# CVEs published 2020-09-01

105 CVEs were published on September 1, 2020: 26 critical, 8 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-24955](https://cve.now/CVE-2020-24955.md): SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivileged users to restore a (no CVSS)
- [CVE-2020-8341](https://cve.now/CVE-2020-8341.md): In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. (no CVSS, Lenovo ThinkPad)
- [CVE-2020-8335](https://cve.now/CVE-2020-8335.md): The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wuj (CVSS 6.1, Lenovo ThinkPad A285 BIOS · Lenovo ThinkPad A485 BIOS +2)
- [CVE-2020-6152](https://cve.now/CVE-2020-6152.md): A code execution vulnerability exists in the DICOM parse\_dicom\_meta\_info functionality of Accusoft ImageGear 19.7. (CVSS 9.8, Accusoft)
- [CVE-2020-6151](https://cve.now/CVE-2020-6151.md): A memory corruption vulnerability exists in the TIFF handle\_COMPRESSION\_PACKBITS functionality of Accusoft ImageGear 19.7. (CVSS 8.1, Accusoft)
- [CVE-2020-13946](https://cve.now/CVE-2020-13946.md): In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access (no CVSS, Apache Cassandra · org.apache.cassandra:cassandra-all)
- [CVE-2020-16204](https://cve.now/CVE-2020-16204.md): The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as (no CVSS, N-Tron 702-W / 702M12-W)
- [CVE-2020-16210](https://cve.now/CVE-2020-16210.md): The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and per (no CVSS, N-Tron 702-W / 702M12-W)
- [CVE-2020-16208](https://cve.now/CVE-2020-16208.md): The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a device (no CVSS, N-Tron 702-W / 702M12-W)
- [CVE-2020-16206](https://cve.now/CVE-2020-16206.md): The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain ac (no CVSS, N-Tron 702-W / 702M12-W)
- [CVE-2020-5776](https://cve.now/CVE-2020-5776.md): Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. (no CVSS, MAGMI · dweeves/magmi)
- [CVE-2020-5777](https://cve.now/CVE-2020-5777.md): MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a (no CVSS, MAGMI · dweeves/magmi)
- [CVE-2020-6873](https://cve.now/CVE-2020-6873.md): A ZTE product has a DoS vulnerability. (no CVSS, \<ZXR10 2800-4\_ALMPUFB(LOW)\>)
- [CVE-2020-6874](https://cve.now/CVE-2020-6874.md): A ZTE product is impacted by the cryptographic issues vulnerability. (no CVSS, \<ZXIPTV\>)
- [CVE-2020-6144](https://cve.now/CVE-2020-6144.md): A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. (CVSS 10.0, OS4Ed)
- [CVE-2020-6143](https://cve.now/CVE-2020-6143.md): A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. (CVSS 10.0, OS4Ed)
- [CVE-2020-25069](https://cve.now/CVE-2020-25069.md): USVN (aka User-friendly SVN) before 1.0.10 allows attackers to execute arbitrary code in the commit view. (no CVSS)
- [CVE-2020-25070](https://cve.now/CVE-2020-25070.md): USVN (aka User-friendly SVN) before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature. (no CVSS)
- [CVE-2020-6142](https://cve.now/CVE-2020-6142.md): A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. (CVSS 9.9, OS4Ed)
- [CVE-2020-6140](https://cve.now/CVE-2020-6140.md): SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. (CVSS 9.8, OS4Ed)
- [CVE-2020-6139](https://cve.now/CVE-2020-6139.md): SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. (CVSS 9.8, OS4Ed)
- [CVE-2020-6138](https://cve.now/CVE-2020-6138.md): SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. (CVSS 9.8, OS4Ed)
- [CVE-2020-6137](https://cve.now/CVE-2020-6137.md): SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. (CVSS 9.8, OS4Ed)
