CVEs published August 26, 2020
104 CVEs were published on August 26, 2020: 2 critical, 6 high.
- Published
- 104
- Critical
- 2
- High
- 6
- Medium
- 30
- Low
- 4
- Unrated
- 62
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- IBM Security Guardium Data Encryption
- 13
- BIG-IP
- 9
- Cisco Data Center Network Manager
- 7
- Cisco Vision Dynamic Signage Director
- 4
- BIG-IP ASM
- 3
- Cisco Video Surveillance 8000 Series IP Cameras
- 3
- Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 293…
- 2
- BIG-IP APM
- 2
- BIG-IP, BIG-IQ
- 2
- Cisco Connected Mobile Experiences
- 2
Critical 2
High 6
- CVE-2019-4713IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system.IBM Security Guardium Data Encryption
- CVE-2019-4698IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not require that users should have strong passwords by default, which makes it easiIBM Security Guardium Data Encryption
- CVE-2020-15158Heap buffer overflow in libIEC61850mz-automation libiec61850
- CVE-2020-3443Cisco Smart Software Manager On-Prem Privilege Escalation VulnerabilityCisco Smart Software Manager On-Prem
- CVE-2020-3506Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service VulnerabilitiesCisco Video Surveillance 8000 Series IP Cameras
- CVE-2020-3507Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service VulnerabilitiesCisco Video Surveillance 8000 Series IP Cameras
Medium, low and unrated 96
- CVE-2020-14729Vulnerability in SuiteCommerce Advanced (SCA) Sites component of Oracle NetSuite service.Oracle NetSuite service
- CVE-2020-14728Vulnerability in the SuiteCommerce Advanced (SCA) component of Oracle NetSuite service.Oracle NetSuite service
- CVE-2019-5321Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* beforAruba Intelligent Edge Switch Series 2540, 2530, 2930F, 293…
- CVE-2019-5320Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* beforAruba Intelligent Edge Switch Series 2540, 2530, 2930F, 293…
- CVE-2020-24598An issue was discovered in Joomla! before 3.9.21.
- CVE-2020-24599An issue was discovered in Joomla! before 3.9.21.
- CVE-2011-4820IBM Rational Asset Manager 7.5 could allow a remote attacker to bypass security restrictions.
- CVE-2019-4695IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system.IBM Security Guardium Data Encryption
- CVE-2020-15485An issue was discovered on Nescomed Multipara Monitor M1000 devices.
- CVE-2020-15156XSS due to lack of CSRF validation for replying/publishingpsychobunny nodebb-plugin-blog-comments · nodebb-plugin-blo…
- CVE-2019-4701IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is deployed with active debugging code that can create unintended entry points.IBM Security Guardium Data Encryption
- CVE-2019-4699IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, usIBM Security Guardium Data Encryption
- CVE-2019-4697IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated useIBM Security Guardium Data Encryption
- CVE-2019-4694IBM Security Guardium Data Encryption (GDE) 3.0.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses IBM Security Guardium Data Encryption
- CVE-2019-4693IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by a local privileged uIBM Security Guardium Data Encryption
- CVE-2019-4692IBM Security Guardium Data Encryption (GDE) 3.0.0.2 discloses sensitive information to unauthorized users.IBM Security Guardium Data Encryption
- CVE-2019-4691IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is vulnerable to cross-site scripting.IBM Security Guardium Data Encryption
- CVE-2019-4689IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to IBM Security Guardium Data Encryption
- CVE-2019-4688IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies.IBM Security Guardium Data Encryption
- CVE-2019-4686IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies.IBM Security Guardium Data Encryption
- CVE-2018-1501IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to missing security controlsIBM Security Guardium
- CVE-2020-12855A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11.
- CVE-2020-17376An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0.nova
- CVE-2020-24548Ericom Access Server 9.2.0 (for AccessNow and Ericom Blaze) allows SSRF to make outbound WebSocket connection requests on arbitrary TCP port
- CVE-2020-11497An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress.
- CVE-2020-11797An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x
- CVE-2020-12456A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary cod
- CVE-2020-13617The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker
- CVE-2020-13767The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insuffi
- CVE-2020-13863The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses
- CVE-2020-23659WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature.
- CVE-2020-23660webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search."
- CVE-2020-23658PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.
- CVE-2020-23657NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
- CVE-2020-23656NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."
- CVE-2020-23655NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
- CVE-2020-23654NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop."
