CVEs published August 11, 2020
61 CVEs were published on August 11, 2020: 0 critical, 1 high.
- Published
- 61
- Critical
- 0
- High
- 1
- Medium
- 5
- Low
- 1
- Unrated
- 54
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Android
- 20
- CloudForms
- 8
- - PCoIP Standard Agent for Windows - PCoIP Graphics Agent f…
- 3
- - Cloud Access Connector - Cloud Access Connector Legacy
- 2
- Google AWS S3 Crypto SDK for GoLang · github.com/aws/aws-sd…
- 2
- IBM QRadar Wincollect
- 2
- - Management Console
- 1
- Apache Wicket · org.apache.wicket:wicket-core
- 1
- Avaya Aura Communication Manager · Avaya Aura Messaging
- 1
- django-celery-results
- 1
High 1
Medium, low and unrated 60
- CVE-2020-7029Avaya Product System Management Interface Cross-Site Request Forgery VulnerabilityAvaya Aura Communication Manager · Avaya Aura Messaging
- CVE-2020-17495django-celery-results through 1.2.1 stores task results in the database.django-celery-results
- CVE-2020-17489An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4.
- CVE-2020-17487radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_parse_algorithmidentifier in libr/util/x50
- CVE-2020-0260There is a possible out of bounds read due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-152225183Android
- CVE-2020-0259In android_verity_ctr of dm-android-verity.c, there is a possible way to modify a dm-verity protected filesystem due to improperly used crypAndroid
- CVE-2020-0258In stopZygoteLocked of AppZygote.java, there is an insufficient cleanup.Android
- CVE-2020-0257In SpecializeCommon of com_android_internal_os_Zygote.cpp, there is a permissions bypass due to an incomplete cleanup.Android
- CVE-2020-0256In LoadPartitionTable of gpt.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0254There is a possible out of bounds read due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-152647751Android
- CVE-2020-0253There is a possible memory corruption due to a use after free.Product: AndroidVersions: Android SoCAndroid ID: A-152647365Android
- CVE-2020-0252There is a possible memory corruption due to a use after free.Product: AndroidVersions: Android SoCAndroid ID: A-152236803Android
- CVE-2020-0251There is a possible out of bounds read due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-152647626Android
- CVE-2019-17339TIBCO Silver Fabric XSS vulerabilityTIBCO Software TIBCO Silver Fabric
- CVE-2020-0250In requestCellInfoUpdateInternal of PhoneInterfaceManager.java, there is a missing permission check.Android
- CVE-2020-0249In postInstantAppNotif of InstantAppNotifier.java, there is a possible permission bypass due to a PendingIntent error.Android
- CVE-2020-0248In postInstantAppNotif of InstantAppNotifier.java, there is a possible permission bypass due to a PendingIntent error.Android
- CVE-2020-0247In Threshold::getHistogram of ImageProcessHelper.java, there is a possible crash loop due to an uncaught exception.Android
- CVE-2020-0243In clearPropValue of MediaAnalyticsItem.cpp, there is a possible use-after-free due to improper locking.Android
- CVE-2020-0242In reset of NuPlayerDriver.cpp, there is a possible use-after-free due to improper locking.Android
- CVE-2020-0241In NuPlayerStreamListener of NuPlayerStreamListener.cpp, there is possible memory corruption due to a double free.Android
- CVE-2020-0240In NewFixedDoubleArray of factory.cc, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2020-0239In getDocumentMetadata of DocumentsContract.java, there is a possible disclosure of location metadata from a file due to a permissions bypasAndroid
- CVE-2020-0238In updatePreferenceIntents of AccountTypePreferenceLoader, there is a possible confused deputy attack due to a race condition.Android
- CVE-2020-0108In postNotification of ServiceRecord.java, there is a possible bypass of foreground process restrictions due to an uncaught exception.Android
- CVE-2020-8911CBC padding oracle in AWS S3 Crypto SDK for GoLangGoogle AWS S3 Crypto SDK for GoLang · github.com/aws/aws-sd…
- CVE-2020-8912In-band key negotiation issue in AWS S3 Crypto SDK for GoLangGoogle AWS S3 Crypto SDK for GoLang · github.com/aws/aws-sd…
- CVE-2020-16170Use of Hard-coded Credentials in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to listen in on any ong
- CVE-2020-9244HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8);HUAWEI Mate 20 Pro versions Versions earlier than 10.1.0.270(C431E7R1PHUAWEI Mate 20;HUAWEI Mate 20 Pro;HUAWEI Mate 20 X;HUAWEI P…
- CVE-2020-8918TPM 1.2 key authorization values are vulnerable to a TPM transport eavesdroppergoogle/go-tpm library · github.com/google/go-tpm
- CVE-2020-9403In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in a recoverable format, and may be retrieved by any user with acce
- CVE-2020-9404In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in an insecure manner, and may be modified by an attacker with no k
- CVE-2020-11976By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates.Apache Wicket · org.apache.wicket:wicket-core
- CVE-2020-13179Broker Protocol messages in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to 20.04.1 are not cleaned up in - PCoIP Standard Agent for Windows - PCoIP Graphics Agent f…
- CVE-2020-14979The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA Precision X1 through 1.0.6 allow local users, including low integrity processes,
- CVE-2020-13178A function in the Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to version 20.04.1 does not properly valida- PCoIP Standard Agent for Windows - PCoIP Graphics Agent f…
- CVE-2020-13177The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.1 and 20.07.0 does n- PCoIP Standard Agent for Windows - PCoIP Graphics Agent f…
- CVE-2020-13176The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 - Cloud Access Connector - Cloud Access Connector Legacy
- CVE-2020-13175The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 - Cloud Access Connector - Cloud Access Connector Legacy
- CVE-2020-13174The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which cou- Management Console
- CVE-2020-15071content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading.
- CVE-2020-17466Turcom TRCwifiZone through 2020-08-10 allows authentication bypass by visiting manage/control.php and ignoring 302 Redirect responses.
- CVE-2020-17448Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated
- CVE-2020-17368Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command inje
- CVE-2020-17367Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection.
- CVE-2020-16092In QEMU through 5.0.0, an assertion failure can occur in the network packet processing.
- CVE-2020-15597SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.
- CVE-2020-13124SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to
- CVE-2020-11552An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce use
- CVE-2020-14313An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1.Quay
- CVE-2020-10780Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the fiCloudForms
- CVE-2020-14324A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0.CloudForms
- CVE-2020-14296Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw.CloudForms
- CVE-2020-14325Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create exiCloudForms
- CVE-2020-10779Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing priCloudForms
- CVE-2020-10783Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw.CloudForms
- CVE-2020-10778In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fiCloudForms
- CVE-2020-10777A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5.CloudForms
- CVE-2020-4485IBM QRadar 7.2.0 through 7.2.9 could allow an authenticated user to disable the Wincollect service which could aid an attacker in bypassing IBM QRadar Wincollect
- CVE-2020-9079FusionSphere OpenStack 8.0.0 have a protection mechanism failure vulnerability.FusionSphere OpenStack