# CVEs published 2020-09-04

39 CVEs were published on September 4, 2020: 2 critical, 6 high. Days are UTC.

- [CVE-2020-24981](https://cve.now/CVE-2020-24981.md): An Incorrect Access Control vulnerability exists in /ucms/chk.php in UCMS 1.4.8. (no CVSS)
- [CVE-2020-24986](https://cve.now/CVE-2020-24986.md): Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. (no CVSS)
- [CVE-2020-24987](https://cve.now/CVE-2020-24987.md): Tenda AC18 Router through V15.03.05.05\_EN and through V15.03.05.19(6318) CN devices could cause a remote code execution due to incorrect aut (no CVSS)
- [CVE-2019-20916](https://cve.now/CVE-2019-20916.md): The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition h (no CVSS, pip)
- [CVE-2020-24963](https://cve.now/CVE-2020-24963.md): An Authenticated Persistent XSS vulnerability was discovered in the Best Support System, tested version v3.0.4. (no CVSS)
- [CVE-2020-14008](https://cve.now/CVE-2020-14008.md): Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location (no CVSS)
- [CVE-2020-7299](https://cve.now/CVE-2020-7299.md): Sensitive Data Exposure vulnerability in McAfee True Key Windows Client (CVSS 5.0, McAfee True Key Windows client)
- [CVE-2020-24659](https://cve.now/CVE-2020-24659.md): An issue was discovered in GnuTLS before 3.6.15. (no CVSS)
- [CVE-2020-4702](https://cve.now/CVE-2020-4702.md): IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM InfoSphere Information Server)
- [CVE-2020-4632](https://cve.now/CVE-2020-4632.md): IBM InfoSphere Metadata Asset Manager 11.7 is vulnerable to server-side request forgery. (CVSS 5.7, IBM InfoSphere Information Server)
- [CVE-2020-4545](https://cve.now/CVE-2020-4545.md): IBM Aspera Connect 3.9.9 could allow a remote attacker to execute arbitrary code on the system, caused by improper loading of Dynamic Link L (CVSS 7.8, IBM Aspera Connect)
- [CVE-2020-7119](https://cve.now/CVE-2020-7119.md): A vulnerability exists in the Aruba Analytics and Location Engine (ALE) web management interface 2.1.0.2 and earlier firmware that allows an (no CVSS, Aruba ALE ClearPass C1000 S-1200 R4 HW-Based Appliance)
- [CVE-2020-7730](https://cve.now/CVE-2020-7730.md): Command Injection (CVSS 9.8, bestzip)
- [CVE-2020-23834](https://cve.now/CVE-2020-23834.md): Insecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow local attackers to escalate privileges to a (CVSS 8.8)
- [CVE-2020-25023](https://cve.now/CVE-2020-25023.md): An issue was discovered in Noise-Java through 2020-08-27. (no CVSS)
- [CVE-2020-25022](https://cve.now/CVE-2020-25022.md): An issue was discovered in Noise-Java through 2020-08-27. (no CVSS)
- [CVE-2020-25021](https://cve.now/CVE-2020-25021.md): An issue was discovered in Noise-Java through 2020-08-27. (no CVSS)
- [CVE-2020-12248](https://cve.now/CVE-2020-12248.md): In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can execute arbitrary code via a heap-based buffer over (no CVSS)
- [CVE-2020-12247](https://cve.now/CVE-2020-12247.md): In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information from an out-of-bounds (no CVSS)
- [CVE-2020-11493](https://cve.now/CVE-2020-11493.md): In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information about an uninitialized (no CVSS)
- [CVE-2020-1911](https://cve.now/CVE-2020-1911.md): A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes pr (no CVSS, Facebook Hermes · hermes-engine)
- [CVE-2020-3547](https://cve.now/CVE-2020-3547.md): Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure Vulnerability (CVSS 4.3, Cisco Web Security Appliance)
- [CVE-2020-3365](https://cve.now/CVE-2020-3365.md): Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability (CVSS 4.3, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2020-3430](https://cve.now/CVE-2020-3430.md): Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability (CVSS 8.8, Cisco Jabber)
- [CVE-2020-3451](https://cve.now/CVE-2020-3451.md): Cisco Small Business RV340 Series Routers Command Injection and Remote Code Execution Vulnerabilities (CVSS 4.7, Cisco Small Business RV Series Router Firmware)
- [CVE-2020-3453](https://cve.now/CVE-2020-3453.md): Cisco Small Business RV340 Series Routers Command Injection and Remote Code Execution Vulnerabilities (CVSS 4.7, Cisco Small Business RV Series Router Firmware)
- [CVE-2020-3473](https://cve.now/CVE-2020-3473.md): Cisco IOS XR Software Authenticated User Privilege Escalation Vulnerability (CVSS 7.8, Cisco IOS XR Software)
- [CVE-2020-3478](https://cve.now/CVE-2020-3478.md): Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability (CVSS 8.1, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2020-3495](https://cve.now/CVE-2020-3495.md): Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability (CVSS 9.9, Cisco Jabber)
- [CVE-2020-3498](https://cve.now/CVE-2020-3498.md): Cisco Jabber for Windows Information Disclosure Vulnerability (CVSS 6.5, Cisco Jabber)
- [CVE-2020-3530](https://cve.now/CVE-2020-3530.md): Cisco IOS XR Authenticated User Privilege Escalation Vulnerability (CVSS 8.4, Cisco IOS XR Software)
- [CVE-2020-3537](https://cve.now/CVE-2020-3537.md): Cisco Jabber for Windows Universal Naming Convention Link Handling Vulnerability (CVSS 5.7, Cisco Jabber)
- [CVE-2020-3541](https://cve.now/CVE-2020-3541.md): Cisco Webex Meetings Client for Windows, Webex Meetings Desktop App, and Webex Teams Information Disclosure Vulnerability (CVSS 4.4, Cisco Webex Meetings)
- [CVE-2020-3542](https://cve.now/CVE-2020-3542.md): Cisco Webex Training Unauthorized Meeting Join Vulnerability (CVSS 5.3, Cisco Webex Meetings)
- [CVE-2020-3545](https://cve.now/CVE-2020-3545.md): Cisco FXOS Software Buffer Overflow Vulnerability (CVSS 6.0, Cisco Firepower Extensible Operating System)
- [CVE-2020-3546](https://cve.now/CVE-2020-3546.md): Cisco Email Security Appliance Information Disclosure Vulnerability (CVSS 5.3, Cisco Email Security Appliance)
- [CVE-2020-24940](https://cve.now/CVE-2020-24940.md): An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. (no CVSS, illuminate/database)
- [CVE-2020-24941](https://cve.now/CVE-2020-24941.md): An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. (no CVSS, laravel/framework)
- [CVE-2019-3881](https://cve.now/CVE-2019-3881.md): Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations unde (no CVSS, rubygem-bundler · bundler)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.