CVEs published August 12, 2020
62 CVEs were published on August 12, 2020: 4 critical, 9 high. 1 is now in CISA KEV.
- Published
- 62
- Critical
- 4
- High
- 9
- Medium
- 13
- Low
- 3
- Unrated
- 33
- Now in CISA KEV
- 1
- Fix available
- 34
Most affected products
- GitLab
- 3
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 3
- Jenkins project Jenkins Pipeline Maven Integration Plugin ·…
- 3
- SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform
- 3
- Google Asylo
- 2
- McAfee DLP ePO extension
- 2
- SAP SE SAP Business Objects Business Intelligence Platform
- 2
- SAP SE SAP NetWeaver
- 2
- asyncpg
- 1
- BlackBerry QNX Software Development Platform
- 1
Critical 4
- CVE-2020-5415Concourse's GitLab auth allows impersonationVMware Tanzu Concourse · github.com/concourse/concourse +1
- CVE-2020-6284SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file dSAP SE SAP NetWeaver
- CVE-2020-17496vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel
- CVE-2020-6932An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development PlatfBlackBerry QNX Software Development Platform
High 9
- CVE-2020-13290In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications pageGitLab
- CVE-2020-13291In GitLab before 13.2.3, project sharing could temporarily allow too permissive access.GitLab
- CVE-2020-6309SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform anSAP SE SAP NetWeaver AS JAVA
- CVE-2020-6298SAP Banking Services (Generic Market Data), versions - 400, 450, 500, allows an unauthorized user to display protected Business Partner GeneSAP SE SAP Banking Services
- CVE-2020-6296SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform
- CVE-2020-6295Under certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to access encrypted sensitive and confidentialSAP SE SAP Adaptive Server Enterprise
- CVE-2020-6294Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checkSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6293SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and aSAP SE SAP NetWeaver
- CVE-2020-8913Local arbitrary code execution in splitinstall in Android's Play CoreGoogle Android Play Core
Medium, low and unrated 49
- CVE-2020-7301DLP ePO extension - Cross site scriptingMcAfee DLP ePO extension
- CVE-2020-7300DLP ePO extension - Improper AuthorizationMcAfee DLP ePO extension
- CVE-2020-17450PHP-Fusion 9.03 allows XSS on the preview page.
- CVE-2020-17449PHP-Fusion 9.03 allows XSS via the error_log file.
- CVE-2020-15596The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Di
- CVE-2020-15868Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.
- CVE-2020-17362search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.
- CVE-2020-16139A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the device remotely throug
- CVE-2020-16138A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the devi
- CVE-2020-16137A privilege escalation issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to reset the credentials
- CVE-2020-8905Confidential Information Disclosure vulnerability in AsyloGoogle Asylo
- CVE-2020-8904Arbitrary trusted memory overwrite vulnerability in AsyloGoogle Asylo
- CVE-2020-12107The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows command injection via a text field, which allow full control over this module
- CVE-2020-12106The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows unauthenticated users to send HTTP POST request to several critical Administr
- CVE-2020-17507An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1.
- CVE-2020-17361An issue was discovered in ReadyTalk Avian 1.2.0.
- CVE-2020-17360An issue was discovered in ReadyTalk Avian 1.2.0.
- CVE-2020-7374Documalis Free PDF Editor / Free PDF Scanner Stack Based Buffer OverflowDocumalis Free PDF Editor · Documalis Free PDF Scanner
- CVE-2020-2035PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessionsPalo Alto Networks PAN-OS
- CVE-2020-17505Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php.
- CVE-2020-17506Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQ
- CVE-2020-15137Integer overflow in HoRNDISjwise HoRNDIS
- CVE-2020-6653Sensitive date stored in logcat fileEaton Secure Connect Mobile App
- CVE-2020-17446asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a craftedasyncpg
- CVE-2020-12674In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.
- CVE-2020-12673In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.
- CVE-2020-17497eapol.c in iNet wireless daemon (IWD) through 1.8 allows attackers to trigger a PTK reinstallation by retransmitting EAPOL Msg4/4.
- CVE-2020-12100In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resour
- CVE-2020-13288In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs pageGitLab
- CVE-2020-13278Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execRosarioSIS · francoisjacquet/rosariosis
- CVE-2020-6310Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform
- CVE-2020-6301SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to reaSAP SE SAP ERP
- CVE-2020-6300SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator SAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6299SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of usSAP SE SAP NetWeaver (ABAP Server) and ABAP Platform
- CVE-2020-6297Under certain conditions the upgrade of SAP Data Hub 2.7 to SAP Data Intelligence, version - 3.0, allows an attacker to access confidential SAP SE SAP Data Intelligence
- CVE-2020-2235A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connectJenkins project Jenkins Pipeline Maven Integration Plugin ·…
- CVE-2020-2236Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XSJenkins project Jenkins Yet Another Build Visualizer Plugin…
- CVE-2020-2237A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a projeJenkins project Jenkins Flaky Test Handler Plugin · org.jen…
- CVE-2020-2233A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerateJenkins project Jenkins Pipeline Maven Integration Plugin ·…
- CVE-2020-2234A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect tJenkins project Jenkins Pipeline Maven Integration Plugin ·…
- CVE-2020-2231Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-2232Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuratJenkins project Jenkins Email Extension Plugin · org.jenkin…
- CVE-2020-2229Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-2230Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-siteJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-6273SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization checks for an authenticatSAP SE SAP S/4 HANA
- CVE-2020-16266An XSS issue was discovered in MantisBT before 2.24.2.mantisbt/mantisbt
- CVE-2020-16145Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document.
- CVE-2020-17373SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection.
- CVE-2020-17372SugarCRM before 10.1.0 (Q3 2020) allows XSS.