CVEs published August 24, 2020
41 CVEs were published on August 24, 2020: 1 critical, 6 high.
- Published
- 41
- Critical
- 1
- High
- 6
- Medium
- 8
- Low
- 0
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- IBM Security Guardium Insights
- 4
- codiad/codiad
- 2
- IBM Elastic Storage Server
- 2
- PostgreSQL
- 2
- Rapid7 Metasploit Framework
- 2
- Chrony
- 1
- IBM Security Trusteer Rapport · IBM Security Rapport for Ma…
- 1
- IBM Sterling Connect:Direct for UNIX · IBM Connect:Direct f…
- 1
- INOGARD Ebiz4u CViewer Object AxECM.dll
- 1
- MintegralAdSDK
- 1
Critical 1
High 6
- CVE-2020-7377Rapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump moduleRapid7 Metasploit Framework
- CVE-2020-7376Rapid7 Metasploit Framework Relative Path Traversal in enum_osx moduleRapid7 Metasploit Framework
- CVE-2020-7705Malicious PackageMintegralAdSDK
- CVE-2020-24606Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handl
- CVE-2020-4587IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, 6.0.0, and 6.1.0 is vulnerable to a stack based buffer ovreflow, caused by improper boundIBM Sterling Connect:Direct for UNIX · IBM Connect:Direct f…
- CVE-2020-7831A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file.INOGARD Ebiz4u CViewer Object AxECM.dll
Medium, low and unrated 34
- CVE-2020-24613wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c.
- CVE-2020-24612An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is
- CVE-2020-24572An issue was discovered in includes/webconsole.php in RaspAP 2.5.
- CVE-2020-6637openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.
- CVE-2020-24364MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting.
- CVE-2020-10775An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbovirt-engine
- CVE-2020-14043** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later.codiad/codiad
- CVE-2020-14044** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later.codiad/codiad
- CVE-2020-4598IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Security Guardium Insights
- CVE-2020-4593IBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be read by a local user.IBM Security Guardium Insights
- CVE-2020-4383IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during IBM Elastic Storage Server
- CVE-2020-4382IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during IBM Elastic Storage Server
- CVE-2020-4170IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauIBM Security Guardium Insights
- CVE-2020-4165IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim.IBM Security Guardium Insights
- CVE-2018-1985IBM Trusteer Rapport/Apex 3.6.1908.22 contains an unused legacy driver which could allow a user with administrator privileges to cause a bufIBM Security Trusteer Rapport · IBM Security Rapport for Ma…
- CVE-2020-19891DBHcms v1.2.0 has an Arbitrary file write vulnerability in dbhcms\mod\mod.editor.php $_POST['updatefile'] is filename and $_POST['tinymce_co
- CVE-2020-19890DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $_GET['file'] is filename,and as there is no filter func
- CVE-2020-19889DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcms_pid=-70 can add a user.
- CVE-2020-19888DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache o
- CVE-2020-19887DBHcms v1.2.0 has a stored XSS vulnerability as there is no htmlspecialchars function for '$_POST['pageparam_insert_description']' variable
- CVE-2020-19886DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for an /index.php?dbhcms_pid=-80&deletemenu=9 can delete any menu.
- CVE-2020-19885DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$_POST['pageparam_insert_name']' variable in dbhc
- CVE-2020-19884DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function in dbhcms\mod\mod.domain.edit.php line 119.
- CVE-2020-19883DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter in dbhcms\mod\mod.users.view.php line 57 for user_login, A remot
- CVE-2020-19882DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for 'menu_description' variable in dbhcms\mod\mod.menu
- CVE-2020-19881DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\mod\mod.selector.php line 108 for $_GET['return_nam
- CVE-2020-19880DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthentica
- CVE-2020-19879DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $_GET['dbhcms_pid'] variable in dbhcms\page.php line 107,
- CVE-2020-14367A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder.Chrony
- CVE-2020-19878DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A
- CVE-2020-19877DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/.
- CVE-2020-14350It was found that some PostgreSQL extensions did not use search_path safely in their installation script.PostgreSQL
- CVE-2020-14349It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical repPostgreSQL
- CVE-2020-13101In OASIS Digital Signature Services (DSS) 1.0, an attacker can control the validation outcome (i.e., trigger either a valid or invalid outco