CVEs published September 3, 2020
66 CVEs were published on September 3, 2020: 0 critical, 3 high.
- Published
- 66
- Critical
- 0
- High
- 3
- Medium
- 3
- Low
- 1
- Unrated
- 59
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- com.xuxueli:xxl-job
- 2
- Facebook WhatsApp Android · Facebook WhatsApp Business f… +2
- 2
- Facebook WhatsApp Desktop
- 2
- Facebook WhatsApp for Android · Facebook WhatsApp Business…
- 2
- IBM API Connect
- 2
- Rapid7 Nexpose
- 2
- B2368-22;B2368-57;B2368-66
- 1
- Cloud Foundry CAPI · Cloud Foundry CF Deployment
- 1
- Cloud Foundry Routing · Cloud Foundry CF Deployment
- 1
- ghostscript
- 1
High 3
Medium, low and unrated 63
- CVE-2020-24977GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.
- CVE-2020-24978In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c.
- CVE-2020-24996There is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2.
- CVE-2020-24999There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2.
- CVE-2020-1891A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhFacebook WhatsApp Android · Facebook WhatsApp Business f… +2
- CVE-2020-1894A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone priorFacebook WhatsApp Android · Facebook WhatsApp Business f… +2
- CVE-2020-1886A buffer overflow in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have allowed an out-of-Facebook WhatsApp for Android · Facebook WhatsApp Business…
- CVE-2020-1889A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in Electron and escalaFacebook WhatsApp Desktop
- CVE-2020-1890A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the reFacebook WhatsApp for Android · Facebook WhatsApp Business…
- CVE-2019-11928An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link frFacebook WhatsApp Desktop
- CVE-2020-25004Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary c
- CVE-2020-25005Heybbs v1.2 has a SQL injection vulnerability in msg.php file via the ID parameter which may allow a remote attacker to execute arbitrary co
- CVE-2020-25006Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbi
- CVE-2020-9083HUAWEI Mate 20 smart phones with Versions earlier than 10.1.0.163(C00E160R3P8) have a denial of service (DoS) vulnerability.HUAWEI Mate
- CVE-2020-9235Huawei smartphones HONOR 20 PRO Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier thHONOR 20 PRO;Honor View 20;OxfordS-AN00A;Princeton-AL10B;Pr…
- CVE-2020-24193A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication by
- CVE-2020-9199B2368-22 V100R001C00;B2368-57 V100R001C00;B2368-66 V100R001C00 have a command injection vulnerability.B2368-22;B2368-57;B2368-66
- CVE-2020-14373A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25.ghostscript
- CVE-2020-10720A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2.Kernel
- CVE-2020-25125GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim i
- CVE-2020-25115The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.
- CVE-2020-25116The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.
- CVE-2020-25117The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.
- CVE-2020-25118The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.
- CVE-2020-25119The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.
- CVE-2020-25120The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.
- CVE-2020-25121The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.
- CVE-2020-25122The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.
- CVE-2020-25123The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.
- CVE-2020-25124The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.
- CVE-2020-11579An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition.
- CVE-2020-23814Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) com.xuxueli:xxl-job
- CVE-2020-23811xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.com.xuxueli:xxl-job
- CVE-2020-25102silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) silverstripe-australia/advancedreports
- CVE-2020-24162The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL hijacking vulnerability.
- CVE-2020-24161Guangzhou NetEase Mail Master 4.14.1.1004 on Windows has a DLL hijacking vulnerability.
- CVE-2020-24160Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious
- CVE-2020-24159NetEase Youdao Dictionary has a DLL hijacking vulnerability, which can be exploited by attackers to gain server permissions.
- CVE-2020-24158360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code.
- CVE-2020-24876Use of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge session cookies, which may lead to remote pr
- CVE-2019-10679Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILES(X86)%\Thomson Reu
- CVE-2020-13972Enghouse Web Chat 6.2.284.34 allows XSS.
- CVE-2020-24385In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation la
- CVE-2020-24863A memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, an
- CVE-2020-25068Setelsa Conacwin v3.7.1.2 is vulnerable to a local file inclusion vulnerability.
- CVE-2020-25042An arbitrary file upload issue exists in Mara CMS 7.5.
- CVE-2020-25104eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object.
- CVE-2020-25105eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token (createHash has only a million possibilities).
- CVE-2020-24948The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing
- CVE-2020-7382Unquoted Path in Rapid7 Nexpose InstallerRapid7 Nexpose
- CVE-2020-7381Code Injection in Rapid7 Nexpose InstallerRapid7 Nexpose
- CVE-2020-4337IBM API Connect 2018.4.1.0 through 2018.4.1.12 could allow an attacker to launch phishing attacks by tricking the server to generate user reIBM API Connect
- CVE-2020-24949Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the
- CVE-2020-12058Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code.
- CVE-2020-25086Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/adminUsers.php.
- CVE-2020-25087Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/languages.php.
- CVE-2020-25088Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/blog/blogpublish.php.
- CVE-2020-25089Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/discounts.php.
- CVE-2020-25090Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php.
- CVE-2020-25091Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php.
- CVE-2020-25092Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in _parts/header.php, within application/views/templates/clothesshop, applicati
- CVE-2020-25093Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in blog.php.
- CVE-2020-5418Cloud Controller allows users with no roles to list dropletsCloud Foundry CAPI · Cloud Foundry CF Deployment