CVEs published September 2, 2020
42 CVEs were published on September 2, 2020: 1 critical, 7 high. 2 are now in CISA KEV.
- Published
- 42
- Critical
- 1
- High
- 7
- Medium
- 6
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 2
- Fix available
- 9
Most affected products
- Dell CPG BIOS
- 3
- IBM Rational Rhapsody Design Manager · IBM Rational Qual… +3
- 2
- Trading Technologies Messaging
- 2
- Clustered Data ONTAP
- 1
- Cyber Security Cloud Shadankun Server Security Type
- 1
- Dell Elastic Cloud Storage
- 1
- Dell Isilon OneFS
- 1
- derhansen/sf_event_mgt
- 1
- dolibarr/dolibarr
- 1
- IBM Engineering Workflow Management · IBM Rational Team… +3
- 1
Critical 1
High 7
- CVE-2020-5386Dell EMC ECS, versions prior to 3.5, contains an Exposure of Resource vulnerability.Dell Elastic Cloud Storage
- CVE-2020-5369Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability.Dell Isilon OneFS
- CVE-2020-7830RAONWIZ v2018.0.2.50 and earlier versions contains a vulnerability that could allow remote files to be downloaded by lack of validation.RAONWIZ RAON KUpload
- CVE-2020-15167Arbitrary code execution via configuration file in Millerjohnkerl miller
- CVE-2020-15094RCE in Symfonysymfony · symfony/http-kernel +1
- CVE-2020-25078An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.
- CVE-2020-25079An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices.
Medium, low and unrated 34
- CVE-2020-5379Dell Inspiron 7352 BIOS versions prior to A12 contain a UEFI BIOS Boot Services overwrite vulnerability.Dell CPG BIOS
- CVE-2020-5378Dell G7 17 7790 BIOS versions prior to 1.13.2 contain a UEFI BIOS Boot Services overwrite vulnerability.Dell CPG BIOS
- CVE-2020-5376Dell Inspiron 7347 BIOS versions prior to A13 contain a UEFI BIOS Boot Services overwrite vulnerability.Dell CPG BIOS
- CVE-2020-25044Kaspersky Virus Removal Tool (KVRT) prior to 15.0.23.0 was vulnerable to arbitrary file corruption that could provide an attacker with the oKaspersky Virus Removal Tool
- CVE-2020-25043The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to deleKaspersky VPN Secure Connection
- CVE-2020-25045Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLLKaspersky Security Center & Kaspersky Security Center Web C…
- CVE-2020-5779A flaw in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) relates to invalid parameter handling when calling strcpy_s() with an invalid pTrading Technologies Messaging
- CVE-2020-5778A flaw exists in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) due to improper validation of user-supplied data when processing a type Trading Technologies Messaging
- CVE-2020-8576Clustered Data ONTAP versions prior to 9.3P19, 9.5P14, 9.6P9 and 9.7 are susceptible to a vulnerability which when successfully exploited coClustered Data ONTAP
- CVE-2020-4546IBM Jazz Team Server based Applications are vulnerable to cross-site scripting.IBM Engineering Workflow Management · IBM Rational Team… +3
- CVE-2020-4522IBM Jazz Team Server based Applications are vulnerable to cross-site scripting.IBM Rational Rhapsody Design Manager · IBM Rational Qual… +3
- CVE-2020-4445IBM Jazz Team Server based Applications are vulnerable to cross-site scripting.IBM Rational Rhapsody Design Manager · IBM Rational Qual… +3
- CVE-2020-15811An issue was discovered in Squid before 4.13 and 5.x before 5.0.4.
- CVE-2020-15810An issue was discovered in Squid before 4.13 and 5.x before 5.0.4.
- CVE-2020-14209Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution.dolibarr/dolibarr
- CVE-2020-13802Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.
- CVE-2020-12621The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component.
- CVE-2020-24553Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.stdlib
- CVE-2020-24654In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a writ
- CVE-2020-25025The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosurlocalizationteam/l10nmgr
- CVE-2020-25026The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosurederhansen/sf_event_mgt
- CVE-2020-24028ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user p
- CVE-2020-24029Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a sim
- CVE-2020-24030ForLogic Qualiex v1 and v3 has weak token expiration.
- CVE-2020-23830A Cross-Site Request Forgery (CSRF) vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attacke
- CVE-2020-24601In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnera
- CVE-2020-24604A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1.
- CVE-2020-24602Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious UR
- CVE-2020-17458A post-authenticated stored XSS was found in MultiUx v.3.1.12.0 via the /multiux/SaveMailbox LastName field.
- CVE-2020-16602Razer Chroma SDK Rest Server through 3.12.17 allows remote attackers to execute arbitrary programs because there is a race condition in whic
- CVE-2020-24355Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insecure permissions whic
- CVE-2020-5622Shadankun Server Security Type (excluding normal blocking method types) Ver.1.5.3 and earlier allows remote attackers to cause a denial of sCyber Security Cloud Shadankun Server Security Type
- CVE-2020-25073FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, bec
- CVE-2020-16150A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacke