# CVEs published 2020-08-20

16 CVEs were published on August 20, 2020: 0 critical, 2 high. Days are UTC.

- [CVE-2020-12618](https://cve.now/CVE-2020-12618.md): eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones. (no CVSS)
- [CVE-2020-12619](https://cve.now/CVE-2020-12619.md): MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. (no CVSS)
- [CVE-2020-24359](https://cve.now/CVE-2020-24359.md): HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's net (no CVSS, github.com/hashicorp/vault-ssh-helper)
- [CVE-2020-4687](https://cve.now/CVE-2020-4687.md): IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have acc (CVSS 4.3, IBM Content Navigator)
- [CVE-2020-4548](https://cve.now/CVE-2020-4548.md): IBM Content Navigator 3.0.7 and 3.0.8 is vulnerable to improper input validation. (CVSS 4.3, IBM Content Navigator)
- [CVE-2020-16282](https://cve.now/CVE-2020-16282.md): In the default configuration of Rangee GmbH RangeeOS 8.0.4, all components are executed in the context of the privileged root user. (no CVSS)
- [CVE-2020-16281](https://cve.now/CVE-2020-16281.md): The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restricted environment and (no CVSS)
- [CVE-2020-16280](https://cve.now/CVE-2020-16280.md): Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several external facing admini (no CVSS)
- [CVE-2020-16279](https://cve.now/CVE-2020-16279.md): The Kommbox component in Rangee GmbH RangeeOS 8.0.4 is vulnerable to Remote Code Execution due to untrusted user supplied input being passed (no CVSS)
- [CVE-2020-23935](https://cve.now/CVE-2020-23935.md): Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something)". (no CVSS)
- [CVE-2020-23936](https://cve.now/CVE-2020-23936.md): PHPGurukul Vehicle Parking Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something (no CVSS)
- [CVE-2019-20152](https://cve.now/CVE-2019-20152.md): An XSS issue was discovered in TreasuryXpress 19191105. (no CVSS)
- [CVE-2019-20151](https://cve.now/CVE-2019-20151.md): An XSS issue was discovered in TreasuryXpress 19191105. (no CVSS)
- [CVE-2019-20150](https://cve.now/CVE-2019-20150.md): In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. (no CVSS)
- [CVE-2020-10283](https://cve.now/CVE-2020-10283.md): RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication (CVSS 8.1, PX4 MAVLink)
- [CVE-2020-10289](https://cve.now/CVE-2020-10289.md): RVD#2401: Use of unsafe yaml load, ./src/actionlib/tools/library.py:132 (CVSS 8.0, Open Robotics ros)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.