CVEs published September 1, 2020
105 CVEs were published on September 1, 2020: 26 critical, 8 high. 1 is now in CISA KEV.
- Published
- 105
- Critical
- 26
- High
- 8
- Medium
- 30
- Low
- 1
- Unrated
- 40
- Now in CISA KEV
- 1
- Fix available
- 26
Most affected products
- OS4Ed
- 23
- IBM InfoSphere Guardium
- 5
- N-Tron 702-W / 702M12-W
- 4
- Jenkins project Jenkins database Plugin · org.jenkins-ci.pl…
- 3
- OS4ED
- 3
- Trend Micro Apex One · Trend Micro Worry-Free Business Secu…
- 3
- Accusoft
- 2
- django
- 2
- Jenkins project Jenkins SoapUI Pro Functional Testing Plugi…
- 2
- Jenkins project Jenkins Valgrind Plugin · org.jenkins-ci.pl…
- 2
Critical 26
- CVE-2020-6152A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7.Accusoft
- CVE-2020-6144A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4.OS4Ed
- CVE-2020-6143A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4.OS4Ed
- CVE-2020-6142A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6140SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6139SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6138SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6137SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6141An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-15150Remote Code Execution in paginator(hex)duffelhq paginator
- CVE-2020-7725Prototype Pollutionworksmith
- CVE-2020-7726Prototype Pollutionsafe-object2
- CVE-2020-7727Prototype Pollutiongedi
- CVE-2020-7723Prototype Pollutionpromisehelpers
- CVE-2020-7724Prototype Pollutiontiny-conf
- CVE-2020-7721Prototype Pollutionnode-oojs
- CVE-2020-7722Prototype Pollutionnodee-utils
- CVE-2020-7720Prototype Pollutionnode-forge
- CVE-2020-7719Prototype Pollutionlocutus
- CVE-2020-7717Prototype Pollutiondot-notes
- CVE-2020-7718Prototype Pollutiongammautils
- CVE-2020-7714Prototype Pollutionconfucious
- CVE-2020-7715Prototype Pollutiondeep-get-set
- CVE-2020-7716Prototype Pollutiondeeps
- CVE-2020-7713Prototype Pollutionarr-flatten-unflatten
- CVE-2020-25067NETGEAR R8300 devices before 1.0.2.134 are affected by command injection by an unauthenticated attacker.
High 8
- CVE-2020-6151A memory corruption vulnerability exists in the TIFF handle_COMPRESSION_PACKBITS functionality of Accusoft ImageGear 19.7.Accusoft
- CVE-2020-24557A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate aTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2020-17405This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Symphony 7.3.2.2.Senstar Symphony
- CVE-2019-5645Rapid7 Metasploit HTTP Handler Denial of ServiceRapid7 Metasploit Framework
- CVE-2020-7669Arbitrary File Write via Archive Extraction (Zip Slip)github.com/u-root/u-root/pkg/tarutil · github.com/u-root/u-…
- CVE-2020-7666Arbitrary File Write via Archive Extraction (Zip Slip)github.com/u-root/u-root/pkg/cpio
- CVE-2020-7665Arbitrary File Write via Archive Extraction (Zip Slip)github.com/u-root/u-root/pkg/uzip · github.com/u-root/u-root
- CVE-2020-8023Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2SUSE Enterprise Storage · SUSE Linux Enterprise Debugin… +16
Medium, low and unrated 71
- CVE-2020-24955SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivileged users to restore a
- CVE-2020-8341In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash.Lenovo ThinkPad
- CVE-2020-8335The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wujLenovo ThinkPad A285 BIOS · Lenovo ThinkPad A485 BIOS +2
- CVE-2020-13946In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access Apache Cassandra · org.apache.cassandra:cassandra-all
- CVE-2020-16204The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as N-Tron 702-W / 702M12-W
- CVE-2020-16210The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perN-Tron 702-W / 702M12-W
- CVE-2020-16208The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a deviceN-Tron 702-W / 702M12-W
- CVE-2020-16206The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain acN-Tron 702-W / 702M12-W
- CVE-2020-5776Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens.MAGMI · dweeves/magmi
- CVE-2020-5777MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a MAGMI · dweeves/magmi
- CVE-2020-6873A ZTE product has a DoS vulnerability.<ZXR10 2800-4_ALMPUFB(LOW)>
- CVE-2020-6874A ZTE product is impacted by the cryptographic issues vulnerability.<ZXIPTV>
- CVE-2020-25069USVN (aka User-friendly SVN) before 1.0.10 allows attackers to execute arbitrary code in the commit view.
- CVE-2020-25070USVN (aka User-friendly SVN) before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature.
- CVE-2020-24558A vulnerability in an Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services dll may allow anTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2020-24559A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow Trend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2020-24556A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business Security Services onTrend Micro Apex One · Trend Micro OfficeScan +1
- CVE-2020-24034Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a pri
- CVE-2020-6136An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-23829interface/new/new_comprehensive_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote a
- CVE-2020-23831A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 al
- CVE-2020-23836A Cross-Site Request Forgery (CSRF) vulnerability in edit_user.php in OSWAPP Warehouse Inventory System (aka OSWA-INV) through 2020-08-10 al
- CVE-2020-23835A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Management System v1.0 a
- CVE-2020-23839A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote at
- CVE-2020-6135An exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3.OS4Ed
- CVE-2012-3341IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.IBM InfoSphere Guardium
- CVE-2012-3340IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to XML external entity injection, caused by improper validation of user-supplied inIBM InfoSphere Guardium
- CVE-2012-3338IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by improper restrictions onIBM InfoSphere Guardium
- CVE-2012-3337IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system.IBM InfoSphere Guardium
- CVE-2012-3336IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to SQL injection.IBM InfoSphere Guardium
- CVE-2020-23450Spiceworks Version <= 7.5.00107 is affected by XSS.
- CVE-2020-23971gmapfp.org Joomla Component GMapFP J3.30pro is affected by Insecure Permissions.
- CVE-2020-6134SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages.OS4Ed
- CVE-2020-6133SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages.OS4Ed
- CVE-2020-6132SQL injection vulnerability exists in the ID parameters of OS4Ed openSIS 7.3 pages.OS4Ed
- CVE-2020-6128SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6127SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6126SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6125An exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6124An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6123An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-14514Trailer Power Line Communications vulnerabilityMultiple Vendors All trailer power line communications are…
- CVE-2020-6122SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6121SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6120SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6119SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3.OS4Ed
- CVE-2020-6118SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3.OS4ED"
- CVE-2020-6117SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3.OS4ED"
- CVE-2020-2249Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the JenkinJenkins project Jenkins Team Foundation Server Plugin · org…
- CVE-2020-2250Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins conJenkins project Jenkins SoapUI Pro Functional Testing Plugi…
- CVE-2020-2251Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job cJenkins project Jenkins SoapUI Pro Functional Testing Plugi…
- CVE-2020-2247Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Klocwork Analysis Plugin · org.jenk…
- CVE-2020-2248Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.Jenkins project Jenkins JSGames Plugin · org.jenkins-ci.plu…
- CVE-2020-2245Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Valgrind Plugin · org.jenkins-ci.pl…
- CVE-2020-2246Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vJenkins project Jenkins Valgrind Plugin · org.jenkins-ci.pl…
- CVE-2020-2242A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an Jenkins project Jenkins database Plugin · org.jenkins-ci.pl…
- CVE-2020-2243Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scriptingJenkins project Jenkins Cadence vManager Plugin · org.jenki…
- CVE-2020-2244Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-sJenkins project Jenkins Build Failure Analyzer Plugin · com…
- CVE-2020-2240A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to execute arbitrary SQL scripJenkins project Jenkins database Plugin · org.jenkins-ci.pl…
- CVE-2020-2241A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specJenkins project Jenkins database Plugin · org.jenkins-ci.pl…
- CVE-2020-2238Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stoJenkins project Jenkins Git Parameter Plugin · org.jenkins-…
- CVE-2020-2239Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins coJenkins project Jenkins Parameterized Remote Trigger Plugin…
- CVE-2020-24554The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allowscom.liferay.portal:release.portal.bom
- CVE-2020-6131SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages.OS4ED
- CVE-2020-6130SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages.OS4ED
- CVE-2020-6129SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages.OS4ED
- CVE-2020-24584An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used).django
- CVE-2020-24583An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used).django
- CVE-2018-12475obs-service-download_files allows downloading from localhost or intranet hostsopenSUSE Open Build Service
- CVE-2020-12776Openfind Mail2000 - Broken Access ControlOpenfind Mail2000
- CVE-2020-14178Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vuAtlassian Jira Server