# CVEs published 2020-08-26

104 CVEs were published on August 26, 2020: 2 critical, 6 high. Days are UTC.

- [CVE-2020-14729](https://cve.now/CVE-2020-14729.md): Vulnerability in SuiteCommerce Advanced (SCA) Sites component of Oracle NetSuite service. (CVSS 5.4, Oracle NetSuite service)
- [CVE-2020-14728](https://cve.now/CVE-2020-14728.md): Vulnerability in the SuiteCommerce Advanced (SCA) component of Oracle NetSuite service. (CVSS 5.4, Oracle NetSuite service)
- [CVE-2019-5321](https://cve.now/CVE-2019-5321.md): Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.\* before 16.08.0009, 16.09.\* befor (no CVSS, Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 293…)
- [CVE-2019-5320](https://cve.now/CVE-2019-5320.md): Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.\* before 16.08.0009, 16.09.\* befor (no CVSS, Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 293…)
- [CVE-2020-24598](https://cve.now/CVE-2020-24598.md): An issue was discovered in Joomla! before 3.9.21. (no CVSS)
- [CVE-2020-24599](https://cve.now/CVE-2020-24599.md): An issue was discovered in Joomla! before 3.9.21. (no CVSS)
- [CVE-2011-4820](https://cve.now/CVE-2011-4820.md): IBM Rational Asset Manager 7.5 could allow a remote attacker to bypass security restrictions. (no CVSS)
- [CVE-2019-4695](https://cve.now/CVE-2019-4695.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM Security Guardium Data Encryption)
- [CVE-2020-15485](https://cve.now/CVE-2020-15485.md): An issue was discovered on Nescomed Multipara Monitor M1000 devices. (no CVSS)
- [CVE-2020-15156](https://cve.now/CVE-2020-15156.md): XSS due to lack of CSRF validation for replying/publishing (CVSS 6.8, psychobunny nodebb-plugin-blog-comments · nodebb-plugin-blo…)
- [CVE-2019-4713](https://cve.now/CVE-2019-4713.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. (CVSS 8.8, IBM Security Guardium Data Encryption)
- [CVE-2019-4701](https://cve.now/CVE-2019-4701.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is deployed with active debugging code that can create unintended entry points. (CVSS 5.3, IBM Security Guardium Data Encryption)
- [CVE-2019-4699](https://cve.now/CVE-2019-4699.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, us (CVSS 2.7, IBM Security Guardium Data Encryption)
- [CVE-2019-4698](https://cve.now/CVE-2019-4698.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not require that users should have strong passwords by default, which makes it easi (CVSS 7.4, IBM Security Guardium Data Encryption)
- [CVE-2019-4697](https://cve.now/CVE-2019-4697.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated use (CVSS 5.3, IBM Security Guardium Data Encryption)
- [CVE-2019-4694](https://cve.now/CVE-2019-4694.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses (CVSS 6.8, IBM Security Guardium Data Encryption)
- [CVE-2019-4693](https://cve.now/CVE-2019-4693.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by a local privileged u (CVSS 6.0, IBM Security Guardium Data Encryption)
- [CVE-2019-4692](https://cve.now/CVE-2019-4692.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Security Guardium Data Encryption)
- [CVE-2019-4691](https://cve.now/CVE-2019-4691.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Guardium Data Encryption)
- [CVE-2019-4689](https://cve.now/CVE-2019-4689.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to (CVSS 5.9, IBM Security Guardium Data Encryption)
- [CVE-2019-4688](https://cve.now/CVE-2019-4688.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.7, IBM Security Guardium Data Encryption)
- [CVE-2019-4686](https://cve.now/CVE-2019-4686.md): IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.7, IBM Security Guardium Data Encryption)
- [CVE-2018-1501](https://cve.now/CVE-2018-1501.md): IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to missing security controls (CVSS 5.3, IBM Security Guardium)
- [CVE-2020-12855](https://cve.now/CVE-2020-12855.md): A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11. (no CVSS)
