# CVEs published 2020-08-25

52 CVEs were published on August 25, 2020: 4 critical, 22 high. Days are UTC.

- [CVE-2019-14904](https://cve.now/CVE-2019-14904.md): A flaw was found in the solaris\_zone module from the Ansible Community modules. (no CVSS, Ansible)
- [CVE-2020-19005](https://cve.now/CVE-2020-19005.md): zrlog v2.1.0 has a vulnerability with the permission check. (no CVSS)
- [CVE-2020-15777](https://cve.now/CVE-2020-15777.md): An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. (no CVSS, com.gradle:gradle-enterprise-maven-extension)
- [CVE-2020-17404](https://cve.now/CVE-2020-17404.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-17403](https://cve.now/CVE-2020-17403.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-17389](https://cve.now/CVE-2020-17389.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. (CVSS 8.8, Marvell QConvergeConsole)
- [CVE-2020-17387](https://cve.now/CVE-2020-17387.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. (CVSS 8.8, Marvell QConvergeConsole)
- [CVE-2020-17388](https://cve.now/CVE-2020-17388.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. (CVSS 8.8, Marvell QConvergeConsole)
- [CVE-2020-15644](https://cve.now/CVE-2020-15644.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. (CVSS 8.8, Marvell QConvergeConsole)
- [CVE-2020-15645](https://cve.now/CVE-2020-15645.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. (CVSS 8.8, Marvell QConvergeConsole)
- [CVE-2020-15641](https://cve.now/CVE-2020-15641.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. (CVSS 7.5, Marvell QConvergeConsole)
- [CVE-2020-15642](https://cve.now/CVE-2020-15642.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of installations of Marvell QConvergeConsole (CVSS 8.8, Marvell QConvergeConsole)
- [CVE-2020-15643](https://cve.now/CVE-2020-15643.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. (CVSS 8.8, Marvell QConvergeConsole)
- [CVE-2020-15639](https://cve.now/CVE-2020-15639.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. (CVSS 9.8, Marvell QConvergeConsole)
- [CVE-2020-15640](https://cve.now/CVE-2020-15640.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. (CVSS 7.5, Marvell QConvergeConsole)
- [CVE-2020-17402](https://cve.now/CVE-2020-17402.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4 (47270). (CVSS 6.5, Parallels Desktop)
- [CVE-2020-17399](https://cve.now/CVE-2020-17399.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. (CVSS 8.8, Parallels Desktop)
- [CVE-2020-17400](https://cve.now/CVE-2020-17400.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. (CVSS 8.8, Parallels Desktop)
- [CVE-2020-17401](https://cve.now/CVE-2020-17401.md): This vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Desktop 15.1.4. (CVSS 6.0, Parallels Desktop)
- [CVE-2020-17397](https://cve.now/CVE-2020-17397.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. (CVSS 7.5, Parallels Desktop)
- [CVE-2020-17398](https://cve.now/CVE-2020-17398.md): This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4. (CVSS 6.5, Parallels Desktop)
- [CVE-2020-17395](https://cve.now/CVE-2020-17395.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. (CVSS 7.5, Parallels Desktop)
- [CVE-2020-17396](https://cve.now/CVE-2020-17396.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. (CVSS 8.8, Parallels Desktop)
- [CVE-2020-17393](https://cve.now/CVE-2020-17393.md): This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. (CVSS 6.5, Parallels Desktop)
- [CVE-2020-17394](https://cve.now/CVE-2020-17394.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4. (CVSS 6.0, Parallels Desktop)
- [CVE-2020-17391](https://cve.now/CVE-2020-17391.md): This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. (CVSS 6.5, Parallels Desktop)
- [CVE-2020-17392](https://cve.now/CVE-2020-17392.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.3-47255. (CVSS 8.8, Parallels Desktop)
