# CVEs published 2020-08-27

54 CVEs were published on August 27, 2020: 0 critical, 9 high. Days are UTC.

- [CVE-2020-10517](https://cve.now/CVE-2020-10517.md): Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names (no CVSS, GitHub Enterprise Server)
- [CVE-2020-10518](https://cve.now/CVE-2020-10518.md): Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server (no CVSS, GitHub Enterprise Server)
- [CVE-2020-24715](https://cve.now/CVE-2020-24715.md): The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks (no CVSS, scalyr-agent-2)
- [CVE-2020-24714](https://cve.now/CVE-2020-24714.md): The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without t (no CVSS, scalyr-agent-2)
- [CVE-2020-15605](https://cve.now/CVE-2020-15605.md): If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection 2.0 SP2 could allow a (no CVSS, Trend Micro Vulnerability Protection)
- [CVE-2020-8602](https://cve.now/CVE-2020-8602.md): A vulnerability in the management consoles of Trend Micro Deep Security 10.0-12.0 and Trend Micro Vulnerability Protection 2.0 SP2 may allow (no CVSS, Trend Micro Deep Security · Trend Micro Vulnerability Manag…)
- [CVE-2020-15601](https://cve.now/CVE-2020-15601.md): If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Deep Security 10.x-12.x could allow an unauthe (no CVSS, Trend Micro Deep Security)
- [CVE-2020-24618](https://cve.now/CVE-2020-24618.md): In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can (no CVSS)
- [CVE-2020-5383](https://cve.now/CVE-2020-5383.md): Dell EMC Isilon OneFS version 8.2.2 and Dell EMC PowerScale OneFS version 9.0.0 contains a buffer overflow vulnerability in the Likewise com (CVSS 5.3, Dell Isilon OneFS)
- [CVE-2020-24716](https://cve.now/CVE-2020-24716.md): OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories. (no CVSS)
- [CVE-2020-24717](https://cve.now/CVE-2020-24717.md): OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equi (no CVSS)
- [CVE-2020-24203](https://cve.now/CVE-2020-24203.md): Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management (no CVSS)
- [CVE-2020-24202](https://cve.now/CVE-2020-24202.md): File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regular users, which allo (no CVSS)
- [CVE-2020-24196](https://cve.now/CVE-2020-24196.md): An Arbitrary File Upload in Vehicle Image Upload in Online Bike Rental v1.0 allows authenticated admin to conduct remote code execution. (no CVSS)
- [CVE-2020-3517](https://cve.now/CVE-2020-3517.md): Cisco FXOS and NX-OS Software Cisco Fabric Services Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2020-3338](https://cve.now/CVE-2020-3338.md): Cisco NX-OS Software IPv6 Protocol Independent Multicast Denial of Service Vulnerability (CVSS 7.5, Cisco NX-OS Software)
- [CVE-2020-3394](https://cve.now/CVE-2020-3394.md): Cisco Nexus 3000 and 9000 Series Switches Privilege Escalation Vulnerability (CVSS 7.8, Cisco NX-OS Software)
- [CVE-2020-3397](https://cve.now/CVE-2020-3397.md): Cisco NX-OS Software Border Gateway Protocol Multicast VPN Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2020-3398](https://cve.now/CVE-2020-3398.md): Cisco NX-OS Software Border Gateway Protocol Multicast VPN Session Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2020-3415](https://cve.now/CVE-2020-3415.md): Cisco NX-OS Software Data Management Engine Remote Code Execution Vulnerability (CVSS 8.8, Cisco NX-OS Software)
- [CVE-2020-3454](https://cve.now/CVE-2020-3454.md): Cisco NX-OS Software Call Home Command Injection Vulnerability (CVSS 7.2, Cisco NX-OS Software)
- [CVE-2020-3504](https://cve.now/CVE-2020-3504.md): Cisco UCS Manager Software Local Management CLI Denial of Service Vulnerability (CVSS 3.3, Cisco Unified Computing System)
- [CVE-2020-14415](https://cve.now/CVE-2020-14415.md): oss\_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position. (no CVSS)
- [CVE-2020-16142](https://cve.now/CVE-2020-16142.md): On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a devi (no CVSS)
- [CVE-2020-23576](https://cve.now/CVE-2020-23576.md): Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab. (no CVSS)
- [CVE-2020-24390](https://cve.now/CVE-2020-24390.md): eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin\_logs page, which might allow pre-authenticat (no CVSS)