- [CVE-2020-24557](https://cve.now/CVE-2020-24557.md): A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a (CVSS 7.8, KEV, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2020-24558](https://cve.now/CVE-2020-24558.md): A vulnerability in an Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services dll may allow an (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2020-24559](https://cve.now/CVE-2020-24559.md): A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2020-24556](https://cve.now/CVE-2020-24556.md): A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business Security Services on (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan +1)
- [CVE-2020-17405](https://cve.now/CVE-2020-17405.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Symphony 7.3.2.2. (CVSS 8.8, Senstar Symphony)
- [CVE-2020-6141](https://cve.now/CVE-2020-6141.md): An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. (CVSS 9.8, OS4Ed)
- [CVE-2020-24034](https://cve.now/CVE-2020-24034.md): Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a pri (no CVSS)
- [CVE-2020-6136](https://cve.now/CVE-2020-6136.md): An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2020-23829](https://cve.now/CVE-2020-23829.md): interface/new/new\_comprehensive\_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote a (no CVSS)
- [CVE-2020-23831](https://cve.now/CVE-2020-23831.md): A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 al (CVSS 6.4)
- [CVE-2020-23836](https://cve.now/CVE-2020-23836.md): A Cross-Site Request Forgery (CSRF) vulnerability in edit\_user.php in OSWAPP Warehouse Inventory System (aka OSWA-INV) through 2020-08-10 al (no CVSS)
- [CVE-2020-23835](https://cve.now/CVE-2020-23835.md): A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Management System v1.0 a (CVSS 6.4)
- [CVE-2020-23839](https://cve.now/CVE-2020-23839.md): A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote at (no CVSS)
- [CVE-2020-15150](https://cve.now/CVE-2020-15150.md): Remote Code Execution in paginator(hex) (CVSS 9.0, duffelhq paginator)
- [CVE-2020-6135](https://cve.now/CVE-2020-6135.md): An exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2012-3341](https://cve.now/CVE-2012-3341.md): IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. (CVSS 6.4, IBM InfoSphere Guardium)
- [CVE-2012-3340](https://cve.now/CVE-2012-3340.md): IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to XML external entity injection, caused by improper validation of user-supplied in (CVSS 4.3, IBM InfoSphere Guardium)
- [CVE-2012-3338](https://cve.now/CVE-2012-3338.md): IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by improper restrictions on (CVSS 3.7, IBM InfoSphere Guardium)
- [CVE-2012-3337](https://cve.now/CVE-2012-3337.md): IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. (CVSS 5.3, IBM InfoSphere Guardium)
- [CVE-2012-3336](https://cve.now/CVE-2012-3336.md): IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to SQL injection. (CVSS 6.3, IBM InfoSphere Guardium)
- [CVE-2020-23450](https://cve.now/CVE-2020-23450.md): Spiceworks Version \<= 7.5.00107 is affected by XSS. (no CVSS)
- [CVE-2020-23971](https://cve.now/CVE-2020-23971.md): gmapfp.org Joomla Component GMapFP J3.30pro is affected by Insecure Permissions. (no CVSS)
- [CVE-2019-5645](https://cve.now/CVE-2019-5645.md): Rapid7 Metasploit HTTP Handler Denial of Service (CVSS 7.5, Rapid7 Metasploit Framework)
- [CVE-2020-6134](https://cve.now/CVE-2020-6134.md): SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. (CVSS 6.4, OS4Ed)
- [CVE-2020-6133](https://cve.now/CVE-2020-6133.md): SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. (CVSS 6.4, OS4Ed)
- [CVE-2020-6132](https://cve.now/CVE-2020-6132.md): SQL injection vulnerability exists in the ID parameters of OS4Ed openSIS 7.3 pages. (CVSS 6.4, OS4Ed)
