# CVEs published 2020-08-31

69 CVEs were published on August 31, 2020: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-15704](https://cve.now/CVE-2020-15704.md): pppd arbitrary file read information disclosure vulnerability (CVSS 5.5, Canonical ppp)
- [CVE-2020-25057](https://cve.now/CVE-2020-25057.md): An issue was discovered on LG mobile devices with Android OS 10 software. (no CVSS)
- [CVE-2020-25059](https://cve.now/CVE-2020-25059.md): An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. (no CVSS)
- [CVE-2020-25060](https://cve.now/CVE-2020-25060.md): An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. (no CVSS)
- [CVE-2020-25061](https://cve.now/CVE-2020-25061.md): An issue was discovered on LG mobile devices with Android OS 9 and 10 software on the VZW network. (no CVSS)
- [CVE-2020-25062](https://cve.now/CVE-2020-25062.md): An issue was discovered on LG mobile devices with Android OS 9 and 10 software. (no CVSS)
- [CVE-2020-25063](https://cve.now/CVE-2020-25063.md): An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. (no CVSS)
- [CVE-2020-25064](https://cve.now/CVE-2020-25064.md): An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software. (no CVSS)
- [CVE-2020-25065](https://cve.now/CVE-2020-25065.md): An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software. (no CVSS)
- [CVE-2020-25058](https://cve.now/CVE-2020-25058.md): An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. (no CVSS)
- [CVE-2020-25046](https://cve.now/CVE-2020-25046.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. (no CVSS)
- [CVE-2020-25047](https://cve.now/CVE-2020-25047.md): An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (released in China and India) software. (no CVSS)
- [CVE-2020-25048](https://cve.now/CVE-2020-25048.md): An issue was discovered on Samsung mobile devices with Q(10.0) (with ONEUI 2.1) software. (no CVSS)
- [CVE-2020-25049](https://cve.now/CVE-2020-25049.md): An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. (no CVSS)
- [CVE-2020-25050](https://cve.now/CVE-2020-25050.md): An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. (no CVSS)
- [CVE-2020-25051](https://cve.now/CVE-2020-25051.md): An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. (no CVSS)
- [CVE-2020-25052](https://cve.now/CVE-2020-25052.md): An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. (no CVSS)
- [CVE-2020-25054](https://cve.now/CVE-2020-25054.md): An issue was discovered on Samsung mobile devices with software through 2020-04-02 (Exynos modem chipsets). (no CVSS)
- [CVE-2020-25055](https://cve.now/CVE-2020-25055.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. (no CVSS)
- [CVE-2020-25056](https://cve.now/CVE-2020-25056.md): An issue was discovered on Samsung mobile devices with Q(10.0) (Galaxy S20) software. (no CVSS)
- [CVE-2020-25053](https://cve.now/CVE-2020-25053.md): An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. (no CVSS)
- [CVE-2020-24354](https://cve.now/CVE-2020-24354.md): Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3\_1127, and possibly older versions of firmware are affected by shell injection. (no CVSS)
- [CVE-2020-14364](https://cve.now/CVE-2020-14364.md): An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. (no CVSS, QEMU)
- [CVE-2020-2075](https://cve.now/CVE-2020-2075.md): Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan L (no CVSS, Bulkscan LMS111; Bulkscan LMS511; CLV62x – CLV65x; ICR890-3…)
- [CVE-2020-7527](https://cve.now/CVE-2020-7527.md): Incorrect Default Permission vulnerability exists in SoMove (V2.8.1) and prior which could cause elevation of privilege and provide full acc (no CVSS, SoMove V2.8.1 and prior)
- [CVE-2020-7526](https://cve.now/CVE-2020-7526.md): Improper Input Validation vulnerability exists in PowerChute Business Edition (software V9.0.x and earlier) which could cause remote code ex (no CVSS, PowerChute Business Edition software V9.0.x and earlier)
- [CVE-2020-7525](https://cve.now/CVE-2020-7525.md): Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (form (no CVSS, All hardware versions of spaceLYnk and Wiser for KNX)
- [CVE-2020-7524](https://cve.now/CVE-2020-7524.md): Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (V5.0.0.7 and prior) which could cause Denial of Service when send (no CVSS, Modicon M218 Logic Controller V5.0.0.7 and prior)
- [CVE-2020-7523](https://cve.now/CVE-2020-7523.md): Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification for versions) which (no CVSS, Schneider Electric Modbus Serial Driver (64 bits) versions…)
- [CVE-2020-7522](https://cve.now/CVE-2020-7522.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Soft (no CVSS, SFAPV9601 - APC Easy UPS On-Line Software V2.0 and earlier)
- [CVE-2020-7521](https://cve.now/CVE-2020-7521.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Soft (no CVSS, SFAPV9601 - APC Easy UPS On-Line Software V2.0 and earlier)
- [CVE-2020-20628](https://cve.now/CVE-2020-20628.md): controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS. (no CVSS)
- [CVE-2020-20627](https://cve.now/CVE-2020-20627.md): The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings c (no CVSS)
- [CVE-2020-20626](https://cve.now/CVE-2020-20626.md): lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS. (no CVSS)
- [CVE-2020-20625](https://cve.now/CVE-2020-20625.md): Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via cor (no CVSS)
- [CVE-2020-24363](https://cve.now/CVE-2020-24363.md): TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP\_RESET POST request (CVSS 8.8, KEV)
- [CVE-2020-13472](https://cve.now/CVE-2020-13472.md): The flash memory readout protection in Gigadevice GD32F103 devices allows physical attackers to extract firmware via the debug interface by (no CVSS)
- [CVE-2020-15687](https://cve.now/CVE-2020-15687.md): Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious entity, with root ac (no CVSS)
- [CVE-2020-13471](https://cve.now/CVE-2020-13471.md): Apex Microelectronics APM32F103 devices allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/bre (no CVSS)
- [CVE-2020-13470](https://cve.now/CVE-2020-13470.md): Gigadevice GD32F103 and GD32F130 devices allow physical attackers to extract data via the probing of easily accessible bonding wires and de- (no CVSS)
- [CVE-2020-13469](https://cve.now/CVE-2020-13469.md): The flash memory readout protection in Gigadevice GD32VF103 devices allows physical attackers to extract firmware via the debug interface by (no CVSS)
- [CVE-2020-24699](https://cve.now/CVE-2020-24699.md): The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS. (no CVSS)
- [CVE-2020-13468](https://cve.now/CVE-2020-13468.md): Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection into inter-IC bonding (no CVSS)
- [CVE-2020-17465](https://cve.now/CVE-2020-17465.md): Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. (no CVSS)
- [CVE-2020-13467](https://cve.now/CVE-2020-13467.md): The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmwar (no CVSS)
- [CVE-2020-13466](https://cve.now/CVE-2020-13466.md): STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power glitch and a specific (no CVSS)
- [CVE-2020-13465](https://cve.now/CVE-2020-13465.md): The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execute arbitrary code via (no CVSS)
- [CVE-2020-13464](https://cve.now/CVE-2020-13464.md): The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmwar (no CVSS)
- [CVE-2020-13463](https://cve.now/CVE-2020-13463.md): The flash memory readout protection in Apex Microelectronics APM32F103 devices allows physical attackers to extract firmware via the debug i (no CVSS)
- [CVE-2020-13828](https://cve.now/CVE-2020-13828.md): Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to (no CVSS, dolibarr/dolibarr)
- [CVE-2020-5419](https://cve.now/CVE-2020-5419.md): RabbitMQ arbitrary code execution using local binary planting (CVSS 6.7, VMware Tanzu RabbitMQ)
- [CVE-2020-13595](https://cve.now/CVE-2020-13595.md): The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number o (no CVSS)
- [CVE-2020-13594](https://cve.now/CVE-2020-13594.md): The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does not properly restrict (no CVSS)
- [CVE-2020-13593](https://cve.now/CVE-2020-13593.md): The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R2-SDK through 2.2.3 (no CVSS)
- [CVE-2020-12829](https://cve.now/CVE-2020-12829.md): In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. (no CVSS)
- [CVE-2020-12646](https://cve.now/CVE-2020-12646.md): OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document. (no CVSS)
- [CVE-2020-12645](https://cve.now/CVE-2020-12645.md): OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and (no CVSS)
- [CVE-2020-12644](https://cve.now/CVE-2020-12644.md): OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API. (no CVSS)
- [CVE-2020-12643](https://cve.now/CVE-2020-12643.md): OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address. (no CVSS)
- [CVE-2020-11618](https://cve.now/CVE-2020-11618.md): THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes have their TELNET service hardcoded to start on boot, which allow (no CVSS)
- [CVE-2020-11617](https://cve.now/CVE-2020-11617.md): The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the SSL certificates of R (no CVSS)
- [CVE-2020-13655](https://cve.now/CVE-2020-13655.md): An issue was discovered in Collabtive 3.0 and later. (no CVSS)
- [CVE-2020-24786](https://cve.now/CVE-2020-24786.md): An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService (no CVSS)
- [CVE-2020-24115](https://cve.now/CVE-2020-24115.md): In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access. (no CVSS)
- [CVE-2020-4492](https://cve.now/CVE-2020-4492.md): IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a denial of service crashi (CVSS 6.2, IBM Spectrum Scale)
- [CVE-2020-15020](https://cve.now/CVE-2020-15020.md): An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. (no CVSS)
- [CVE-2020-25033](https://cve.now/CVE-2020-25033.md): The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe\_sidebar.php&status= reflected XSS. (no CVSS)
- [CVE-2020-25032](https://cve.now/CVE-2020-25032.md): An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. (no CVSS, flask-cors)
- [CVE-2020-25031](https://cve.now/CVE-2020-25031.md): checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 executable file. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.