- [CVE-2020-23983](https://cve.now/CVE-2020-23983.md): Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags. (no CVSS)
- [CVE-2020-23984](https://cve.now/CVE-2020-23984.md): Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags. (no CVSS)
- [CVE-2020-23982](https://cve.now/CVE-2020-23982.md): DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php' (no CVSS)
- [CVE-2020-23981](https://cve.now/CVE-2020-23981.md): 13enforme CMS 1.0 has Cross Site Scripting via the "content.php" id parameter. (no CVSS)
- [CVE-2020-23979](https://cve.now/CVE-2020-23979.md): 13enforme CMS 1.0 has SQL Injection via the 'content.php' id parameter. (no CVSS)
- [CVE-2020-23978](https://cve.now/CVE-2020-23978.md): SQL injection can occur in Soluzione Globale Ecommerce CMS v1 via the parameter " offerta.php" (no CVSS)
- [CVE-2020-23977](https://cve.now/CVE-2020-23977.md): KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the 'team.php,player.php,club.php' id parameter. (no CVSS)
- [CVE-2020-23976](https://cve.now/CVE-2020-23976.md): Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has SQL Injection via the 'content.php' id parameter. (no CVSS)
- [CVE-2020-23975](https://cve.now/CVE-2020-23975.md): Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter. (no CVSS)
- [CVE-2020-23974](https://cve.now/CVE-2020-23974.md): Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), (no CVSS)
- [CVE-2020-23973](https://cve.now/CVE-2020-23973.md): KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter. (no CVSS)
- [CVE-2020-23972](https://cve.now/CVE-2020-23972.md): In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application a (no CVSS)
- [CVE-2020-23980](https://cve.now/CVE-2020-23980.md): DesignMasterEvents Conference management 1.0.0 allows SQL Injection via the username field on the administrator login page. (no CVSS)
- [CVE-2020-4603](https://cve.now/CVE-2020-4603.md): IBM Security Guardium Insights 2.0.1 performs an operation at a privilege level that is higher than the minimum level required, which create (CVSS 3.3, IBM Security Guardium Insights)
- [CVE-2020-4575](https://cve.now/CVE-2020-4575.md): IBM WebSphere Application Server ND 8.5 and 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting whe (CVSS 4.7, IBM WebSphere Virtual Enterprise · IBM WebSphere Applicatio…)
- [CVE-2020-4175](https://cve.now/CVE-2020-4175.md): IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable (CVSS 5.9, IBM Security Guardium Insights)
- [CVE-2020-4172](https://cve.now/CVE-2020-4172.md): IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters. (CVSS 3.7, IBM Security Guardium Insights)
- [CVE-2020-4171](https://cve.now/CVE-2020-4171.md): IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.3, IBM Security Guardium Insights)
- [CVE-2020-4169](https://cve.now/CVE-2020-4169.md): IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensi (CVSS 5.9, IBM Security Guardium Insights)
- [CVE-2020-4167](https://cve.now/CVE-2020-4167.md): IBM Security Guardium Insights 2.0.1 could allow an attacker to obtain sensitive information or perform unauthorized actions due to improper (CVSS 6.5, IBM Security Guardium Insights)
- [CVE-2020-4166](https://cve.now/CVE-2020-4166.md): IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message i (CVSS 5.3, IBM Security Guardium Insights)
- [CVE-2020-4174](https://cve.now/CVE-2020-4174.md): IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensi (CVSS 5.9, IBM Security Guardium Insights)
- [CVE-2012-2201](https://cve.now/CVE-2012-2201.md): IBM WebSphere MQ 7.1 is vulnerable to a denial of service, caused by an error when handling user ids. (no CVSS)
- [CVE-2012-2160](https://cve.now/CVE-2012-2160.md): IBM Rational Change 5.3 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. (no CVSS)
- [CVE-2020-24703](https://cve.now/CVE-2020-24703.md): An issue was discovered in certain WSO2 products. (CVSS 8.8)
- [CVE-2020-24704](https://cve.now/CVE-2020-24704.md): An issue was discovered in certain WSO2 products. (CVSS 6.1)
- [CVE-2020-24705](https://cve.now/CVE-2020-24705.md): An issue was discovered in certain WSO2 products. (CVSS 8.8)
- [CVE-2020-24706](https://cve.now/CVE-2020-24706.md): An issue was discovered in certain WSO2 products. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.