# CVEs published 2020-08-12

62 CVEs were published on August 12, 2020: 4 critical, 9 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-7301](https://cve.now/CVE-2020-7301.md): DLP ePO extension - Cross site scripting (CVSS 4.1, McAfee DLP ePO extension)
- [CVE-2020-7300](https://cve.now/CVE-2020-7300.md): DLP ePO extension - Improper Authorization (CVSS 4.6, McAfee DLP ePO extension)
- [CVE-2020-17450](https://cve.now/CVE-2020-17450.md): PHP-Fusion 9.03 allows XSS on the preview page. (no CVSS)
- [CVE-2020-17449](https://cve.now/CVE-2020-17449.md): PHP-Fusion 9.03 allows XSS via the error\_log file. (no CVSS)
- [CVE-2020-15596](https://cve.now/CVE-2020-15596.md): The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path… (no CVSS)
- [CVE-2020-15868](https://cve.now/CVE-2020-15868.md): Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control. (no CVSS)
- [CVE-2020-17362](https://cve.now/CVE-2020-17362.md): search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. (no CVSS)
- [CVE-2020-16139](https://cve.now/CVE-2020-16139.md): A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the device remotely… (no CVSS)
- [CVE-2020-16138](https://cve.now/CVE-2020-16138.md): A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the… (no CVSS)
- [CVE-2020-16137](https://cve.now/CVE-2020-16137.md): A privilege escalation issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to reset the… (no CVSS)
- [CVE-2020-8905](https://cve.now/CVE-2020-8905.md): Confidential Information Disclosure vulnerability in Asylo (CVSS 2.8, Google Asylo)
- [CVE-2020-8904](https://cve.now/CVE-2020-8904.md): Arbitrary trusted memory overwrite vulnerability in Asylo (CVSS 6.4, Google Asylo)
- [CVE-2020-12107](https://cve.now/CVE-2020-12107.md): The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows command injection via a text field, which allow full control over this… (no CVSS)
- [CVE-2020-12106](https://cve.now/CVE-2020-12106.md): The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows unauthenticated users to send HTTP POST request to several critical… (no CVSS)
- [CVE-2020-17507](https://cve.now/CVE-2020-17507.md): An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. (no CVSS)
- [CVE-2020-17361](https://cve.now/CVE-2020-17361.md): An issue was discovered in ReadyTalk Avian 1.2.0. (no CVSS)
- [CVE-2020-17360](https://cve.now/CVE-2020-17360.md): An issue was discovered in ReadyTalk Avian 1.2.0. (no CVSS)
- [CVE-2020-7374](https://cve.now/CVE-2020-7374.md): Documalis Free PDF Editor / Free PDF Scanner Stack Based Buffer Overflow (CVSS 5.3, Documalis Free PDF Editor · Documalis Free PDF Scanner)
- [CVE-2020-2035](https://cve.now/CVE-2020-2035.md): PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions (CVSS 3.0, Palo Alto Networks PAN-OS)
- [CVE-2020-5415](https://cve.now/CVE-2020-5415.md): Concourse's GitLab auth allows impersonation (CVSS 10.0, VMware Tanzu Concourse · github.com/concourse/concourse +1)
- [CVE-2020-17505](https://cve.now/CVE-2020-17505.md): Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. (no CVSS)
- [CVE-2020-17506](https://cve.now/CVE-2020-17506.md): Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through… (no CVSS)
- [CVE-2020-15137](https://cve.now/CVE-2020-15137.md): Integer overflow in HoRNDIS (CVSS 5.5, jwise HoRNDIS)
- [CVE-2020-6653](https://cve.now/CVE-2020-6653.md): Sensitive date stored in logcat file (CVSS 3.8, Eaton Secure Connect Mobile App)
- [CVE-2020-17446](https://cve.now/CVE-2020-17446.md): asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a… (no CVSS, asyncpg)
- [CVE-2020-12674](https://cve.now/CVE-2020-12674.md): In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. (no CVSS)
- [CVE-2020-12673](https://cve.now/CVE-2020-12673.md): In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. (no CVSS)
- [CVE-2020-17497](https://cve.now/CVE-2020-17497.md): eapol.c in iNet wireless daemon (IWD) through 1.8 allows attackers to trigger a PTK reinstallation by retransmitting EAPOL Msg4/4. (no CVSS)
- [CVE-2020-12100](https://cve.now/CVE-2020-12100.md): In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2020-13290](https://cve.now/CVE-2020-13290.md): In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page (CVSS 7.5, GitLab)
- [CVE-2020-13291](https://cve.now/CVE-2020-13291.md): In GitLab before 13.2.3, project sharing could temporarily allow too permissive access. (CVSS 8.1, GitLab)
- [CVE-2020-13288](https://cve.now/CVE-2020-13288.md): In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page (CVSS 5.5, GitLab)
- [CVE-2020-13278](https://cve.now/CVE-2020-13278.md): Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System \< 6.5.1 allows remote attackers to… (CVSS 6.1, RosarioSIS · francoisjacquet/rosariosis)
