# CVEs published 2020-07-31 33 CVEs were published on July 31, 2020: 4 critical, 7 high. Days are UTC. - [CVE-2020-14311](https://cve.now/CVE-2020-14311.md): There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. (CVSS 5.7, The Grub2 Project grub2) - [CVE-2020-14310](https://cve.now/CVE-2020-14310.md): There is an issue on grub2 before version 2.06 at function read\_section\_as\_string(). (CVSS 5.7, The Grub2 Project grub2) - [CVE-2020-15871](https://cve.now/CVE-2020-15871.md): Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution. (no CVSS) - [CVE-2020-15869](https://cve.now/CVE-2020-15869.md): Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2). (no CVSS) - [CVE-2020-15870](https://cve.now/CVE-2020-15870.md): Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). (no CVSS) - [CVE-2020-5414](https://cve.now/CVE-2020-5414.md): App Autoscaler logs credentials (CVSS 5.7, VMware Tanzu PCF Autoscaling · VMware Tanzu Operations M… +1) - [CVE-2020-5413](https://cve.now/CVE-2020-5413.md): Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets" (no CVSS, Spring by VMware Spring Integration · org.springframework.i…) - [CVE-2020-5396](https://cve.now/CVE-2020-5396.md): JMX Insecure Default Configuration in GemFire (no CVSS, VMware Tanzu GemFire for VMs · VMware Tanzu VMware GemFire) - [CVE-2019-11286](https://cve.now/CVE-2019-11286.md): JMX Credential Deserialization in GemFire (CVSS 9.0, VMware Tanzu VMware GemFire · VMware Tanzu GemFire for VMs) - [CVE-2020-15128](https://cve.now/CVE-2020-15128.md): Reliance on Cookies without validation in OctoberCMS (CVSS 6.1, octobercms october · october/rain) - [CVE-2020-5384](https://cve.now/CVE-2020-5384.md): Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerability. (CVSS 8.4, Dell RSA Authentication Agent for Microsoft Windows) - [CVE-2020-15133](https://cve.now/CVE-2020-15133.md): Missing TLS certificate verification in Faye Websocket (CVSS 8.0, faye-websocket) - [CVE-2020-15134](https://cve.now/CVE-2020-15134.md): Missing TLS certificate verification in Faye (CVSS 8.0, faye) - [CVE-2020-12081](https://cve.now/CVE-2020-12081.md): An information disclosure vulnerability has been identified in FlexNet Publisher lmadmin.exe 11.14.0.2. (no CVSS) - [CVE-2020-16136](https://cve.now/CVE-2020-16136.md): In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine (acc (no CVSS) - [CVE-2020-14337](https://cve.now/CVE-2020-14337.md): A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. (no CVSS, Ansible Tower) - [CVE-2020-14334](https://cve.now/CVE-2020-14334.md): A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files. (no CVSS, Red Hat Satellite) - [CVE-2020-10731](https://cve.now/CVE-2020-10731.md): A flaw was found in the nova\_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. (no CVSS, nova\_libvirt container provided by the Red Hat OpenStack Pl…) - [CVE-2020-14520](https://cve.now/CVE-2020-14520.md): The affected product is vulnerable to an information leak, which may allow an attacker to obtain sensitive information on the Ignition 8 (al (no CVSS, Ignition) - [CVE-2020-9248](https://cve.now/CVE-2020-9248.md): Huawei FusionComput 8.0.0 have an improper authorization vulnerability. (no CVSS, FusionCompute) - [CVE-2020-9249](https://cve.now/CVE-2020-9249.md): HUAWEI P30 smartphones with versions earlier than 10.1.0.160(C00E160R2P11) have a denial of service vulnerability. (no CVSS, HUAWEI P30) - [CVE-2020-3681](https://cve.now/CVE-2020-3681.md): Authenticated and encrypted payload MMEs can be forged and remotely sent to any HPAV2 system using a jailbreak key recoverable from code. (no CVSS) - [CVE-2020-3462](https://cve.now/CVE-2020-3462.md): Cisco Data Center Network Manager SQL Injection Vulnerability (CVSS 6.3, Cisco Data Center Network Manager) - [CVE-2020-3461](https://cve.now/CVE-2020-3461.md): Cisco Data Center Network Manager Information Disclosure Vulnerability (CVSS 5.3, Cisco Data Center Network Manager) - [CVE-2020-3374](https://cve.now/CVE-2020-3374.md): Cisco SD-WAN vManage Software Authorization Bypass Vulnerability (CVSS 9.9, Cisco SD-WAN vManage) - [CVE-2020-3375](https://cve.now/CVE-2020-3375.md): Cisco SD-WAN Solution Software Buffer Overflow Vulnerability (CVSS 9.8, Cisco SD-WAN vManage) - [CVE-2020-3376](https://cve.now/CVE-2020-3376.md): Cisco Data Center Network Manager Authentication Bypass Vulnerability (CVSS 7.3, Cisco Data Center Network Manager) - [CVE-2020-3377](https://cve.now/CVE-2020-3377.md): Cisco Data Center Network Manager Command Injection Vulnerability (CVSS 6.3, Cisco Data Center Network Manager) - [CVE-2020-3382](https://cve.now/CVE-2020-3382.md): Cisco Data Center Network Manager Authentication Bypass Vulnerability (CVSS 9.8, Cisco Data Center Network Manager) - [CVE-2020-3383](https://cve.now/CVE-2020-3383.md): Cisco Data Center Network Manager Path Traversal Vulnerability (CVSS 8.8, Cisco Data Center Network Manager) - [CVE-2020-3384](https://cve.now/CVE-2020-3384.md): Cisco Data Center Network Manager Command Injection Vulnerability (CVSS 8.2, Cisco Data Center Network Manager) - [CVE-2020-3386](https://cve.now/CVE-2020-3386.md): Cisco Data Center Network Manager Improper Authorization Vulnerability (CVSS 8.8, Cisco Data Center Network Manager) - [CVE-2020-3460](https://cve.now/CVE-2020-3460.md): Cisco Data Center Network Manager Cross-Site Scripting Vulnerability (CVSS 4.7, Cisco Data Center Network Manager) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-07-31 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.