- CVE-2020-3151Cisco Connected Mobile Experiences Restricted Shell Escape VulnerabilityCisco Connected Mobile Experiences
- CVE-2020-3152Cisco Connected Mobile Experiences Privilege Escalation VulnerabilityCisco Connected Mobile Experiences
- CVE-2020-3389Cisco Hyperflex HX-Series Software Weak Storage VulnerabilityCisco HyperFlex HX Data Platform
- CVE-2020-3439Cisco Data Center Network Manager Stored Cross-Site Scripting VulnerabilityCisco Data Center Network Manager
- CVE-2020-3440Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite VulnerabilityCisco Webex Meetings
- CVE-2020-3466Cisco DNA Center Cross-Site Scripting VulnerabilitiesCisco Digital Network Architecture Center
- CVE-2020-3484Cisco Vision Dynamic Signage Director Directory Traversal Information Disclosure VulnerabilityCisco Vision Dynamic Signage Director
- CVE-2020-3490Cisco Vision Dynamic Signage Director Path Traversal VulnerabilityCisco Vision Dynamic Signage Director
- CVE-2020-3485Cisco Vision Dynamic Signage Director Role-Based Access Control VulnerabilityCisco Vision Dynamic Signage Director
- CVE-2020-3491Cisco Vision Dynamic Signage Director Stored Cross-Site Scripting VulnerabilityCisco Vision Dynamic Signage Director
- CVE-2020-3496Cisco Small Business Smart and Managed Switches Denial of Service VulnerabilityCisco Small Business 250 Series Smart Switches Software
- CVE-2020-3505Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Memory Leak VulnerabilityCisco Video Surveillance 8000 Series IP Cameras
- CVE-2020-3518Cisco Data Center Network Manager Cross-Site Scripting VulnerabilityCisco Data Center Network Manager
- CVE-2020-3519Cisco Data Center Network Manager Path Traversal VulnerabilityCisco Data Center Network Manager
- CVE-2020-3520Cisco Data Center Network Manager Information Disclosure VulnerabilityCisco Data Center Network Manager
- CVE-2020-3521Cisco Data Center Network Manager Read File Path Traversal VulnerabilityCisco Data Center Network Manager
- CVE-2020-3522Cisco Data Center Network Manager Authorization Bypass VulnerabilityCisco Data Center Network Manager
- CVE-2020-3523Cisco Data Center Network Manager Cross-Site Scripting VulnerabilityCisco Data Center Network Manager
- CVE-2020-5928In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM ConfiguratiBIG-IP ASM
- CVE-2020-15482An issue was discovered on Nescomed Multipara Monitor M1000 devices.
- CVE-2020-5926In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server with a Session Initiation Protocol (SIP) ABIG-IP
- CVE-2020-15483An issue was discovered on Nescomed Multipara Monitor M1000 devices.
- CVE-2020-5925In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed intBIG-IP
- CVE-2020-13821An issue was discovered in HiveMQ Broker Control Center 4.3.2.
- CVE-2020-5921in BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, Syn flood causeBIG-IP
- CVE-2020-15486An issue was discovered on Dr Trust ECG Pen 2.00.08 devices.
- CVE-2020-5927In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, BIG-IP ASM Configuration utility Stored-Cross Site Scripting.BIG-IP ASM
- CVE-2020-24661GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., se
- CVE-2020-5920In versions 15.0.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a vulnerability in the BIG-IP AFM ConfiBIG-IP AFM
- CVE-2020-5922In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implementBIG-IP
- CVE-2020-5923In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 and BIG-IQ versions 5.4.0-7.0.0, BIG-IP, BIG-IQ
- CVE-2020-15484An issue was discovered on Nescomed Multipara Monitor M1000 devices.
- CVE-2020-5924In BIG-IP APM versions 12.1.0-12.1.5.1 and 11.6.1-11.6.5.2, RADIUS authentication leaks memory when the username for authentication is not sBIG-IP APM
- CVE-2020-13410An issue was discovered in MoscaJS Aedes 0.42.0.aedes
- CVE-2020-5912In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad pBIG-IP
- CVE-2020-5915In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed BIG-IP
- CVE-2020-5916In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitBIG-IP
- CVE-2020-5919In versions 15.1.0-15.1.0.4, rendering of certain session variables by BIG-IP APM UI-based agents in an access profile configured with ModerBIG-IP APM
- CVE-2020-16251HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authenticagithub.com/hashicorp/vault
- CVE-2020-16250HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authenticagithub.com/hashicorp/vault
- CVE-2020-5914In BIG-IP ASM versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosedBIG-IP ASM
- CVE-2020-5918In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic ManBIG-IP
- CVE-2020-5917In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versiBIG-IP, BIG-IQ
- CVE-2020-5913In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profileBIG-IP
- CVE-2020-24007Umanni RH 1.0 does not limit the number of authentication attempts.
- CVE-2019-18847Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1.
- CVE-2020-24008Umanni RH 1.0 has a user enumeration vulnerability.
- CVE-2020-19007Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments.
- CVE-2020-24316WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user
- CVE-2020-24315Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input
- CVE-2020-24314Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside
- CVE-2020-24313Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointmen
- CVE-2020-24312mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file.
- CVE-2020-15498An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253.
- CVE-2020-15499An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253.
- CVE-2020-16193osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call.
- CVE-2020-7309Cross Site Scripting vulnerability in ePO extension of MACCMcAfee Application and Change Control
- CVE-2020-24656Maltego before 4.2.12 allows XXE attacks.
- CVE-2020-24653secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICexpo