Mcafee Application and Change Control

Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the policy discovery section.

3.5
2020-08-25 CVE-2020-19005 Zrlog Incorrect Authorization vulnerability in Zrlog 2.1.0

zrlog v2.1.0 has a vulnerability with the permission check.

3.5
2020-08-25 CVE-2020-5620 Exceedone Cross-Site Scripting vulnerability in Exceedone Exment

Cross-site scripting vulnerability in Exment prior to v3.6.0 allows remote authenticated attackers to inject arbitrary script or HTML via a specially crafted file.

3.5
2020-08-25 CVE-2020-5619 Exceedone Cross-Site Scripting vulnerability in Exceedone Exment

Cross-site scripting vulnerability in Exment prior to v3.6.0 allows remote authenticated attackers to inject arbitrary script or HTML via unspecified vectors.

3.5
2020-08-24 CVE-2020-4165 IBM Improper Restriction of Rendered UI Layers OR Frames vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim.

3.5
2020-08-24 CVE-2020-19887 Dbhcms Project Cross-Site Scripting vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has a stored XSS vulnerability as there is no htmlspecialchars function for '$_POST['pageparam_insert_description']' variable in dbhcms\mod\mod.page.edit.php line 227, A remote authenticated with admin user can exploit this vulnerability to hijack other users.

3.5
2020-08-24 CVE-2020-19885 Dbhcms Project Cross-Site Scripting vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$_POST['pageparam_insert_name']' variable in dbhcms\mod\mod.page.edit.php line 227, A remote authenticated with admin user can exploit this vulnerability to hijack other users.

3.5
2020-08-24 CVE-2020-19884 Dbhcms Project Cross-Site Scripting vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function in dbhcms\mod\mod.domain.edit.php line 119.

3.5
2020-08-24 CVE-2020-19883 Dbhcms Project Cross-Site Scripting vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter in dbhcms\mod\mod.users.view.php line 57 for user_login, A remote authenticated with admin user can exploit this vulnerability to hijack other users.

3.5
2020-08-24 CVE-2020-19882 Dbhcms Project Cross-Site Scripting vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for 'menu_description' variable in dbhcms\mod\mod.menus.edit.php line 83 and in dbhcms\mod\mod.menus.view.php line 111, A remote authenticated with admin user can exploit this vulnerability to hijack other users.

3.5
2020-08-24 CVE-2020-19881 Dbhcms Project Cross-Site Scripting vulnerability in Dbhcms Project Dbhcms 1.2.0

DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\mod\mod.selector.php line 108 for $_GET['return_name'] parameter, A remote authenticated with admin user can exploit this vulnerability to hijack other users.

3.5
2020-08-26 CVE-2020-5928 F5 Cross-Site Request Forgery (CSRF) vulnerability in F5 Big-Ip Application Security Manager

In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM Configuration utility CSRF protection token can be reused multiple times.

3.3
2020-08-26 CVE-2020-15486 Drtrust Information Exposure vulnerability in Drtrust Electrocardiogram PEN Firmware 2.00.08

An issue was discovered on Dr Trust ECG Pen 2.00.08 devices.

3.3
2020-08-27 CVE-2020-16142 Mercedes Benz Improper Input Validation vulnerability in Mercedes-Benz Comand

On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software.

2.9
2020-08-26 CVE-2020-24661 Gnome Improper Certificate Validation vulnerability in Gnome Geary

GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store.

2.6
2020-08-24 CVE-2020-10775 Oracle
Redhat
Open Redirect vulnerability in multiple products

An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks.

2.6
2020-08-28 CVE-2020-15155 Basercms Cross-Site Scripting vulnerability in Basercms

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution.

2.1
2020-08-28 CVE-2020-15154 Basercms Cross-Site Scripting vulnerability in Basercms

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution.

2.1
2020-08-27 CVE-2020-3504 Cisco Resource Exhaustion vulnerability in Cisco Fxos and Nx-Os

A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device.

2.1
2020-08-27 CVE-2020-14415 Qemu
Canonical
Divide BY Zero vulnerability in multiple products

oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.

2.1
2020-08-26 CVE-2020-15485 Niscomed Cleartext Storage of Sensitive Information vulnerability in Niscomed Multipara Monitor M1000 Firmware

An issue was discovered on Nescomed Multipara Monitor M1000 devices.

2.1
2020-08-26 CVE-2019-4695 IBM Insecure Storage of Sensitive Information vulnerability in IBM Guardium Data Encryption 3.0.0.2

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system.

2.1
2020-08-26 CVE-2019-4693 IBM Insufficiently Protected Credentials vulnerability in IBM products

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by a local privileged user.

2.1
2020-08-26 CVE-2020-3520 Cisco Information Exposure vulnerability in Cisco Data Center Network Manager

A vulnerability in Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, local attacker to obtain confidential information from an affected device.

2.1
2020-08-26 CVE-2020-3389 Cisco Missing Encryption of Sensitive Data vulnerability in Cisco Hyperflex Hx-Series Software 4.0(2A)

A vulnerability in the installation component of Cisco Hyperflex HX-Series Software could allow an authenticated, local attacker to retrieve the password that was configured at installation on an affected device.

2.1
2020-08-25 CVE-2020-17402 Parallels Incorrect Permission Assignment FOR Critical Resource vulnerability in Parallels Desktop

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4 (47270).

2.1
2020-08-25 CVE-2020-17401 Parallels Improper Validation of Array Index vulnerability in Parallels Desktop

This vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Desktop 15.1.4.

2.1
2020-08-25 CVE-2020-17398 Parallels Improper Validation of Array Index vulnerability in Parallels Desktop

This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4.

2.1
2020-08-25 CVE-2020-17394 Parallels Improper Validation of Array Index vulnerability in Parallels Desktop

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4.

2.1
2020-08-25 CVE-2020-17393 Parallels Improper Input Validation vulnerability in Parallels Desktop

This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255.

2.1
2020-08-25 CVE-2020-17391 Parallels Exposed Dangerous Method OR Function vulnerability in Parallels Desktop

This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255.

2.1
2020-08-24 CVE-2020-4593 IBM Insufficiently Protected Credentials vulnerability in IBM Security Guardium Insights 2.0.1

IBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be read by a local user.

2.1
2020-08-24 CVE-2020-4382 IBM Improper Input Validation vulnerability in IBM Elastic Storage Server

IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment or upgrade pertaining to xcat services.

2.1
2020-08-28 CVE-2020-4591 IBM Information Exposure vulnerability in IBM Spectrum Protect Server

IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the second chunk of an object in an encrypted container pool.

1.9
2020-08-24 CVE-2020-24612 Fedoraproject Improper Authentication vulnerability in Fedoraproject Selinux-Policy 20200824/3.14

An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled.

1.9