# CVEs published 2020-09-02

42 CVEs were published on September 2, 2020: 1 critical, 7 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-5386](https://cve.now/CVE-2020-5386.md): Dell EMC ECS, versions prior to 3.5, contains an Exposure of Resource vulnerability. (CVSS 8.1, Dell Elastic Cloud Storage)
- [CVE-2020-5379](https://cve.now/CVE-2020-5379.md): Dell Inspiron 7352 BIOS versions prior to A12 contain a UEFI BIOS Boot Services overwrite vulnerability. (CVSS 6.8, Dell CPG BIOS)
- [CVE-2020-5378](https://cve.now/CVE-2020-5378.md): Dell G7 17 7790 BIOS versions prior to 1.13.2 contain a UEFI BIOS Boot Services overwrite vulnerability. (CVSS 6.8, Dell CPG BIOS)
- [CVE-2020-5376](https://cve.now/CVE-2020-5376.md): Dell Inspiron 7347 BIOS versions prior to A13 contain a UEFI BIOS Boot Services overwrite vulnerability. (CVSS 6.8, Dell CPG BIOS)
- [CVE-2020-5369](https://cve.now/CVE-2020-5369.md): Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability. (CVSS 8.8, Dell Isilon OneFS)
- [CVE-2020-25044](https://cve.now/CVE-2020-25044.md): Kaspersky Virus Removal Tool (KVRT) prior to 15.0.23.0 was vulnerable to arbitrary file corruption that could provide an attacker with the o (no CVSS, Kaspersky Virus Removal Tool)
- [CVE-2020-25043](https://cve.now/CVE-2020-25043.md): The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to dele (no CVSS, Kaspersky VPN Secure Connection)
- [CVE-2020-25045](https://cve.now/CVE-2020-25045.md): Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL (no CVSS, Kaspersky Security Center & Kaspersky Security Center Web C…)
- [CVE-2020-5779](https://cve.now/CVE-2020-5779.md): A flaw in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) relates to invalid parameter handling when calling strcpy\_s() with an invalid p (no CVSS, Trading Technologies Messaging)
- [CVE-2020-5778](https://cve.now/CVE-2020-5778.md): A flaw exists in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) due to improper validation of user-supplied data when processing a type (no CVSS, Trading Technologies Messaging)
- [CVE-2020-8576](https://cve.now/CVE-2020-8576.md): Clustered Data ONTAP versions prior to 9.3P19, 9.5P14, 9.6P9 and 9.7 are susceptible to a vulnerability which when successfully exploited co (no CVSS, Clustered Data ONTAP)
- [CVE-2020-7830](https://cve.now/CVE-2020-7830.md): RAONWIZ v2018.0.2.50 and earlier versions contains a vulnerability that could allow remote files to be downloaded by lack of validation. (CVSS 7.8, RAONWIZ RAON KUpload)
- [CVE-2020-4693](https://cve.now/CVE-2020-4693.md): IBM Spectrum Protect Operations Center 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 may allow an attacker to execute arbitrary code (CVSS 9.1, IBM Spectrum Protect Operations Center)
- [CVE-2020-4546](https://cve.now/CVE-2020-4546.md): IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Workflow Management · IBM Rational Team… +3)
- [CVE-2020-4522](https://cve.now/CVE-2020-4522.md): IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Rhapsody Design Manager · IBM Rational Qual… +3)
- [CVE-2020-4445](https://cve.now/CVE-2020-4445.md): IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Rhapsody Design Manager · IBM Rational Qual… +3)
- [CVE-2020-15167](https://cve.now/CVE-2020-15167.md): Arbitrary code execution via configuration file in Miller (CVSS 8.2, johnkerl miller)
- [CVE-2020-15094](https://cve.now/CVE-2020-15094.md): RCE in Symfony (CVSS 8.0, symfony · symfony/http-kernel +1)
- [CVE-2020-15811](https://cve.now/CVE-2020-15811.md): An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. (no CVSS)
- [CVE-2020-15810](https://cve.now/CVE-2020-15810.md): An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. (no CVSS)
- [CVE-2020-14209](https://cve.now/CVE-2020-14209.md): Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. (no CVSS, dolibarr/dolibarr)
- [CVE-2020-13802](https://cve.now/CVE-2020-13802.md): Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification. (no CVSS)
- [CVE-2020-12621](https://cve.now/CVE-2020-12621.md): The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component. (no CVSS)
- [CVE-2020-24553](https://cve.now/CVE-2020-24553.md): Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. (no CVSS, stdlib)
- [CVE-2020-24654](https://cve.now/CVE-2020-24654.md): In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a writ (no CVSS)
- [CVE-2020-25025](https://cve.now/CVE-2020-25025.md): The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosur (no CVSS, localizationteam/l10nmgr)
- [CVE-2020-25026](https://cve.now/CVE-2020-25026.md): The sf\_event\_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (no CVSS, derhansen/sf\_event\_mgt)
- [CVE-2020-24028](https://cve.now/CVE-2020-24028.md): ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user p (no CVSS)
- [CVE-2020-24029](https://cve.now/CVE-2020-24029.md): Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a sim (no CVSS)
- [CVE-2020-24030](https://cve.now/CVE-2020-24030.md): ForLogic Qualiex v1 and v3 has weak token expiration. (no CVSS)
- [CVE-2020-23830](https://cve.now/CVE-2020-23830.md): A Cross-Site Request Forgery (CSRF) vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attacke (no CVSS)
- [CVE-2020-25078](https://cve.now/CVE-2020-25078.md): An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. (CVSS 7.5, KEV)
- [CVE-2020-25079](https://cve.now/CVE-2020-25079.md): An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. (CVSS 8.8, KEV)
- [CVE-2020-24601](https://cve.now/CVE-2020-24601.md): In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnera (no CVSS)
- [CVE-2020-24604](https://cve.now/CVE-2020-24604.md): A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. (no CVSS)
- [CVE-2020-24602](https://cve.now/CVE-2020-24602.md): Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious UR (no CVSS)
- [CVE-2020-17458](https://cve.now/CVE-2020-17458.md): A post-authenticated stored XSS was found in MultiUx v.3.1.12.0 via the /multiux/SaveMailbox LastName field. (no CVSS)
- [CVE-2020-16602](https://cve.now/CVE-2020-16602.md): Razer Chroma SDK Rest Server through 3.12.17 allows remote attackers to execute arbitrary programs because there is a race condition in whic (no CVSS)
- [CVE-2020-24355](https://cve.now/CVE-2020-24355.md): Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3\_1127, and possibly older versions of firmware are affected by insecure permissions whic (no CVSS)
- [CVE-2020-5622](https://cve.now/CVE-2020-5622.md): Shadankun Server Security Type (excluding normal blocking method types) Ver.1.5.3 and earlier allows remote attackers to cause a denial of s (no CVSS, Cyber Security Cloud Shadankun Server Security Type)
- [CVE-2020-25073](https://cve.now/CVE-2020-25073.md): FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, bec (no CVSS)
- [CVE-2020-16150](https://cve.now/CVE-2020-16150.md): A Lucky 13 timing side channel in mbedtls\_ssl\_decrypt\_buf in library/ssl\_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacke (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.