# CVEs published 2020-08-12

62 CVEs were published on August 12, 2020: 4 critical, 9 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-7301](https://cve.now/CVE-2020-7301.md): DLP ePO extension - Cross site scripting (CVSS 4.1, McAfee DLP ePO extension)
- [CVE-2020-7300](https://cve.now/CVE-2020-7300.md): DLP ePO extension - Improper Authorization (CVSS 4.6, McAfee DLP ePO extension)
- [CVE-2020-17450](https://cve.now/CVE-2020-17450.md): PHP-Fusion 9.03 allows XSS on the preview page. (no CVSS)
- [CVE-2020-17449](https://cve.now/CVE-2020-17449.md): PHP-Fusion 9.03 allows XSS via the error\_log file. (no CVSS)
- [CVE-2020-15596](https://cve.now/CVE-2020-15596.md): The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Di (no CVSS)
- [CVE-2020-15868](https://cve.now/CVE-2020-15868.md): Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control. (no CVSS)
- [CVE-2020-17362](https://cve.now/CVE-2020-17362.md): search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. (no CVSS)
- [CVE-2020-16139](https://cve.now/CVE-2020-16139.md): A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the device remotely throug (no CVSS)
- [CVE-2020-16138](https://cve.now/CVE-2020-16138.md): A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the devi (no CVSS)
- [CVE-2020-16137](https://cve.now/CVE-2020-16137.md): A privilege escalation issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to reset the credentials (no CVSS)
- [CVE-2020-8905](https://cve.now/CVE-2020-8905.md): Confidential Information Disclosure vulnerability in Asylo (CVSS 2.8, Google Asylo)
- [CVE-2020-8904](https://cve.now/CVE-2020-8904.md): Arbitrary trusted memory overwrite vulnerability in Asylo (CVSS 6.4, Google Asylo)
- [CVE-2020-12107](https://cve.now/CVE-2020-12107.md): The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows command injection via a text field, which allow full control over this module (no CVSS)
- [CVE-2020-12106](https://cve.now/CVE-2020-12106.md): The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows unauthenticated users to send HTTP POST request to several critical Administr (no CVSS)
- [CVE-2020-17507](https://cve.now/CVE-2020-17507.md): An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. (no CVSS)
- [CVE-2020-17361](https://cve.now/CVE-2020-17361.md): An issue was discovered in ReadyTalk Avian 1.2.0. (no CVSS)
- [CVE-2020-17360](https://cve.now/CVE-2020-17360.md): An issue was discovered in ReadyTalk Avian 1.2.0. (no CVSS)
- [CVE-2020-7374](https://cve.now/CVE-2020-7374.md): Documalis Free PDF Editor / Free PDF Scanner Stack Based Buffer Overflow (CVSS 5.3, Documalis Free PDF Editor · Documalis Free PDF Scanner)
- [CVE-2020-2035](https://cve.now/CVE-2020-2035.md): PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions (CVSS 3.0, Palo Alto Networks PAN-OS)
- [CVE-2020-5415](https://cve.now/CVE-2020-5415.md): Concourse's GitLab auth allows impersonation (CVSS 10.0, VMware Tanzu Concourse · github.com/concourse/concourse +1)
- [CVE-2020-17505](https://cve.now/CVE-2020-17505.md): Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. (no CVSS)
- [CVE-2020-17506](https://cve.now/CVE-2020-17506.md): Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQ (no CVSS)
- [CVE-2020-15137](https://cve.now/CVE-2020-15137.md): Integer overflow in HoRNDIS (CVSS 5.5, jwise HoRNDIS)
- [CVE-2020-6653](https://cve.now/CVE-2020-6653.md): Sensitive date stored in logcat file (CVSS 3.8, Eaton Secure Connect Mobile App)
- [CVE-2020-17446](https://cve.now/CVE-2020-17446.md): asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted (no CVSS, asyncpg)
- [CVE-2020-12674](https://cve.now/CVE-2020-12674.md): In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. (no CVSS)
- [CVE-2020-12673](https://cve.now/CVE-2020-12673.md): In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. (no CVSS)
- [CVE-2020-17497](https://cve.now/CVE-2020-17497.md): eapol.c in iNet wireless daemon (IWD) through 1.8 allows attackers to trigger a PTK reinstallation by retransmitting EAPOL Msg4/4. (no CVSS)
- [CVE-2020-12100](https://cve.now/CVE-2020-12100.md): In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resour (no CVSS)
- [CVE-2020-13290](https://cve.now/CVE-2020-13290.md): In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page (CVSS 7.5, GitLab)
- [CVE-2020-13291](https://cve.now/CVE-2020-13291.md): In GitLab before 13.2.3, project sharing could temporarily allow too permissive access. (CVSS 8.1, GitLab)
- [CVE-2020-13288](https://cve.now/CVE-2020-13288.md): In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page (CVSS 5.5, GitLab)
- [CVE-2020-13278](https://cve.now/CVE-2020-13278.md): Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System \< 6.5.1 allows remote attackers to exec (CVSS 6.1, RosarioSIS · francoisjacquet/rosariosis)
- [CVE-2020-6310](https://cve.now/CVE-2020-6310.md): Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740 (CVSS 4.3, SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform)
- [CVE-2020-6309](https://cve.now/CVE-2020-6309.md): SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform an (CVSS 7.5, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2020-6301](https://cve.now/CVE-2020-6301.md): SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to rea (CVSS 5.4, SAP SE SAP ERP)
- [CVE-2020-6300](https://cve.now/CVE-2020-6300.md): SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator (CVSS 4.8, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6299](https://cve.now/CVE-2020-6299.md): SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of us (CVSS 4.3, SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform)
- [CVE-2020-6298](https://cve.now/CVE-2020-6298.md): SAP Banking Services (Generic Market Data), versions - 400, 450, 500, allows an unauthorized user to display protected Business Partner Gene (CVSS 8.3, SAP SE SAP Banking Services)
- [CVE-2020-6297](https://cve.now/CVE-2020-6297.md): Under certain conditions the upgrade of SAP Data Hub 2.7 to SAP Data Intelligence, version - 3.0, allows an attacker to access confidential (CVSS 6.3, SAP SE SAP Data Intelligence)
- [CVE-2020-6296](https://cve.now/CVE-2020-6296.md): SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to (CVSS 8.3, SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform)
- [CVE-2020-6295](https://cve.now/CVE-2020-6295.md): Under certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to access encrypted sensitive and confidential (CVSS 7.0, SAP SE SAP Adaptive Server Enterprise)
- [CVE-2020-6294](https://cve.now/CVE-2020-6294.md): Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication check (CVSS 8.5, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-2235](https://cve.now/CVE-2020-2235.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect (no CVSS, Jenkins project Jenkins Pipeline Maven Integration Plugin ·…)
- [CVE-2020-2236](https://cve.now/CVE-2020-2236.md): Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XS (no CVSS, Jenkins project Jenkins Yet Another Build Visualizer Plugin…)
- [CVE-2020-2237](https://cve.now/CVE-2020-2237.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a proje (no CVSS, Jenkins project Jenkins Flaky Test Handler Plugin · org.jen…)
- [CVE-2020-2233](https://cve.now/CVE-2020-2233.md): A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate (no CVSS, Jenkins project Jenkins Pipeline Maven Integration Plugin ·…)
- [CVE-2020-2234](https://cve.now/CVE-2020-2234.md): A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect t (no CVSS, Jenkins project Jenkins Pipeline Maven Integration Plugin ·…)
- [CVE-2020-2231](https://cve.now/CVE-2020-2231.md): Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remot (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2232](https://cve.now/CVE-2020-2232.md): Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configurat (no CVSS, Jenkins project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2020-2229](https://cve.now/CVE-2020-2229.md): Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scrip (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2230](https://cve.now/CVE-2020-2230.md): Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-6293](https://cve.now/CVE-2020-6293.md): SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and a (CVSS 7.3, SAP SE SAP NetWeaver)
- [CVE-2020-6284](https://cve.now/CVE-2020-6284.md): SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file d (CVSS 9.0, SAP SE SAP NetWeaver)
- [CVE-2020-6273](https://cve.now/CVE-2020-6273.md): SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization checks for an authenticat (CVSS 4.3, SAP SE SAP S/4 HANA)
- [CVE-2020-17496](https://cve.now/CVE-2020-17496.md): vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget\_tabbedcontainer\_tab\_panel (CVSS 9.8, KEV)
- [CVE-2020-16266](https://cve.now/CVE-2020-16266.md): An XSS issue was discovered in MantisBT before 2.24.2. (no CVSS, mantisbt/mantisbt)
- [CVE-2020-16145](https://cve.now/CVE-2020-16145.md): Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. (no CVSS)
- [CVE-2020-17373](https://cve.now/CVE-2020-17373.md): SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection. (no CVSS)
- [CVE-2020-17372](https://cve.now/CVE-2020-17372.md): SugarCRM before 10.1.0 (Q3 2020) allows XSS. (no CVSS)
- [CVE-2020-6932](https://cve.now/CVE-2020-6932.md): An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platf (CVSS 10.0, BlackBerry QNX Software Development Platform)
- [CVE-2020-8913](https://cve.now/CVE-2020-8913.md): Local arbitrary code execution in splitinstall in Android's Play Core (CVSS 8.8, Google Android Play Core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.