- [CVE-2020-17390](https://cve.now/CVE-2020-17390.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. (CVSS 3.8, Parallels Desktop)
- [CVE-2020-16197](https://cve.now/CVE-2020-16197.md): An issue was discovered in Octopus Deploy 3.4. (no CVSS)
- [CVE-2020-7824](https://cve.now/CVE-2020-7824.md): Ericssonlg iPECS Privilege Escalation Vulnerability (CVSS 6.5, Ericsson-LG iPCES UCM)
- [CVE-2020-24622](https://cve.now/CVE-2020-24622.md): In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user. (no CVSS)
- [CVE-2020-16245](https://cve.now/CVE-2020-16245.md): Advantech iView, Versions 5.7 and prior. (no CVSS, Advantech iView)
- [CVE-2020-24616](https://cve.now/CVE-2020-24616.md): FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.antero (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-14042](https://cve.now/CVE-2020-14042.md): \*\* PRODUCT NOT SUPPORTED WHEN ASSIGNED \*\* A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. (no CVSS, codiad/codiad)
- [CVE-2020-24609](https://cve.now/CVE-2020-24609.md): TechKshetra Info Solutions Pvt. (no CVSS)
- [CVE-2020-24242](https://cve.now/CVE-2020-24242.md): In Netwide Assembler (NASM) 2.15rc10, SEGV can be triggered in tok\_text in asm/preproc.c by accessing READ memory. (no CVSS)
- [CVE-2020-24241](https://cve.now/CVE-2020-24241.md): In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa\_wbytes in nasmlib/saa.c. (no CVSS)
- [CVE-2020-24240](https://cve.now/CVE-2020-24240.md): GNU Bison before 3.7.1 has a use-after-free in \_obstack\_free in lib/obstack.c (called from gram\_lex) when a '\\0' byte is encountered. (no CVSS)
- [CVE-2020-24614](https://cve.now/CVE-2020-24614.md): Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. (no CVSS)
- [CVE-2020-14524](https://cve.now/CVE-2020-14524.md): Softing Industrial Automation OPC (CVSS 9.8, Softing Industrial Automation all versions prior to the lat…)
- [CVE-2020-14522](https://cve.now/CVE-2020-14522.md): Softing Industrial Automation OPC (CVSS 7.5, Softing Industrial Automation all versions prior to the lat…)
- [CVE-2020-14512](https://cve.now/CVE-2020-14512.md): USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916 (CVSS 8.1, Secomea GateManager)
- [CVE-2020-14510](https://cve.now/CVE-2020-14510.md): OFF-BY-ONE ERROR CWE-193 (CVSS 9.8, Secomea GateManager)
- [CVE-2020-14508](https://cve.now/CVE-2020-14508.md): OFF-BY-ONE ERROR CWE-193 (CVSS 8.1, Secomea GateManager)
- [CVE-2020-14500](https://cve.now/CVE-2020-14500.md): IMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-158 (CVSS 10.0, Secomea GateManager all versions prior to)
- [CVE-2020-17386](https://cve.now/CVE-2020-17386.md): Cellopoint CelloOS - Server-Side Request Forgery (SSRF) (CVSS 6.5, Cellopoint CelloOS)
- [CVE-2020-17385](https://cve.now/CVE-2020-17385.md): Cellopoint CelloOS - Unauthenticated Arbitrary File Disclosure (CVSS 7.5, Cellopoint CelloOS)
- [CVE-2020-17384](https://cve.now/CVE-2020-17384.md): Cellopoint CelloOS - Remote Command Execution (RCE) (CVSS 7.2, Cellopoint CelloOS)
- [CVE-2020-5619](https://cve.now/CVE-2020-5619.md): Cross-site scripting vulnerability in Exment prior to v3.6.0 allows remote authenticated attackers to inject arbitrary script or HTML via un (no CVSS, Kajitori Co. Exment)
- [CVE-2020-5620](https://cve.now/CVE-2020-5620.md): Cross-site scripting vulnerability in Exment prior to v3.6.0 allows remote authenticated attackers to inject arbitrary script or HTML via a (no CVSS, Kajitori Co. Exment)
- [CVE-2020-5540](https://cve.now/CVE-2020-5540.md): Cross-site scripting vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to inject arbitrary script or HTML via a special (no CVSS, CyberSolutions CyberMail)
- [CVE-2020-5541](https://cve.now/CVE-2020-5541.md): Open redirect vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to redirect users to arbitrary sites and conduct phishi (no CVSS, CyberSolutions CyberMail)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.