- [CVE-2020-17376](https://cve.now/CVE-2020-17376.md): An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. (no CVSS, nova)
- [CVE-2020-24548](https://cve.now/CVE-2020-24548.md): Ericom Access Server 9.2.0 (for AccessNow and Ericom Blaze) allows SSRF to make outbound WebSocket connection requests on arbitrary TCP port (no CVSS)
- [CVE-2020-11497](https://cve.now/CVE-2020-11497.md): An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. (no CVSS)
- [CVE-2020-11797](https://cve.now/CVE-2020-11797.md): An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x (no CVSS)
- [CVE-2020-12456](https://cve.now/CVE-2020-12456.md): A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary cod (no CVSS)
- [CVE-2020-13617](https://cve.now/CVE-2020-13617.md): The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker (no CVSS)
- [CVE-2020-15158](https://cve.now/CVE-2020-15158.md): Heap buffer overflow in libIEC61850 (CVSS 7.7, mz-automation libiec61850)
- [CVE-2020-13767](https://cve.now/CVE-2020-13767.md): The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insuffi (no CVSS)
- [CVE-2020-13863](https://cve.now/CVE-2020-13863.md): The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses (no CVSS)
- [CVE-2020-23659](https://cve.now/CVE-2020-23659.md): WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature. (no CVSS)
- [CVE-2020-23660](https://cve.now/CVE-2020-23660.md): webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search." (no CVSS)
- [CVE-2020-23658](https://cve.now/CVE-2020-23658.md): PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member\_poll\_panel/poll\_admin.php. (no CVSS)
- [CVE-2020-23657](https://cve.now/CVE-2020-23657.md): NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration." (no CVSS)
- [CVE-2020-23656](https://cve.now/CVE-2020-23656.md): NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content." (no CVSS)
- [CVE-2020-23655](https://cve.now/CVE-2020-23655.md): NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration." (no CVSS)
- [CVE-2020-23654](https://cve.now/CVE-2020-23654.md): NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop." (no CVSS)
- [CVE-2020-3151](https://cve.now/CVE-2020-3151.md): Cisco Connected Mobile Experiences Restricted Shell Escape Vulnerability (CVSS 5.1, Cisco Connected Mobile Experiences)
- [CVE-2020-3152](https://cve.now/CVE-2020-3152.md): Cisco Connected Mobile Experiences Privilege Escalation Vulnerability (CVSS 6.7, Cisco Connected Mobile Experiences)
- [CVE-2020-3389](https://cve.now/CVE-2020-3389.md): Cisco Hyperflex HX-Series Software Weak Storage Vulnerability (CVSS 4.4, Cisco HyperFlex HX Data Platform)
- [CVE-2020-3439](https://cve.now/CVE-2020-3439.md): Cisco Data Center Network Manager Stored Cross-Site Scripting Vulnerability (CVSS 5.9, Cisco Data Center Network Manager)
- [CVE-2020-3440](https://cve.now/CVE-2020-3440.md): Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite Vulnerability (CVSS 6.5, Cisco Webex Meetings)
- [CVE-2020-3443](https://cve.now/CVE-2020-3443.md): Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability (CVSS 8.8, Cisco Smart Software Manager On-Prem)
- [CVE-2020-3446](https://cve.now/CVE-2020-3446.md): Cisco vWAAS for Cisco ENCS 5400-W Series and CSP 5000-W Series Default Credentials Vulnerability (CVSS 9.8, Cisco Wide Area Application Services)
- [CVE-2020-3466](https://cve.now/CVE-2020-3466.md): Cisco DNA Center Cross-Site Scripting Vulnerabilities (CVSS 4.7, Cisco Digital Network Architecture Center)
- [CVE-2020-3484](https://cve.now/CVE-2020-3484.md): Cisco Vision Dynamic Signage Director Directory Traversal Information Disclosure Vulnerability (CVSS 5.3, Cisco Vision Dynamic Signage Director)
- [CVE-2020-3490](https://cve.now/CVE-2020-3490.md): Cisco Vision Dynamic Signage Director Path Traversal Vulnerability (CVSS 4.9, Cisco Vision Dynamic Signage Director)
- [CVE-2020-3485](https://cve.now/CVE-2020-3485.md): Cisco Vision Dynamic Signage Director Role-Based Access Control Vulnerability (CVSS 6.3, Cisco Vision Dynamic Signage Director)