- [CVE-2020-6310](https://cve.now/CVE-2020-6310.md): Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731… (CVSS 4.3, SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform)
- [CVE-2020-6309](https://cve.now/CVE-2020-6309.md): SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform… (CVSS 7.5, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2020-6301](https://cve.now/CVE-2020-6301.md): SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to… (CVSS 5.4, SAP SE SAP ERP)
- [CVE-2020-6300](https://cve.now/CVE-2020-6300.md): SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with… (CVSS 4.8, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6299](https://cve.now/CVE-2020-6299.md): SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of… (CVSS 4.3, SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform)
- [CVE-2020-6298](https://cve.now/CVE-2020-6298.md): SAP Banking Services (Generic Market Data), versions - 400, 450, 500, allows an unauthorized user to display protected Business Partner… (CVSS 8.3, SAP SE SAP Banking Services)
- [CVE-2020-6297](https://cve.now/CVE-2020-6297.md): Under certain conditions the upgrade of SAP Data Hub 2.7 to SAP Data Intelligence, version - 3.0, allows an attacker to access… (CVSS 6.3, SAP SE SAP Data Intelligence)
- [CVE-2020-6296](https://cve.now/CVE-2020-6296.md): SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker… (CVSS 8.3, SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform)
- [CVE-2020-6295](https://cve.now/CVE-2020-6295.md): Under certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to access encrypted sensitive and… (CVSS 7.0, SAP SE SAP Adaptive Server Enterprise)
- [CVE-2020-6294](https://cve.now/CVE-2020-6294.md): Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication… (CVSS 8.5, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-2235](https://cve.now/CVE-2020-2235.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to… (no CVSS, Jenkins project Jenkins Pipeline Maven Integration Plugin ·…)
- [CVE-2020-2236](https://cve.now/CVE-2020-2236.md): Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting… (no CVSS, Jenkins project Jenkins Yet Another Build Visualizer Plugin…)
- [CVE-2020-2237](https://cve.now/CVE-2020-2237.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a… (no CVSS, Jenkins project Jenkins Flaky Test Handler Plugin · org.jen…)
- [CVE-2020-2233](https://cve.now/CVE-2020-2233.md): A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to… (no CVSS, Jenkins project Jenkins Pipeline Maven Integration Plugin ·…)
- [CVE-2020-2234](https://cve.now/CVE-2020-2234.md): A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect… (no CVSS, Jenkins project Jenkins Pipeline Maven Integration Plugin ·…)
- [CVE-2020-2231](https://cve.now/CVE-2020-2231.md): Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds… (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2232](https://cve.now/CVE-2020-2232.md): Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins… (no CVSS, Jenkins project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2020-2229](https://cve.now/CVE-2020-2229.md): Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site… (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2230](https://cve.now/CVE-2020-2230.md): Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored… (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-6293](https://cve.now/CVE-2020-6293.md): SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and… (CVSS 7.3, SAP SE SAP NetWeaver)
- [CVE-2020-6284](https://cve.now/CVE-2020-6284.md): SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file… (CVSS 9.0, SAP SE SAP NetWeaver)
- [CVE-2020-6273](https://cve.now/CVE-2020-6273.md): SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization checks for an… (CVSS 4.3, SAP SE SAP S/4 HANA)
- [CVE-2020-17496](https://cve.now/CVE-2020-17496.md): vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget\_tabbedcontainer\_tab\_panel (CVSS 9.8, KEV)
- [CVE-2020-16266](https://cve.now/CVE-2020-16266.md): An XSS issue was discovered in MantisBT before 2.24.2. (no CVSS, mantisbt/mantisbt)
- [CVE-2020-16145](https://cve.now/CVE-2020-16145.md): Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. (no CVSS)
- [CVE-2020-17373](https://cve.now/CVE-2020-17373.md): SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection. (no CVSS)
- [CVE-2020-17372](https://cve.now/CVE-2020-17372.md): SugarCRM before 10.1.0 (Q3 2020) allows XSS. (no CVSS)
- [CVE-2020-6932](https://cve.now/CVE-2020-6932.md): An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development… (CVSS 10.0, BlackBerry QNX Software Development Platform)
- [CVE-2020-8913](https://cve.now/CVE-2020-8913.md): Local arbitrary code execution in splitinstall in Android's Play Core (CVSS 8.8, Google Android Play Core)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.