# CVEs published 2020-08-29

8 CVEs were published on August 29, 2020: 1 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-24972](https://cve.now/CVE-2020-24972.md): The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: (CVSS 8.8)
- [CVE-2020-24897](https://cve.now/CVE-2020-24897.md): The Table Filter and Charts for Confluence Server app before 5.3.25 (for Atlassian Confluence) allow remote attackers to inject arbitrary HT (CVSS 8.9)
- [CVE-2020-24898](https://cve.now/CVE-2020-24898.md): The Table Filter and Charts for Confluence Server app before 5.3.26 (for Atlassian Confluence) allows SSRF via the "Table from CSV" macro (U (CVSS 7.6)
- [CVE-2020-24928](https://cve.now/CVE-2020-24928.md): managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server (port 3020) open to all origins, which allows att (no CVSS)
- [CVE-2020-25020](https://cve.now/CVE-2020-25020.md): MPXJ through 8.1.3 allows XXE attacks. (CVSS 9.8, net.sf.mpxj:mpxj)
- [CVE-2020-25019](https://cve.now/CVE-2020-25019.md): jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is (no CVSS)
- [CVE-2020-3566](https://cve.now/CVE-2020-3566.md): Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability (CVSS 8.6, KEV, Cisco IOS XR Software)
- [CVE-2020-25016](https://cve.now/CVE-2020-25016.md): A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or d (no CVSS, rgb)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.