CVEs published August 31, 2020
69 CVEs were published on August 31, 2020: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 69
- Critical
- 0
- High
- 1
- Medium
- 3
- Low
- 0
- Unrated
- 65
- Now in CISA KEV
- 1
- Fix available
- 3
Most affected products
- SFAPV9601 - APC Easy UPS On-Line Software V2.0 and earlier
- 2
- All hardware versions of spaceLYnk and Wiser for KNX
- 1
- Bulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3…
- 1
- Canonical ppp
- 1
- dolibarr/dolibarr
- 1
- flask-cors
- 1
- IBM Spectrum Scale
- 1
- Modicon M218 Logic Controller V5.0.0.7 and prior
- 1
- PowerChute Business Edition software V9.0.x and earlier
- 1
- QEMU
- 1
High 1
Medium, low and unrated 68
- CVE-2020-15704pppd arbitrary file read information disclosure vulnerabilityCanonical ppp
- CVE-2020-25057An issue was discovered on LG mobile devices with Android OS 10 software.
- CVE-2020-25059An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software.
- CVE-2020-25060An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software.
- CVE-2020-25061An issue was discovered on LG mobile devices with Android OS 9 and 10 software on the VZW network.
- CVE-2020-25062An issue was discovered on LG mobile devices with Android OS 9 and 10 software.
- CVE-2020-25063An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software.
- CVE-2020-25064An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software.
- CVE-2020-25065An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software.
- CVE-2020-25058An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software.
- CVE-2020-25046An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
- CVE-2020-25047An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (released in China and India) software.
- CVE-2020-25048An issue was discovered on Samsung mobile devices with Q(10.0) (with ONEUI 2.1) software.
- CVE-2020-25049An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software.
- CVE-2020-25050An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software.
- CVE-2020-25051An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software.
- CVE-2020-25052An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software.
- CVE-2020-25054An issue was discovered on Samsung mobile devices with software through 2020-04-02 (Exynos modem chipsets).
- CVE-2020-25055An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
- CVE-2020-25056An issue was discovered on Samsung mobile devices with Q(10.0) (Galaxy S20) software.
- CVE-2020-25053An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software.
- CVE-2020-24354Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by shell injection.
- CVE-2020-14364An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0.QEMU
- CVE-2020-2075Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LBulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3…
- CVE-2020-7527Incorrect Default Permission vulnerability exists in SoMove (V2.8.1) and prior which could cause elevation of privilege and provide full accSoMove V2.8.1 and prior
- CVE-2020-7526Improper Input Validation vulnerability exists in PowerChute Business Edition (software V9.0.x and earlier) which could cause remote code exPowerChute Business Edition software V9.0.x and earlier
- CVE-2020-7525Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (formAll hardware versions of spaceLYnk and Wiser for KNX
- CVE-2020-7524Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (V5.0.0.7 and prior) which could cause Denial of Service when sendModicon M218 Logic Controller V5.0.0.7 and prior
- CVE-2020-7523Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification for versions) whichSchneider Electric Modbus Serial Driver (64 bits) versions…
- CVE-2020-7522Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line SoftSFAPV9601 - APC Easy UPS On-Line Software V2.0 and earlier
- CVE-2020-7521Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line SoftSFAPV9601 - APC Easy UPS On-Line Software V2.0 and earlier
- CVE-2020-20628controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS.
- CVE-2020-20627The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings c
- CVE-2020-20626lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.
- CVE-2020-20625Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via cor
- CVE-2020-13472The flash memory readout protection in Gigadevice GD32F103 devices allows physical attackers to extract firmware via the debug interface by
- CVE-2020-15687Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious entity, with root ac
- CVE-2020-13471Apex Microelectronics APM32F103 devices allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/bre
- CVE-2020-13470Gigadevice GD32F103 and GD32F130 devices allow physical attackers to extract data via the probing of easily accessible bonding wires and de-
- CVE-2020-13469The flash memory readout protection in Gigadevice GD32VF103 devices allows physical attackers to extract firmware via the debug interface by
- CVE-2020-24699The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
- CVE-2020-13468Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection into inter-IC bonding
- CVE-2020-17465Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS.
- CVE-2020-13467The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmwar
- CVE-2020-13466STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power glitch and a specific
- CVE-2020-13465The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execute arbitrary code via
- CVE-2020-13464The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmwar
- CVE-2020-13463The flash memory readout protection in Apex Microelectronics APM32F103 devices allows physical attackers to extract firmware via the debug i
- CVE-2020-13828Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers todolibarr/dolibarr
- CVE-2020-5419RabbitMQ arbitrary code execution using local binary plantingVMware Tanzu RabbitMQ
- CVE-2020-13595The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number o
- CVE-2020-13594The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does not properly restrict
- CVE-2020-13593The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R2-SDK through 2.2.3
- CVE-2020-12829In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation.
- CVE-2020-12646OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.
- CVE-2020-12645OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and
- CVE-2020-12644OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API.
- CVE-2020-12643OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.
- CVE-2020-11618THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes have their TELNET service hardcoded to start on boot, which allow
- CVE-2020-11617The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the SSL certificates of R
- CVE-2020-13655An issue was discovered in Collabtive 3.0 and later.
- CVE-2020-24786An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService
- CVE-2020-24115In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access.
- CVE-2020-4492IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a denial of service crashiIBM Spectrum Scale
- CVE-2020-15020An issue was discovered in the Elementor plugin through 2.9.13 for WordPress.
- CVE-2020-25033The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.
- CVE-2020-25032An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9.flask-cors
- CVE-2020-25031checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 executable file.