- [CVE-2020-3491](https://cve.now/CVE-2020-3491.md): Cisco Vision Dynamic Signage Director Stored Cross-Site Scripting Vulnerability (CVSS 5.5, Cisco Vision Dynamic Signage Director)
- [CVE-2020-3496](https://cve.now/CVE-2020-3496.md): Cisco Small Business Smart and Managed Switches Denial of Service Vulnerability (CVSS 5.3, Cisco Small Business 250 Series Smart Switches Software)
- [CVE-2020-3505](https://cve.now/CVE-2020-3505.md): Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Memory Leak Vulnerability (CVSS 6.5, Cisco Video Surveillance 8000 Series IP Cameras)
- [CVE-2020-3506](https://cve.now/CVE-2020-3506.md): Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service Vulnerabilities (CVSS 8.8, Cisco Video Surveillance 8000 Series IP Cameras)
- [CVE-2020-3507](https://cve.now/CVE-2020-3507.md): Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service Vulnerabilities (CVSS 8.8, Cisco Video Surveillance 8000 Series IP Cameras)
- [CVE-2020-3518](https://cve.now/CVE-2020-3518.md): Cisco Data Center Network Manager Cross-Site Scripting Vulnerability (CVSS 6.5, Cisco Data Center Network Manager)
- [CVE-2020-3519](https://cve.now/CVE-2020-3519.md): Cisco Data Center Network Manager Path Traversal Vulnerability (CVSS 5.4, Cisco Data Center Network Manager)
- [CVE-2020-3520](https://cve.now/CVE-2020-3520.md): Cisco Data Center Network Manager Information Disclosure Vulnerability (CVSS 5.5, Cisco Data Center Network Manager)
- [CVE-2020-3521](https://cve.now/CVE-2020-3521.md): Cisco Data Center Network Manager Read File Path Traversal Vulnerability (CVSS 5.3, Cisco Data Center Network Manager)
- [CVE-2020-3522](https://cve.now/CVE-2020-3522.md): Cisco Data Center Network Manager Authorization Bypass Vulnerability (CVSS 6.3, Cisco Data Center Network Manager)
- [CVE-2020-3523](https://cve.now/CVE-2020-3523.md): Cisco Data Center Network Manager Cross-Site Scripting Vulnerability (CVSS 6.5, Cisco Data Center Network Manager)
- [CVE-2020-5928](https://cve.now/CVE-2020-5928.md): In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM Configurati (no CVSS, BIG-IP ASM)
- [CVE-2020-15482](https://cve.now/CVE-2020-15482.md): An issue was discovered on Nescomed Multipara Monitor M1000 devices. (no CVSS)
- [CVE-2020-5926](https://cve.now/CVE-2020-5926.md): In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server with a Session Initiation Protocol (SIP) A (no CVSS, BIG-IP)
- [CVE-2020-15483](https://cve.now/CVE-2020-15483.md): An issue was discovered on Nescomed Multipara Monitor M1000 devices. (no CVSS)
- [CVE-2020-5925](https://cve.now/CVE-2020-5925.md): In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed int (no CVSS, BIG-IP)
- [CVE-2020-13821](https://cve.now/CVE-2020-13821.md): An issue was discovered in HiveMQ Broker Control Center 4.3.2. (no CVSS)
- [CVE-2020-5921](https://cve.now/CVE-2020-5921.md): in BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, Syn flood cause (no CVSS, BIG-IP)
- [CVE-2020-15486](https://cve.now/CVE-2020-15486.md): An issue was discovered on Dr Trust ECG Pen 2.00.08 devices. (no CVSS)
- [CVE-2020-5927](https://cve.now/CVE-2020-5927.md): In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, BIG-IP ASM Configuration utility Stored-Cross Site Scripting. (no CVSS, BIG-IP ASM)
- [CVE-2020-24661](https://cve.now/CVE-2020-24661.md): GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., se (no CVSS)
- [CVE-2020-5920](https://cve.now/CVE-2020-5920.md): In versions 15.0.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a vulnerability in the BIG-IP AFM Confi (no CVSS, BIG-IP AFM)
- [CVE-2020-5922](https://cve.now/CVE-2020-5922.md): In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement (no CVSS, BIG-IP)
- [CVE-2020-5923](https://cve.now/CVE-2020-5923.md): In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 and BIG-IQ versions 5.4.0-7.0.0, (no CVSS, BIG-IP, BIG-IQ)
- [CVE-2020-15484](https://cve.now/CVE-2020-15484.md): An issue was discovered on Nescomed Multipara Monitor M1000 devices. (no CVSS)
