CVEs published August 21, 2020
70 CVEs were published on August 21, 2020: 3 critical, 11 high.
- Published
- 70
- Critical
- 3
- High
- 11
- Medium
- 15
- Low
- 4
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- ISC BIND9
- 5
- NCR SelfServ ATM
- 5
- Philips SureSigns VS4
- 3
- Cog-Creators Red-DiscordBot · red-discordbot
- 2
- Desktop Client
- 2
- HUAWEI P30 Pro
- 2
- Cloud Foundry CAPI · Cloud Foundry CF Deployment
- 1
- Cloud Foundry Routing · Cloud Foundry CF Deployment
- 1
- Diebold Nixdorf ProCash 2100xe USB ATM
- 1
- dolibarr/dolibarr
- 1
Critical 3
- CVE-2020-24589The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.
- CVE-2020-24590The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.
- CVE-2019-11857ALEOS AceManager Information Disclosure
High 11
- CVE-2020-5417Cloud Controller may allow developers to claim sensitive routesCloud Foundry CAPI · Cloud Foundry CF Deployment
- CVE-2020-5416CF clusters with NGINX in front of them may be vulnerable to DoSCloud Foundry Routing · Cloud Foundry CF Deployment
- CVE-2020-8623A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.cISC BIND9
- CVE-2020-8621Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.cISC BIND9
- CVE-2020-8620In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection ISC BIND9
- CVE-2019-11862ALEOS SSH Service Allows Traffic Proxying
- CVE-2019-11855ALEOS LAN-Side RPC Server
- CVE-2019-11847ALEOS User Root Shell Escalation
- CVE-2020-15147Remote Code Execution in Red Discord BotCog-Creators Red-DiscordBot · red-discordbot
- CVE-2020-15140Remote Code Execution in Red Discord BotCog-Creators Red-DiscordBot · red-discordbot
- CVE-2020-7710Sandbox Escapesafe-eval
Medium, low and unrated 56
- CVE-2020-8624update-policy rules of type "subdomain" are enforced incorrectlyISC BIND9
- CVE-2020-8622A truncated TSIG response can lead to an assertion failureISC BIND9
- CVE-2020-8234A vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cookie for admin can be gEdgeSwitch firmware v1.9.0 and prior
- CVE-2020-8189A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invaDesktop Client
- CVE-2020-8227Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files ouDesktop Client
- CVE-2020-9063NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do not authenticate or protect the integrity of USB HID communications between the cNCR SelfServ ATM
- CVE-2020-9062Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messaDiebold Nixdorf ProCash 2100xe USB ATM
- CVE-2020-10126NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attackeNCR SelfServ ATM
- CVE-2020-10125NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software NCR SelfServ ATM
- CVE-2020-10124NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host NCR SelfServ ATM
- CVE-2020-10123The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation reqNCR SelfServ ATM
- CVE-2020-24591The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates.
- CVE-2019-11858ALEOS Multiple Web UI vulnerabilities
- CVE-2019-11853ALEOS AT Command Injections
- CVE-2019-11859ALEOS SMS Handler Buffer Overflow
- CVE-2019-11856ALEOS ACEView Message Replay
- CVE-2019-11852ALEOS ACEView Service Out-Of-Bounds Read
- CVE-2019-11848ALEOS AT Command API Abuse
- CVE-2019-11850ALEOS AT Command Stack Overflow
- CVE-2019-11849ALEOS AT API Stack Overflow
- CVE-2020-14201Dolibarr CRM before 11.0.5 allows privilege escalation.dolibarr/dolibarr
- CVE-2020-3975VMware App Volumes 2.x prior to 2.18.6 and VMware App Volumes 4 prior to 2006 contain a Stored Cross-Site Scripting (XSS) vulnerability.VMware App Volumes
- CVE-2020-5775Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTInstructure Canvas Learning Management System
- CVE-2020-20633ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info)
- CVE-2020-10290RVD#1495: Universal Robots URCaps execute with unbounded privilegesUniversal Robots URx
- CVE-2020-20634Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature.
- CVE-2020-24057The management website of the Verint S5120FD Verint_FW_0_42 unit features a CGI endpoint ('ipfilter.cgi') that allows the user to manage net
- CVE-2020-24056A hardcoded credentials vulnerability exists in Verint 5620PTZ Verint_FW_0_42, Verint 4320 V4320_FW_0_23, V4320_FW_0_31, and Verint S5120FD
- CVE-2020-24055Verint 5620PTZ Verint_FW_0_42 and Verint 4320 V4320_FW_0_23, and V4320_FW_0_31 units feature an autodiscovery service implemented in the bin
- CVE-2020-24054The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given p
- CVE-2020-24053Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability.
- CVE-2020-24052Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to
- CVE-2020-7923Specific GeoQuery can cause DoS against MongoDB ServerMongoDB Server
- CVE-2020-24051The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires auth
- CVE-2020-9246FusionCompute 8.0.0 has an information leak vulnerability.FusionCompute
- CVE-2020-9095HUAWEI P30 Pro smartphone with Versions earlier than 10.1.0.160(C00E160R2P8) has an integer overflow vulnerability.HUAWEI P30 Pro
- CVE-2020-9096HUAWEI P30 Pro smartphones with Versions earlier than 10.1.0.160(C00E160R2P8) have an out of bound read vulnerability.HUAWEI P30 Pro
- CVE-2020-15309An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed.
- CVE-2020-9104HUAWEI P30 smartphones with Versions earlier than 10.1.0.123(C431E22R2P5),Versions earlier than 10.1.0.123(C432E22R2P5),Versions earlier thaHUAWEI P30
- CVE-2020-12457An issue was discovered in wolfSSL before 4.5.0.
- CVE-2020-24585An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0.
- CVE-2020-3976VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services.ESXi, vCenter Server, and Cloud Foundation
- CVE-2020-5774Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios.Tenable Nessus
- CVE-2020-16239Philips SureSigns VS4 Improper AuthenticationPhilips SureSigns VS4
- CVE-2020-16241Philips SureSigns VS4 Improper Access ControlPhilips SureSigns VS4
- CVE-2020-16237Philips SureSigns VS4 Improper Input ValidationPhilips SureSigns VS4
- CVE-2020-14518Philips DreamMapper Insertion of Sensitive Information into Log FilePhilips DreamMapper
- CVE-2020-7310Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial installerMcAfee Total Protection (MTP) Trial
- CVE-2020-12759Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.
- CVE-2020-14194Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link.
- CVE-2020-14215Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitation
- CVE-2020-15070Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose
- CVE-2020-24574The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation fr
- CVE-2020-24571NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal.
- CVE-2020-24567voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via a Trojan horse urlmon.dll file in the installation
- CVE-2020-15858Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers.