# CVEs published 2020-08-21

70 CVEs were published on August 21, 2020: 3 critical, 11 high. Days are UTC.

- [CVE-2020-5417](https://cve.now/CVE-2020-5417.md): Cloud Controller may allow developers to claim sensitive routes (CVSS 8.5, Cloud Foundry CAPI · Cloud Foundry CF Deployment)
- [CVE-2020-5416](https://cve.now/CVE-2020-5416.md): CF clusters with NGINX in front of them may be vulnerable to DoS (CVSS 7.7, Cloud Foundry Routing · Cloud Foundry CF Deployment)
- [CVE-2020-8624](https://cve.now/CVE-2020-8624.md): update-policy rules of type "subdomain" are enforced incorrectly (CVSS 4.3, ISC BIND9)
- [CVE-2020-8623](https://cve.now/CVE-2020-8623.md): A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c (CVSS 7.5, ISC BIND9)
- [CVE-2020-8622](https://cve.now/CVE-2020-8622.md): A truncated TSIG response can lead to an assertion failure (CVSS 6.5, ISC BIND9)
- [CVE-2020-8621](https://cve.now/CVE-2020-8621.md): Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.c (CVSS 7.5, ISC BIND9)
- [CVE-2020-8620](https://cve.now/CVE-2020-8620.md): In BIND 9.15.6 -\> 9.16.5, 9.17.0 -\> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection (CVSS 7.5, ISC BIND9)
- [CVE-2020-8234](https://cve.now/CVE-2020-8234.md): A vulnerability exists in The EdgeMax EdgeSwitch firmware \<v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cookie for admin can be g (no CVSS, EdgeSwitch firmware v1.9.0 and prior)
- [CVE-2020-8189](https://cve.now/CVE-2020-8189.md): A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with inva (no CVSS, Desktop Client)
- [CVE-2020-8227](https://cve.now/CVE-2020-8227.md): Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files ou (no CVSS, Desktop Client)
- [CVE-2020-9063](https://cve.now/CVE-2020-9063.md): NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do not authenticate or protect the integrity of USB HID communications between the c (no CVSS, NCR SelfServ ATM)
- [CVE-2020-9062](https://cve.now/CVE-2020-9062.md): Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messa (no CVSS, Diebold Nixdorf ProCash 2100xe USB ATM)
- [CVE-2020-10126](https://cve.now/CVE-2020-10126.md): NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacke (no CVSS, NCR SelfServ ATM)
- [CVE-2020-10125](https://cve.now/CVE-2020-10125.md): NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software (no CVSS, NCR SelfServ ATM)
- [CVE-2020-10124](https://cve.now/CVE-2020-10124.md): NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host (no CVSS, NCR SelfServ ATM)
- [CVE-2020-10123](https://cve.now/CVE-2020-10123.md): The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation req (no CVSS, NCR SelfServ ATM)
- [CVE-2020-24589](https://cve.now/CVE-2020-24589.md): The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks. (CVSS 9.1)
- [CVE-2020-24591](https://cve.now/CVE-2020-24591.md): The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. (CVSS 6.5)
- [CVE-2020-24590](https://cve.now/CVE-2020-24590.md): The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks. (CVSS 9.1)
- [CVE-2019-11862](https://cve.now/CVE-2019-11862.md): ALEOS SSH Service Allows Traffic Proxying (CVSS 8.1)
- [CVE-2019-11858](https://cve.now/CVE-2019-11858.md): ALEOS Multiple Web UI vulnerabilities (CVSS 5.7)
- [CVE-2019-11853](https://cve.now/CVE-2019-11853.md): ALEOS AT Command Injections (CVSS 3.9)
- [CVE-2019-11859](https://cve.now/CVE-2019-11859.md): ALEOS SMS Handler Buffer Overflow (CVSS 6.0)
- [CVE-2019-11857](https://cve.now/CVE-2019-11857.md): ALEOS AceManager Information Disclosure (CVSS 9.1)
- [CVE-2019-11856](https://cve.now/CVE-2019-11856.md): ALEOS ACEView Message Replay (CVSS 3.3)
- [CVE-2019-11855](https://cve.now/CVE-2019-11855.md): ALEOS LAN-Side RPC Server (CVSS 8.1)
- [CVE-2019-11852](https://cve.now/CVE-2019-11852.md): ALEOS ACEView Service Out-Of-Bounds Read (CVSS 3.7)
- [CVE-2019-11848](https://cve.now/CVE-2019-11848.md): ALEOS AT Command API Abuse (CVSS 4.1)
- [CVE-2019-11850](https://cve.now/CVE-2019-11850.md): ALEOS AT Command Stack Overflow (CVSS 6.3)
- [CVE-2019-11849](https://cve.now/CVE-2019-11849.md): ALEOS AT API Stack Overflow (CVSS 6.3)
- [CVE-2019-11847](https://cve.now/CVE-2019-11847.md): ALEOS User Root Shell Escalation (CVSS 7.3)
- [CVE-2020-14201](https://cve.now/CVE-2020-14201.md): Dolibarr CRM before 11.0.5 allows privilege escalation. (no CVSS, dolibarr/dolibarr)
- [CVE-2020-3975](https://cve.now/CVE-2020-3975.md): VMware App Volumes 2.x prior to 2.18.6 and VMware App Volumes 4 prior to 2006 contain a Stored Cross-Site Scripting (XSS) vulnerability. (no CVSS, VMware App Volumes)
- [CVE-2020-5775](https://cve.now/CVE-2020-5775.md): Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HT (no CVSS, Instructure Canvas Learning Management System)
- [CVE-2020-15147](https://cve.now/CVE-2020-15147.md): Remote Code Execution in Red Discord Bot (CVSS 8.5, Cog-Creators Red-DiscordBot · red-discordbot)
- [CVE-2020-15140](https://cve.now/CVE-2020-15140.md): Remote Code Execution in Red Discord Bot (CVSS 8.2, Cog-Creators Red-DiscordBot · red-discordbot)
- [CVE-2020-20633](https://cve.now/CVE-2020-20633.md): ajax\_policy\_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) (no CVSS)
- [CVE-2020-10290](https://cve.now/CVE-2020-10290.md): RVD#1495: Universal Robots URCaps execute with unbounded privileges (CVSS 6.8, Universal Robots URx)
- [CVE-2020-20634](https://cve.now/CVE-2020-20634.md): Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. (no CVSS)
- [CVE-2020-24057](https://cve.now/CVE-2020-24057.md): The management website of the Verint S5120FD Verint\_FW\_0\_42 unit features a CGI endpoint ('ipfilter.cgi') that allows the user to manage net (no CVSS)
- [CVE-2020-24056](https://cve.now/CVE-2020-24056.md): A hardcoded credentials vulnerability exists in Verint 5620PTZ Verint\_FW\_0\_42, Verint 4320 V4320\_FW\_0\_23, V4320\_FW\_0\_31, and Verint S5120FD (no CVSS)
- [CVE-2020-24055](https://cve.now/CVE-2020-24055.md): Verint 5620PTZ Verint\_FW\_0\_42 and Verint 4320 V4320\_FW\_0\_23, and V4320\_FW\_0\_31 units feature an autodiscovery service implemented in the bin (no CVSS)
- [CVE-2020-24054](https://cve.now/CVE-2020-24054.md): The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given p (no CVSS)
- [CVE-2020-24053](https://cve.now/CVE-2020-24053.md): Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability. (no CVSS)
- [CVE-2020-24052](https://cve.now/CVE-2020-24052.md): Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to (no CVSS)
- [CVE-2020-7923](https://cve.now/CVE-2020-7923.md): Specific GeoQuery can cause DoS against MongoDB Server (CVSS 6.5, MongoDB Server)
- [CVE-2020-24051](https://cve.now/CVE-2020-24051.md): The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires auth (no CVSS)
- [CVE-2020-9246](https://cve.now/CVE-2020-9246.md): FusionCompute 8.0.0 has an information leak vulnerability. (no CVSS, FusionCompute)
- [CVE-2020-9095](https://cve.now/CVE-2020-9095.md): HUAWEI P30 Pro smartphone with Versions earlier than 10.1.0.160(C00E160R2P8) has an integer overflow vulnerability. (no CVSS, HUAWEI P30 Pro)
- [CVE-2020-9096](https://cve.now/CVE-2020-9096.md): HUAWEI P30 Pro smartphones with Versions earlier than 10.1.0.160(C00E160R2P8) have an out of bound read vulnerability. (no CVSS, HUAWEI P30 Pro)
- [CVE-2020-15309](https://cve.now/CVE-2020-15309.md): An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. (no CVSS)
- [CVE-2020-9104](https://cve.now/CVE-2020-9104.md): HUAWEI P30 smartphones with Versions earlier than 10.1.0.123(C431E22R2P5),Versions earlier than 10.1.0.123(C432E22R2P5),Versions earlier tha (no CVSS, HUAWEI P30)
- [CVE-2020-12457](https://cve.now/CVE-2020-12457.md): An issue was discovered in wolfSSL before 4.5.0. (no CVSS)
- [CVE-2020-24585](https://cve.now/CVE-2020-24585.md): An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. (no CVSS)
- [CVE-2020-3976](https://cve.now/CVE-2020-3976.md): VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services. (no CVSS, ESXi, vCenter Server, and Cloud Foundation)
- [CVE-2020-5774](https://cve.now/CVE-2020-5774.md): Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. (no CVSS, Tenable Nessus)
- [CVE-2020-16239](https://cve.now/CVE-2020-16239.md): Philips SureSigns VS4 Improper Authentication (CVSS 4.9, Philips SureSigns VS4)
- [CVE-2020-16241](https://cve.now/CVE-2020-16241.md): Philips SureSigns VS4 Improper Access Control (CVSS 6.3, Philips SureSigns VS4)
- [CVE-2020-16237](https://cve.now/CVE-2020-16237.md): Philips SureSigns VS4 Improper Input Validation (CVSS 2.1, Philips SureSigns VS4)
- [CVE-2020-14518](https://cve.now/CVE-2020-14518.md): Philips DreamMapper Insertion of Sensitive Information into Log File (CVSS 5.3, Philips DreamMapper)
- [CVE-2020-7710](https://cve.now/CVE-2020-7710.md): Sandbox Escape (CVSS 8.1, safe-eval)
- [CVE-2020-7310](https://cve.now/CVE-2020-7310.md): Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial installer (CVSS 6.9, McAfee Total Protection (MTP) Trial)
- [CVE-2020-12759](https://cve.now/CVE-2020-12759.md): Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook. (no CVSS)
- [CVE-2020-14194](https://cve.now/CVE-2020-14194.md): Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link. (no CVSS)
- [CVE-2020-14215](https://cve.now/CVE-2020-14215.md): Zulip Server before 2.1.5 has Incorrect Access Control because 0198\_preregistrationuser\_invited\_as adds the administrator role to invitation (no CVSS)
- [CVE-2020-15070](https://cve.now/CVE-2020-15070.md): Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose (no CVSS)
- [CVE-2020-24574](https://cve.now/CVE-2020-24574.md): The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation fr (no CVSS)
- [CVE-2020-24571](https://cve.now/CVE-2020-24571.md): NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal. (no CVSS)
- [CVE-2020-24567](https://cve.now/CVE-2020-24567.md): voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via a Trojan horse urlmon.dll file in the installation (no CVSS)
- [CVE-2020-15858](https://cve.now/CVE-2020-15858.md): Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. (CVSS 6.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.