# CVEs published 2020-08-11

61 CVEs were published on August 11, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-7029](https://cve.now/CVE-2020-7029.md): Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability (CVSS 6.4, Avaya Aura Communication Manager · Avaya Aura Messaging)
- [CVE-2020-17495](https://cve.now/CVE-2020-17495.md): django-celery-results through 1.2.1 stores task results in the database. (no CVSS, django-celery-results)
- [CVE-2020-17489](https://cve.now/CVE-2020-17489.md): An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. (no CVSS)
- [CVE-2020-17487](https://cve.now/CVE-2020-17487.md): radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r\_x509\_parse\_algorithmidentifier in libr/util/x50 (no CVSS)
- [CVE-2020-0260](https://cve.now/CVE-2020-0260.md): There is a possible out of bounds read due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-152225183 (no CVSS, Android)
- [CVE-2020-0259](https://cve.now/CVE-2020-0259.md): In android\_verity\_ctr of dm-android-verity.c, there is a possible way to modify a dm-verity protected filesystem due to improperly used cryp (no CVSS, Android)
- [CVE-2020-0258](https://cve.now/CVE-2020-0258.md): In stopZygoteLocked of AppZygote.java, there is an insufficient cleanup. (no CVSS, Android)
- [CVE-2020-0257](https://cve.now/CVE-2020-0257.md): In SpecializeCommon of com\_android\_internal\_os\_Zygote.cpp, there is a permissions bypass due to an incomplete cleanup. (no CVSS, Android)
- [CVE-2020-0256](https://cve.now/CVE-2020-0256.md): In LoadPartitionTable of gpt.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0254](https://cve.now/CVE-2020-0254.md): There is a possible out of bounds read due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-152647751 (no CVSS, Android)
- [CVE-2020-0253](https://cve.now/CVE-2020-0253.md): There is a possible memory corruption due to a use after free.Product: AndroidVersions: Android SoCAndroid ID: A-152647365 (no CVSS, Android)
- [CVE-2020-0252](https://cve.now/CVE-2020-0252.md): There is a possible memory corruption due to a use after free.Product: AndroidVersions: Android SoCAndroid ID: A-152236803 (no CVSS, Android)
- [CVE-2020-0251](https://cve.now/CVE-2020-0251.md): There is a possible out of bounds read due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-152647626 (no CVSS, Android)
- [CVE-2019-17339](https://cve.now/CVE-2019-17339.md): TIBCO Silver Fabric XSS vulerability (CVSS 6.8, TIBCO Software TIBCO Silver Fabric)
- [CVE-2020-0250](https://cve.now/CVE-2020-0250.md): In requestCellInfoUpdateInternal of PhoneInterfaceManager.java, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0249](https://cve.now/CVE-2020-0249.md): In postInstantAppNotif of InstantAppNotifier.java, there is a possible permission bypass due to a PendingIntent error. (no CVSS, Android)
- [CVE-2020-0248](https://cve.now/CVE-2020-0248.md): In postInstantAppNotif of InstantAppNotifier.java, there is a possible permission bypass due to a PendingIntent error. (no CVSS, Android)
- [CVE-2020-0247](https://cve.now/CVE-2020-0247.md): In Threshold::getHistogram of ImageProcessHelper.java, there is a possible crash loop due to an uncaught exception. (no CVSS, Android)
- [CVE-2020-0243](https://cve.now/CVE-2020-0243.md): In clearPropValue of MediaAnalyticsItem.cpp, there is a possible use-after-free due to improper locking. (no CVSS, Android)
- [CVE-2020-0242](https://cve.now/CVE-2020-0242.md): In reset of NuPlayerDriver.cpp, there is a possible use-after-free due to improper locking. (no CVSS, Android)
- [CVE-2020-0241](https://cve.now/CVE-2020-0241.md): In NuPlayerStreamListener of NuPlayerStreamListener.cpp, there is possible memory corruption due to a double free. (no CVSS, Android)
- [CVE-2020-0240](https://cve.now/CVE-2020-0240.md): In NewFixedDoubleArray of factory.cc, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2020-0239](https://cve.now/CVE-2020-0239.md): In getDocumentMetadata of DocumentsContract.java, there is a possible disclosure of location metadata from a file due to a permissions bypas (no CVSS, Android)
- [CVE-2020-0238](https://cve.now/CVE-2020-0238.md): In updatePreferenceIntents of AccountTypePreferenceLoader, there is a possible confused deputy attack due to a race condition. (no CVSS, Android)
- [CVE-2020-0108](https://cve.now/CVE-2020-0108.md): In postNotification of ServiceRecord.java, there is a possible bypass of foreground process restrictions due to an uncaught exception. (no CVSS, Android)
- [CVE-2020-8911](https://cve.now/CVE-2020-8911.md): CBC padding oracle in AWS S3 Crypto SDK for GoLang (CVSS 5.6, Google AWS S3 Crypto SDK for GoLang · github.com/aws/aws-sd…)
- [CVE-2020-8912](https://cve.now/CVE-2020-8912.md): In-band key negotiation issue in AWS S3 Crypto SDK for GoLang (CVSS 2.5, Google AWS S3 Crypto SDK for GoLang · github.com/aws/aws-sd…)
- [CVE-2020-16170](https://cve.now/CVE-2020-16170.md): Use of Hard-coded Credentials in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to listen in on any ong (no CVSS)
- [CVE-2020-9244](https://cve.now/CVE-2020-9244.md): HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8);HUAWEI Mate 20 Pro versions Versions earlier than 10.1.0.270(C431E7R1P (no CVSS, HUAWEI Mate 20;HUAWEI Mate 20 Pro;HUAWEI Mate 20 X;HUAWEI P…)