- [CVE-2020-6128](https://cve.now/CVE-2020-6128.md): SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2020-6127](https://cve.now/CVE-2020-6127.md): SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2020-6126](https://cve.now/CVE-2020-6126.md): SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2020-6125](https://cve.now/CVE-2020-6125.md): An exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2020-6124](https://cve.now/CVE-2020-6124.md): An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2020-6123](https://cve.now/CVE-2020-6123.md): An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2020-14514](https://cve.now/CVE-2020-14514.md): Trailer Power Line Communications vulnerability (CVSS 4.3, Multiple Vendors All trailer power line communications are…)
- [CVE-2020-6122](https://cve.now/CVE-2020-6122.md): SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2020-6121](https://cve.now/CVE-2020-6121.md): SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2020-6120](https://cve.now/CVE-2020-6120.md): SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2020-7669](https://cve.now/CVE-2020-7669.md): Arbitrary File Write via Archive Extraction (Zip Slip) (CVSS 7.5, github.com/u-root/u-root/pkg/tarutil · github.com/u-root/u-…)
- [CVE-2020-7666](https://cve.now/CVE-2020-7666.md): Arbitrary File Write via Archive Extraction (Zip Slip) (CVSS 7.5, github.com/u-root/u-root/pkg/cpio)
- [CVE-2020-7665](https://cve.now/CVE-2020-7665.md): Arbitrary File Write via Archive Extraction (Zip Slip) (CVSS 7.5, github.com/u-root/u-root/pkg/uzip · github.com/u-root/u-root)
- [CVE-2020-6119](https://cve.now/CVE-2020-6119.md): SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. (CVSS 6.4, OS4Ed)
- [CVE-2020-6118](https://cve.now/CVE-2020-6118.md): SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. (CVSS 6.4, OS4ED")
- [CVE-2020-6117](https://cve.now/CVE-2020-6117.md): SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. (CVSS 6.4, OS4ED")
- [CVE-2020-2249](https://cve.now/CVE-2020-2249.md): Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkin (no CVSS, Jenkins project Jenkins Team Foundation Server Plugin · org…)
- [CVE-2020-2250](https://cve.now/CVE-2020-2250.md): Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins con (no CVSS, Jenkins project Jenkins SoapUI Pro Functional Testing Plugi…)
- [CVE-2020-2251](https://cve.now/CVE-2020-2251.md): Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job c (no CVSS, Jenkins project Jenkins SoapUI Pro Functional Testing Plugi…)
- [CVE-2020-2247](https://cve.now/CVE-2020-2247.md): Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Klocwork Analysis Plugin · org.jenk…)
- [CVE-2020-2248](https://cve.now/CVE-2020-2248.md): Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability. (no CVSS, Jenkins project Jenkins JSGames Plugin · org.jenkins-ci.plu…)
- [CVE-2020-2245](https://cve.now/CVE-2020-2245.md): Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Valgrind Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2246](https://cve.now/CVE-2020-2246.md): Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) v (no CVSS, Jenkins project Jenkins Valgrind Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2242](https://cve.now/CVE-2020-2242.md): A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an (no CVSS, Jenkins project Jenkins database Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2243](https://cve.now/CVE-2020-2243.md): Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (no CVSS, Jenkins project Jenkins Cadence vManager Plugin · org.jenki…)
- [CVE-2020-2244](https://cve.now/CVE-2020-2244.md): Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-s (no CVSS, Jenkins project Jenkins Build Failure Analyzer Plugin · com…)