- [CVE-2020-5924](https://cve.now/CVE-2020-5924.md): In BIG-IP APM versions 12.1.0-12.1.5.1 and 11.6.1-11.6.5.2, RADIUS authentication leaks memory when the username for authentication is not s (no CVSS, BIG-IP APM)
- [CVE-2020-13410](https://cve.now/CVE-2020-13410.md): An issue was discovered in MoscaJS Aedes 0.42.0. (no CVSS, aedes)
- [CVE-2020-5912](https://cve.now/CVE-2020-5912.md): In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad p (no CVSS, BIG-IP)
- [CVE-2020-5915](https://cve.now/CVE-2020-5915.md): In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed (no CVSS, BIG-IP)
- [CVE-2020-5916](https://cve.now/CVE-2020-5916.md): In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbit (no CVSS, BIG-IP)
- [CVE-2020-5919](https://cve.now/CVE-2020-5919.md): In versions 15.1.0-15.1.0.4, rendering of certain session variables by BIG-IP APM UI-based agents in an access profile configured with Moder (no CVSS, BIG-IP APM)
- [CVE-2020-16251](https://cve.now/CVE-2020-16251.md): HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentica (no CVSS, github.com/hashicorp/vault)
- [CVE-2020-16250](https://cve.now/CVE-2020-16250.md): HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentica (no CVSS, github.com/hashicorp/vault)
- [CVE-2020-5914](https://cve.now/CVE-2020-5914.md): In BIG-IP ASM versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed (no CVSS, BIG-IP ASM)
- [CVE-2020-5918](https://cve.now/CVE-2020-5918.md): In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Man (no CVSS, BIG-IP)
- [CVE-2020-5917](https://cve.now/CVE-2020-5917.md): In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versi (no CVSS, BIG-IP, BIG-IQ)
- [CVE-2020-5913](https://cve.now/CVE-2020-5913.md): In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profile (no CVSS, BIG-IP)
- [CVE-2020-24007](https://cve.now/CVE-2020-24007.md): Umanni RH 1.0 does not limit the number of authentication attempts. (no CVSS)
- [CVE-2019-18847](https://cve.now/CVE-2019-18847.md): Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. (no CVSS)
- [CVE-2020-24008](https://cve.now/CVE-2020-24008.md): Umanni RH 1.0 has a user enumeration vulnerability. (no CVSS)
- [CVE-2020-14498](https://cve.now/CVE-2020-14498.md): HMS Industrial Networks AB eCatcher Stack-based Buffer Overflow (CVSS 9.6, HMS Industrial Networks AB eCatcher)
- [CVE-2020-19007](https://cve.now/CVE-2020-19007.md): Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. (no CVSS)
- [CVE-2020-24316](https://cve.now/CVE-2020-24316.md): WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user (no CVSS)
- [CVE-2020-24315](https://cve.now/CVE-2020-24315.md): Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input (no CVSS)
- [CVE-2020-24314](https://cve.now/CVE-2020-24314.md): Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside (no CVSS)
- [CVE-2020-24313](https://cve.now/CVE-2020-24313.md): Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointmen (no CVSS)
- [CVE-2020-24312](https://cve.now/CVE-2020-24312.md): mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm\_backups directory with a .htaccess file. (no CVSS)
- [CVE-2020-15498](https://cve.now/CVE-2020-15498.md): An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385\_20253. (no CVSS)
- [CVE-2020-15499](https://cve.now/CVE-2020-15499.md): An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385\_20253. (no CVSS)
- [CVE-2020-16193](https://cve.now/CVE-2020-16193.md): osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info\['notes'\] call. (no CVSS)
- [CVE-2020-7309](https://cve.now/CVE-2020-7309.md): Cross Site Scripting vulnerability in ePO extension of MACC (CVSS 3.9, McAfee Application and Change Control)
- [CVE-2020-24656](https://cve.now/CVE-2020-24656.md): Maltego before 4.2.12 allows XXE attacks. (no CVSS)
- [CVE-2020-24653](https://cve.now/CVE-2020-24653.md): secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN\_UNLOCKED\_THIS\_DEVIC (no CVSS, expo)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.