# CVEs published 2020-09-03

66 CVEs were published on September 3, 2020: 0 critical, 3 high. Days are UTC.

- [CVE-2020-24977](https://cve.now/CVE-2020-24977.md): GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. (no CVSS)
- [CVE-2020-24978](https://cve.now/CVE-2020-24978.md): In NASM 2.15.04rc3, there is a double-free vulnerability in pp\_tokline asm/preproc.c. (no CVSS)
- [CVE-2020-24996](https://cve.now/CVE-2020-24996.md): There is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2. (no CVSS)
- [CVE-2020-24999](https://cve.now/CVE-2020-24999.md): There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. (no CVSS)
- [CVE-2020-1891](https://cve.now/CVE-2020-1891.md): A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, Wh (no CVSS, Facebook WhatsApp Android · Facebook WhatsApp Business f… +2)
- [CVE-2020-1894](https://cve.now/CVE-2020-1894.md): A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior (no CVSS, Facebook WhatsApp Android · Facebook WhatsApp Business f… +2)
- [CVE-2020-1886](https://cve.now/CVE-2020-1886.md): A buffer overflow in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have allowed an out-of- (no CVSS, Facebook WhatsApp for Android · Facebook WhatsApp Business…)
- [CVE-2020-1889](https://cve.now/CVE-2020-1889.md): A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in Electron and escala (no CVSS, Facebook WhatsApp Desktop)
- [CVE-2020-1890](https://cve.now/CVE-2020-1890.md): A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the re (no CVSS, Facebook WhatsApp for Android · Facebook WhatsApp Business…)
- [CVE-2019-11928](https://cve.now/CVE-2019-11928.md): An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link fr (no CVSS, Facebook WhatsApp Desktop)
- [CVE-2020-25004](https://cve.now/CVE-2020-25004.md): Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary c (no CVSS)
- [CVE-2020-25005](https://cve.now/CVE-2020-25005.md): Heybbs v1.2 has a SQL injection vulnerability in msg.php file via the ID parameter which may allow a remote attacker to execute arbitrary co (no CVSS)
- [CVE-2020-25006](https://cve.now/CVE-2020-25006.md): Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbi (no CVSS)
- [CVE-2020-9083](https://cve.now/CVE-2020-9083.md): HUAWEI Mate 20 smart phones with Versions earlier than 10.1.0.163(C00E160R3P8) have a denial of service (DoS) vulnerability. (no CVSS, HUAWEI Mate)
- [CVE-2020-9235](https://cve.now/CVE-2020-9235.md): Huawei smartphones HONOR 20 PRO Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier th (no CVSS, HONOR 20 PRO;Honor View 20;OxfordS-AN00A;Princeton-AL10B;Pr…)
- [CVE-2020-24193](https://cve.now/CVE-2020-24193.md): A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication by (no CVSS)
- [CVE-2020-9199](https://cve.now/CVE-2020-9199.md): B2368-22 V100R001C00;B2368-57 V100R001C00;B2368-66 V100R001C00 have a command injection vulnerability. (no CVSS, B2368-22;B2368-57;B2368-66)
- [CVE-2020-14373](https://cve.now/CVE-2020-14373.md): A use after free was found in igc\_reloc\_struct\_ptr() of psi/igc.c of ghostscript-9.25. (no CVSS, ghostscript)
- [CVE-2020-10720](https://cve.now/CVE-2020-10720.md): A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. (no CVSS, Kernel)
- [CVE-2020-25125](https://cve.now/CVE-2020-25125.md): GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim i (no CVSS)
- [CVE-2020-25115](https://cve.now/CVE-2020-25115.md): The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager. (no CVSS)
- [CVE-2020-25116](https://cve.now/CVE-2020-25116.md): The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager. (no CVSS)
- [CVE-2020-25117](https://cve.now/CVE-2020-25117.md): The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager. (no CVSS)
- [CVE-2020-25118](https://cve.now/CVE-2020-25118.md): The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager. (no CVSS)
- [CVE-2020-25119](https://cve.now/CVE-2020-25119.md): The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual. (no CVSS)
- [CVE-2020-25120](https://cve.now/CVE-2020-25120.md): The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI. (no CVSS)
- [CVE-2020-25121](https://cve.now/CVE-2020-25121.md): The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options. (no CVSS)
- [CVE-2020-25122](https://cve.now/CVE-2020-25122.md): The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager. (no CVSS)
- [CVE-2020-25123](https://cve.now/CVE-2020-25123.md): The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager. (no CVSS)
- [CVE-2020-25124](https://cve.now/CVE-2020-25124.md): The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI. (no CVSS)
- [CVE-2020-11579](https://cve.now/CVE-2020-11579.md): An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. (no CVSS)
- [CVE-2020-23814](https://cve.now/CVE-2020-23814.md): Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) (no CVSS, com.xuxueli:xxl-job)
- [CVE-2020-23811](https://cve.now/CVE-2020-23811.md): xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java. (no CVSS, com.xuxueli:xxl-job)