- [CVE-2020-2240](https://cve.now/CVE-2020-2240.md): A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to execute arbitrary SQL scrip (no CVSS, Jenkins project Jenkins database Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2241](https://cve.now/CVE-2020-2241.md): A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-spec (no CVSS, Jenkins project Jenkins database Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2238](https://cve.now/CVE-2020-2238.md): Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a sto (no CVSS, Jenkins project Jenkins Git Parameter Plugin · org.jenkins-…)
- [CVE-2020-2239](https://cve.now/CVE-2020-2239.md): Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins co (no CVSS, Jenkins project Jenkins Parameterized Remote Trigger Plugin…)
- [CVE-2020-24554](https://cve.now/CVE-2020-24554.md): The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows (no CVSS, com.liferay.portal:release.portal.bom)
- [CVE-2020-6131](https://cve.now/CVE-2020-6131.md): SQL injection vulnerabilities exist in the course\_period\_id parameters used in OS4Ed openSIS 7.3 pages. (CVSS 6.4, OS4ED)
- [CVE-2020-6130](https://cve.now/CVE-2020-6130.md): SQL injection vulnerabilities exist in the course\_period\_id parameters used in OS4Ed openSIS 7.3 pages. (CVSS 6.4, OS4ED)
- [CVE-2020-6129](https://cve.now/CVE-2020-6129.md): SQL injection vulnerabilities exist in the course\_period\_id parameters used in OS4Ed openSIS 7.3 pages. (CVSS 6.4, OS4ED)
- [CVE-2020-24584](https://cve.now/CVE-2020-24584.md): An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). (no CVSS, django)
- [CVE-2020-24583](https://cve.now/CVE-2020-24583.md): An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). (no CVSS, django)
- [CVE-2018-12475](https://cve.now/CVE-2018-12475.md): obs-service-download\_files allows downloading from localhost or intranet hosts (CVSS 6.5, openSUSE Open Build Service)
- [CVE-2020-8023](https://cve.now/CVE-2020-8023.md): Local privilege escalation from ldap to root when using OPENLDAP\_CONFIG\_BACKEND=ldap in openldap2 (CVSS 7.7, SUSE Enterprise Storage · SUSE Linux Enterprise Debugin… +16)
- [CVE-2020-7725](https://cve.now/CVE-2020-7725.md): Prototype Pollution (CVSS 9.8, worksmith)
- [CVE-2020-7726](https://cve.now/CVE-2020-7726.md): Prototype Pollution (CVSS 9.8, safe-object2)
- [CVE-2020-7727](https://cve.now/CVE-2020-7727.md): Prototype Pollution (CVSS 9.8, gedi)
- [CVE-2020-7723](https://cve.now/CVE-2020-7723.md): Prototype Pollution (CVSS 9.8, promisehelpers)
- [CVE-2020-7724](https://cve.now/CVE-2020-7724.md): Prototype Pollution (CVSS 9.8, tiny-conf)
- [CVE-2020-7721](https://cve.now/CVE-2020-7721.md): Prototype Pollution (CVSS 9.8, node-oojs)
- [CVE-2020-7722](https://cve.now/CVE-2020-7722.md): Prototype Pollution (CVSS 9.8, nodee-utils)
- [CVE-2020-7720](https://cve.now/CVE-2020-7720.md): Prototype Pollution (CVSS 9.8, node-forge)
- [CVE-2020-7719](https://cve.now/CVE-2020-7719.md): Prototype Pollution (CVSS 9.8, locutus)
- [CVE-2020-7717](https://cve.now/CVE-2020-7717.md): Prototype Pollution (CVSS 9.8, dot-notes)
- [CVE-2020-7718](https://cve.now/CVE-2020-7718.md): Prototype Pollution (CVSS 9.8, gammautils)
- [CVE-2020-7714](https://cve.now/CVE-2020-7714.md): Prototype Pollution (CVSS 9.8, confucious)
- [CVE-2020-7715](https://cve.now/CVE-2020-7715.md): Prototype Pollution (CVSS 9.8, deep-get-set)
- [CVE-2020-7716](https://cve.now/CVE-2020-7716.md): Prototype Pollution (CVSS 9.8, deeps)
- [CVE-2020-7713](https://cve.now/CVE-2020-7713.md): Prototype Pollution (CVSS 9.8, arr-flatten-unflatten)
- [CVE-2020-12776](https://cve.now/CVE-2020-12776.md): Openfind Mail2000 - Broken Access Control (CVSS 6.6, Openfind Mail2000)
- [CVE-2020-14178](https://cve.now/CVE-2020-14178.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vu (no CVSS, Atlassian Jira Server)
- [CVE-2020-25067](https://cve.now/CVE-2020-25067.md): NETGEAR R8300 devices before 1.0.2.134 are affected by command injection by an unauthenticated attacker. (CVSS 9.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.