CVEs published August 10, 2020
48 CVEs were published on August 10, 2020: 1 critical, 4 high.
- Published
- 48
- Critical
- 1
- High
- 4
- Medium
- 10
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- Mozilla Firefox ESR · Mozilla Firefox +1
- 6
- Combodo iTop
- 5
- GitLab
- 3
- IBM Jazz Reporting Service
- 3
- Mozilla Firefox for iOS
- 3
- Desktop Client
- 2
- Mozilla Firefox · Mozilla Thunderbird
- 2
- Mozilla Firefox ESR
- 2
- ERPNext
- 1
- F2fs-tools
- 1
Critical 1
High 4
Medium, low and unrated 43
- CVE-2020-16278A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary scr
- CVE-2020-16277An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker
- CVE-2020-16276An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to
- CVE-2020-16275A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitr
- CVE-2020-17480TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboardtinymce
- CVE-2020-9245HUAWEI P30 versions Versions earlier than 10.1.0.160(C00E160R2P11);HUAWEI P30 Pro versions Versions earlier than 10.1.0.160(C00E160R2P8) havHUAWEI P30, HUAWEI P30 Pro
- CVE-2020-17479jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.jpv
- CVE-2020-9078FusionCompute 8.0.0 have local privilege escalation vulnerability.FusionCompute
- CVE-2020-9243HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a denial of service vulnerability.HUAWEI Mate
- CVE-2020-15647A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitiveMozilla Firefox for
- CVE-2020-15648Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-15649Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of Mozilla Firefox ESR
- CVE-2020-15650Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (butMozilla Firefox ESR
- CVE-2020-15651A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the fiMozilla Firefox for iOS
- CVE-2020-15652By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect.Mozilla Firefox · Mozilla Thunderbird
- CVE-2020-15653An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links.Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-15654When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interfMozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-15655A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential discMozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-15656JIT optimizations involving the Javascript arguments object could confuse later optimizations.Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-15657Firefox could be made to load attacker-supplied DLL files from the installation directory.Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-15658The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file endMozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-15659Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0.Mozilla Firefox · Mozilla Thunderbird
- CVE-2020-15661A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for thMozilla Firefox for iOS
- CVE-2020-15662A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an Mozilla Firefox for iOS
- CVE-2020-17478ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplication algorithm.
- CVE-2020-17476Mibew Messenger before 3.2.7 allows XSS via a crafted user name.
- CVE-2020-9529Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20), as used by many different vendors in millions of Internet of Thing
- CVE-2020-9528Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20), as used by many different vendors in millions of Internet of Thing
- CVE-2020-9527Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20, after 2018-08-09 through 2020), as used by many different vendors i
- CVE-2020-9526CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure flaw that exposes user
- CVE-2020-9525CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an authentication flaw that allows remote attac
- CVE-2020-8224A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed direcDesktop Client
- CVE-2020-8229A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system.Desktop Client
- CVE-2020-13295For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF.GitLab Runner
- CVE-2020-13294In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application.GitLab
- CVE-2020-13293In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.GitLab
- CVE-2020-6070An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0.F2fs-tools
- CVE-2020-6145An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38.ERPNext
- CVE-2020-4541IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2020-4539IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2020-4533IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2020-12781Combodo iTop - CSRFCombodo iTop
- CVE-2020-12779Combodo iTop - Stored XSSCombodo iTop