- [CVE-2020-8918](https://cve.now/CVE-2020-8918.md): TPM 1.2 key authorization values are vulnerable to a TPM transport eavesdropper (CVSS 6.3, google/go-tpm library · github.com/google/go-tpm)
- [CVE-2020-9403](https://cve.now/CVE-2020-9403.md): In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in a recoverable format, and may be retrieved by any user with acce (no CVSS)
- [CVE-2020-9404](https://cve.now/CVE-2020-9404.md): In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in an insecure manner, and may be modified by an attacker with no k (no CVSS)
- [CVE-2020-11976](https://cve.now/CVE-2020-11976.md): By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. (no CVSS, Apache Wicket · org.apache.wicket:wicket-core)
- [CVE-2020-13179](https://cve.now/CVE-2020-13179.md): Broker Protocol messages in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to 20.04.1 are not cleaned up in (no CVSS, - PCoIP Standard Agent for Windows - PCoIP Graphics Agent f…)
- [CVE-2020-14979](https://cve.now/CVE-2020-14979.md): The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA Precision X1 through 1.0.6 allow local users, including low integrity processes, (no CVSS)
- [CVE-2020-13178](https://cve.now/CVE-2020-13178.md): A function in the Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to version 20.04.1 does not properly valida (no CVSS, - PCoIP Standard Agent for Windows - PCoIP Graphics Agent f…)
- [CVE-2020-13177](https://cve.now/CVE-2020-13177.md): The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.1 and 20.07.0 does n (no CVSS, - PCoIP Standard Agent for Windows - PCoIP Graphics Agent f…)
- [CVE-2020-13176](https://cve.now/CVE-2020-13176.md): The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 (no CVSS, - Cloud Access Connector - Cloud Access Connector Legacy)
- [CVE-2020-13175](https://cve.now/CVE-2020-13175.md): The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 (no CVSS, - Cloud Access Connector - Cloud Access Connector Legacy)
- [CVE-2020-13174](https://cve.now/CVE-2020-13174.md): The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which cou (no CVSS, - Management Console)
- [CVE-2020-15071](https://cve.now/CVE-2020-15071.md): content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields\['name'\] to appendSubheading. (no CVSS)
- [CVE-2020-17466](https://cve.now/CVE-2020-17466.md): Turcom TRCwifiZone through 2020-08-10 allows authentication bypass by visiting manage/control.php and ignoring 302 Redirect responses. (no CVSS)
- [CVE-2020-17448](https://cve.now/CVE-2020-17448.md): Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated (no CVSS)
- [CVE-2020-17368](https://cve.now/CVE-2020-17368.md): Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command inje (no CVSS)
- [CVE-2020-17367](https://cve.now/CVE-2020-17367.md): Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection. (no CVSS)
- [CVE-2020-16092](https://cve.now/CVE-2020-16092.md): In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. (no CVSS)
- [CVE-2020-15597](https://cve.now/CVE-2020-15597.md): SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field. (no CVSS)
- [CVE-2020-13124](https://cve.now/CVE-2020-13124.md): SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to (no CVSS)
- [CVE-2020-11552](https://cve.now/CVE-2020-11552.md): An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce use (no CVSS)
- [CVE-2020-14313](https://cve.now/CVE-2020-14313.md): An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. (no CVSS, Quay)
- [CVE-2020-10780](https://cve.now/CVE-2020-10780.md): Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the fi (no CVSS, CloudForms)
- [CVE-2020-14324](https://cve.now/CVE-2020-14324.md): A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. (no CVSS, CloudForms)
- [CVE-2020-14296](https://cve.now/CVE-2020-14296.md): Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. (no CVSS, CloudForms)
- [CVE-2020-14325](https://cve.now/CVE-2020-14325.md): Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create exi (no CVSS, CloudForms)
- [CVE-2020-10779](https://cve.now/CVE-2020-10779.md): Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing pri (no CVSS, CloudForms)
- [CVE-2020-10783](https://cve.now/CVE-2020-10783.md): Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. (no CVSS, CloudForms)
- [CVE-2020-10778](https://cve.now/CVE-2020-10778.md): In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fi (no CVSS, CloudForms)
- [CVE-2020-10777](https://cve.now/CVE-2020-10777.md): A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. (no CVSS, CloudForms)
- [CVE-2020-4486](https://cve.now/CVE-2020-4486.md): IBM QRadar 7.2.0 thorugh 7.2.9 could allow an authenticated user to overwrite or delete arbitrary files due to a flaw after WinCollect insta (CVSS 8.1, IBM QRadar Wincollect)
- [CVE-2020-4485](https://cve.now/CVE-2020-4485.md): IBM QRadar 7.2.0 through 7.2.9 could allow an authenticated user to disable the Wincollect service which could aid an attacker in bypassing (CVSS 6.5, IBM QRadar Wincollect)
- [CVE-2020-9079](https://cve.now/CVE-2020-9079.md): FusionSphere OpenStack 8.0.0 have a protection mechanism failure vulnerability. (no CVSS, FusionSphere OpenStack)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.