# CVEs published 2020-08-24

41 CVEs were published on August 24, 2020: 1 critical, 6 high. Days are UTC.

- [CVE-2020-24613](https://cve.now/CVE-2020-24613.md): wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT\_CERT\_CR state, within SanityCheckTls13MsgReceived() in tls13.c. (no CVSS)
- [CVE-2020-24612](https://cve.now/CVE-2020-24612.md): An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is (CVSS 6.7)
- [CVE-2020-24572](https://cve.now/CVE-2020-24572.md): An issue was discovered in includes/webconsole.php in RaspAP 2.5. (no CVSS)
- [CVE-2020-7377](https://cve.now/CVE-2020-7377.md): Rapid7 Metasploit Framework Relative Path Traversal in telpho10\_credential\_dump module (CVSS 8.1, Rapid7 Metasploit Framework)
- [CVE-2020-7376](https://cve.now/CVE-2020-7376.md): Rapid7 Metasploit Framework Relative Path Traversal in enum\_osx module (CVSS 7.1, Rapid7 Metasploit Framework)
- [CVE-2020-6637](https://cve.now/CVE-2020-6637.md): openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php. (no CVSS)
- [CVE-2020-24364](https://cve.now/CVE-2020-24364.md): MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting. (no CVSS)
- [CVE-2020-7705](https://cve.now/CVE-2020-7705.md): Malicious Package (CVSS 7.1, MintegralAdSDK)
- [CVE-2020-24606](https://cve.now/CVE-2020-24606.md): Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handl (CVSS 8.6)
- [CVE-2020-10775](https://cve.now/CVE-2020-10775.md): An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arb (no CVSS, ovirt-engine)
- [CVE-2020-14043](https://cve.now/CVE-2020-14043.md): \*\* PRODUCT NOT SUPPORTED WHEN ASSIGNED \*\* A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later. (no CVSS, codiad/codiad)
- [CVE-2020-14044](https://cve.now/CVE-2020-14044.md): \*\* PRODUCT NOT SUPPORTED WHEN ASSIGNED \*\* A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. (no CVSS, codiad/codiad)
- [CVE-2020-4598](https://cve.now/CVE-2020-4598.md): IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (CVSS 6.5, IBM Security Guardium Insights)
- [CVE-2020-4593](https://cve.now/CVE-2020-4593.md): IBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be read by a local user. (CVSS 4.4, IBM Security Guardium Insights)
- [CVE-2020-4587](https://cve.now/CVE-2020-4587.md): IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, 6.0.0, and 6.1.0 is vulnerable to a stack based buffer ovreflow, caused by improper bound (CVSS 8.4, IBM Sterling Connect:Direct for UNIX · IBM Connect:Direct f…)
- [CVE-2020-4383](https://cve.now/CVE-2020-4383.md): IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during (CVSS 5.3, IBM Elastic Storage Server)
- [CVE-2020-4382](https://cve.now/CVE-2020-4382.md): IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during (CVSS 6.2, IBM Elastic Storage Server)
- [CVE-2020-4170](https://cve.now/CVE-2020-4170.md): IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau (CVSS 4.3, IBM Security Guardium Insights)
- [CVE-2020-4165](https://cve.now/CVE-2020-4165.md): IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 5.4, IBM Security Guardium Insights)
- [CVE-2018-1985](https://cve.now/CVE-2018-1985.md): IBM Trusteer Rapport/Apex 3.6.1908.22 contains an unused legacy driver which could allow a user with administrator privileges to cause a buf (CVSS 4.4, IBM Security Trusteer Rapport · IBM Security Rapport for Ma…)
- [CVE-2020-7831](https://cve.now/CVE-2020-7831.md): A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. (CVSS 8.8, INOGARD Ebiz4u CViewer Object AxECM.dll)
- [CVE-2020-19891](https://cve.now/CVE-2020-19891.md): DBHcms v1.2.0 has an Arbitrary file write vulnerability in dbhcms\\mod\\mod.editor.php $\_POST\['updatefile'\] is filename and $\_POST\['tinymce\_co (no CVSS)
- [CVE-2020-19890](https://cve.now/CVE-2020-19890.md): DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\\mod\\mod.editor.php $\_GET\['file'\] is filename,and as there is no filter func (no CVSS)
- [CVE-2020-19889](https://cve.now/CVE-2020-19889.md): DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcms\_pid=-70 can add a user. (no CVSS)
- [CVE-2020-19888](https://cve.now/CVE-2020-19888.md): DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\\page.php for empty cache o (no CVSS)
- [CVE-2020-19887](https://cve.now/CVE-2020-19887.md): DBHcms v1.2.0 has a stored XSS vulnerability as there is no htmlspecialchars function for '$\_POST\['pageparam\_insert\_description'\]' variable (no CVSS)
- [CVE-2020-19886](https://cve.now/CVE-2020-19886.md): DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for an /index.php?dbhcms\_pid=-80&deletemenu=9 can delete any menu. (no CVSS)
- [CVE-2020-19885](https://cve.now/CVE-2020-19885.md): DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$\_POST\['pageparam\_insert\_name'\]' variable in dbhc (no CVSS)
- [CVE-2020-19884](https://cve.now/CVE-2020-19884.md): DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function in dbhcms\\mod\\mod.domain.edit.php line 119. (no CVSS)
- [CVE-2020-19883](https://cve.now/CVE-2020-19883.md): DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter in dbhcms\\mod\\mod.users.view.php line 57 for user\_login, A remot (no CVSS)
- [CVE-2020-19882](https://cve.now/CVE-2020-19882.md): DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for 'menu\_description' variable in dbhcms\\mod\\mod.menu (no CVSS)
- [CVE-2020-19881](https://cve.now/CVE-2020-19881.md): DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\\mod\\mod.selector.php line 108 for $\_GET\['return\_nam (no CVSS)
- [CVE-2020-19880](https://cve.now/CVE-2020-19880.md): DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\\types.php, A remote unauthentica (no CVSS)
- [CVE-2020-19879](https://cve.now/CVE-2020-19879.md): DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $\_GET\['dbhcms\_pid'\] variable in dbhcms\\page.php line 107, (no CVSS)
- [CVE-2020-14367](https://cve.now/CVE-2020-14367.md): A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. (no CVSS, Chrony)
- [CVE-2020-19878](https://cve.now/CVE-2020-19878.md): DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A (no CVSS)
- [CVE-2020-19877](https://cve.now/CVE-2020-19877.md): DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. (no CVSS)
- [CVE-2020-24186](https://cve.now/CVE-2020-24186.md): A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated u (CVSS 10.0)
- [CVE-2020-14350](https://cve.now/CVE-2020-14350.md): It was found that some PostgreSQL extensions did not use search\_path safely in their installation script. (no CVSS, PostgreSQL)
- [CVE-2020-14349](https://cve.now/CVE-2020-14349.md): It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search\_path during logical rep (no CVSS, PostgreSQL)
- [CVE-2020-13101](https://cve.now/CVE-2020-13101.md): In OASIS Digital Signature Services (DSS) 1.0, an attacker can control the validation outcome (i.e., trigger either a valid or invalid outco (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.