# CVEs published 2020-08-30

7 CVEs were published on August 30, 2020: 0 critical, 2 high. Days are UTC.

- [CVE-2020-24104](https://cve.now/CVE-2020-24104.md): XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials without being connected (no CVSS)
- [CVE-2020-8097](https://cve.now/CVE-2020-8097.md): Improper authentication vulnerability in Bitdefender Endpoint Security Tools and Endpoint Security SDK (VA-8646) (CVSS 8.1, Bitdefender Endpoinit Security Tools for Windows · Bitdefen…)
- [CVE-2020-24223](https://cve.now/CVE-2020-24223.md): Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters. (no CVSS)
- [CVE-2020-24917](https://cve.now/CVE-2020-24917.md): osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::\_uploadInlineImage() in include/ajax.draft.php. (no CVSS)
- [CVE-2020-14352](https://cve.now/CVE-2020-14352.md): A flaw was found in librepo in versions before 1.12.1. (no CVSS, librepo)
- [CVE-2020-8244](https://cve.now/CVE-2020-8244.md): A buffer over-read vulnerability exists in bl \<4.0.3, \<3.0.1, \<2.2.1, and \<1.2.3 which could allow an attacker to supply user input (even ty (no CVSS, bl)
- [CVE-2020-7712](https://cve.now/CVE-2020-7712.md): Command Injection (CVSS 7.2, json · org.webjars.npm:json)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.