- [CVE-2020-25102](https://cve.now/CVE-2020-25102.md): silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) (no CVSS, silverstripe-australia/advancedreports)
- [CVE-2020-24162](https://cve.now/CVE-2020-24162.md): The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL hijacking vulnerability. (no CVSS)
- [CVE-2020-24161](https://cve.now/CVE-2020-24161.md): Guangzhou NetEase Mail Master 4.14.1.1004 on Windows has a DLL hijacking vulnerability. (no CVSS)
- [CVE-2020-24160](https://cve.now/CVE-2020-24160.md): Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious (no CVSS)
- [CVE-2020-24159](https://cve.now/CVE-2020-24159.md): NetEase Youdao Dictionary has a DLL hijacking vulnerability, which can be exploited by attackers to gain server permissions. (no CVSS)
- [CVE-2020-24158](https://cve.now/CVE-2020-24158.md): 360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code. (no CVSS)
- [CVE-2020-24876](https://cve.now/CVE-2020-24876.md): Use of a hard-coded cryptographic key in Pancake versions \< 4.13.29 allows an attacker to forge session cookies, which may lead to remote pr (no CVSS)
- [CVE-2019-10679](https://cve.now/CVE-2019-10679.md): Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILES(X86)%\\Thomson Reu (no CVSS)
- [CVE-2020-13972](https://cve.now/CVE-2020-13972.md): Enghouse Web Chat 6.2.284.34 allows XSS. (no CVSS)
- [CVE-2020-24385](https://cve.now/CVE-2020-24385.md): In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation la (no CVSS)
- [CVE-2020-24863](https://cve.now/CVE-2020-24863.md): A memory corruption vulnerability was found in the kernel function kern\_getfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, an (no CVSS)
- [CVE-2020-25068](https://cve.now/CVE-2020-25068.md): Setelsa Conacwin v3.7.1.2 is vulnerable to a local file inclusion vulnerability. (no CVSS)
- [CVE-2020-25042](https://cve.now/CVE-2020-25042.md): An arbitrary file upload issue exists in Mara CMS 7.5. (no CVSS)
- [CVE-2020-25104](https://cve.now/CVE-2020-25104.md): eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. (no CVSS)
- [CVE-2020-25105](https://cve.now/CVE-2020-25105.md): eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token (createHash has only a million possibilities). (no CVSS)
- [CVE-2020-24948](https://cve.now/CVE-2020-24948.md): The ao\_ccss\_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing (no CVSS)
- [CVE-2020-7382](https://cve.now/CVE-2020-7382.md): Unquoted Path in Rapid7 Nexpose Installer (CVSS 6.8, Rapid7 Nexpose)
- [CVE-2020-7381](https://cve.now/CVE-2020-7381.md): Code Injection in Rapid7 Nexpose Installer (CVSS 5.8, Rapid7 Nexpose)
- [CVE-2020-4638](https://cve.now/CVE-2020-4638.md): IBM API Connect's API Manager 2018.4.1.0 through 2018.4.1.12 is vulnerable to privilege escalation. (CVSS 7.2, IBM API Connect)
- [CVE-2020-4337](https://cve.now/CVE-2020-4337.md): IBM API Connect 2018.4.1.0 through 2018.4.1.12 could allow an attacker to launch phishing attacks by tricking the server to generate user re (CVSS 6.5, IBM API Connect)
- [CVE-2020-24949](https://cve.now/CVE-2020-24949.md): Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the (no CVSS)
- [CVE-2020-12058](https://cve.now/CVE-2020-12058.md): Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. (no CVSS)
- [CVE-2020-7729](https://cve.now/CVE-2020-7729.md): Arbitrary Code Execution (CVSS 7.1, grunt)
- [CVE-2020-25086](https://cve.now/CVE-2020-25086.md): Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced\_settings/adminUsers.php. (no CVSS)
- [CVE-2020-25087](https://cve.now/CVE-2020-25087.md): Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced\_settings/languages.php. (no CVSS)
- [CVE-2020-25088](https://cve.now/CVE-2020-25088.md): Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/blog/blogpublish.php. (no CVSS)
- [CVE-2020-25089](https://cve.now/CVE-2020-25089.md): Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/discounts.php. (no CVSS)
- [CVE-2020-25090](https://cve.now/CVE-2020-25090.md): Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php. (no CVSS)
- [CVE-2020-25091](https://cve.now/CVE-2020-25091.md): Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add\_product.php. (no CVSS)
- [CVE-2020-25092](https://cve.now/CVE-2020-25092.md): Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in \_parts/header.php, within application/views/templates/clothesshop, applicati (no CVSS)
- [CVE-2020-25093](https://cve.now/CVE-2020-25093.md): Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in blog.php. (no CVSS)
- [CVE-2020-5420](https://cve.now/CVE-2020-5420.md): Gorouter is vulnerable to DoS attack via invalid HTTP responses (CVSS 7.7, Cloud Foundry Routing · Cloud Foundry CF Deployment)
- [CVE-2020-5418](https://cve.now/CVE-2020-5418.md): Cloud Controller allows users with no roles to list droplets (CVSS 3.1, Cloud Foundry CAPI · Cloud Foundry CF Deployment)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.