# CVEs published 2020-09-09

121 CVEs were published on September 9, 2020: 5 critical, 9 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-15173](https://cve.now/CVE-2020-15173.md): Heap buffer overflow in ACCEL-PPP (CVSS 8.2, accel-ppp)
- [CVE-2020-25219](https://cve.now/CVE-2020-25219.md): url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response compo (no CVSS)
- [CVE-2020-15903](https://cve.now/CVE-2020-15903.md): An issue was found in Nagios XI before 5.7.3. (no CVSS)
- [CVE-2020-1913](https://cve.now/CVE-2020-1913.md): An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows (no CVSS, Facebook Hermes · hermes-engine)
- [CVE-2018-17774](https://cve.now/CVE-2018-17774.md): Ingenico Telium 2 POS terminals have an insecure NTPT3 protocol. (no CVSS)
- [CVE-2018-17773](https://cve.now/CVE-2018-17773.md): Ingenico Telium 2 POS terminals have a buffer overflow via SOCKET\_TASK in the NTPT3 protocol. (no CVSS)
- [CVE-2018-17772](https://cve.now/CVE-2018-17772.md): Ingenico Telium 2 POS terminals allow arbitrary code execution via the TRACE protocol. (no CVSS)
- [CVE-2018-17771](https://cve.now/CVE-2018-17771.md): Ingenico Telium 2 POS terminals have hardcoded FTP credentials. (no CVSS)
- [CVE-2018-17770](https://cve.now/CVE-2018-17770.md): Ingenico Telium 2 POS terminals have a buffer overflow via the RemotePutFile command of the NTPT3 protocol. (no CVSS)
- [CVE-2018-17769](https://cve.now/CVE-2018-17769.md): Ingenico Telium 2 POS terminals have a buffer overflow via the 0x26 command of the NTPT3 protocol. (no CVSS)
- [CVE-2018-17768](https://cve.now/CVE-2018-17768.md): Ingenico Telium 2 POS terminals have an insecure TRACE protocol. (no CVSS)
- [CVE-2018-17767](https://cve.now/CVE-2018-17767.md): Ingenico Telium 2 POS terminals have hardcoded PPP credentials. (no CVSS)
- [CVE-2018-17766](https://cve.now/CVE-2018-17766.md): Ingenico Telium 2 POS Telium2 OS allow bypass of file-reading restrictions via the NTPT3 protocol. (no CVSS)
- [CVE-2018-17765](https://cve.now/CVE-2018-17765.md): Ingenico Telium 2 POS terminals have undeclared TRACE protocol commands. (no CVSS)
- [CVE-2020-1912](https://cve.now/CVE-2020-1912.md): An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835 (no CVSS, Facebook Hermes · hermes-engine)
- [CVE-2020-15791](https://cve.now/CVE-2020-15791.md): A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. (CVSS 6.5, Siemens SIMATIC S7-300 CPU family · Siemens SIMATIC S7-4… +2)
- [CVE-2020-15790](https://cve.now/CVE-2020-15790.md): A vulnerability has been identified in Spectrum Power 4 (All versions \< V4.70 SP8). (no CVSS, Siemens AG Spectrum Power)
- [CVE-2020-15789](https://cve.now/CVE-2020-15789.md): A vulnerability has been identified in Polarion Subversion Webclient (All versions). (no CVSS, Siemens AG Polarion Subversion Webclient)
- [CVE-2020-15788](https://cve.now/CVE-2020-15788.md): A vulnerability has been identified in Polarion Subversion Webclient (All versions). (no CVSS, Siemens AG Polarion Subversion Webclient)
- [CVE-2020-15787](https://cve.now/CVE-2020-15787.md): A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions \<= V16). (no CVSS, Siemens SIMATIC HMI Unified Comfort Panels)
- [CVE-2020-15786](https://cve.now/CVE-2020-15786.md): A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. (CVSS 9.8, Siemens SIMATIC HMI Basic Panels 2nd Generation · Siemen… +2)
- [CVE-2020-15785](https://cve.now/CVE-2020-15785.md): A vulnerability has been identified in Siveillance Video Client (All versions). (no CVSS, Siemens AG Siveillance Video Client)
- [CVE-2020-15784](https://cve.now/CVE-2020-15784.md): A vulnerability has been identified in Spectrum Power 4 (All versions \< V4.70 SP8). (no CVSS, Siemens AG Spectrum Power)
- [CVE-2020-10056](https://cve.now/CVE-2020-10056.md): A vulnerability has been identified in License Management Utility (LMU) (All versions \< V2.4). (no CVSS, Siemens AG License Management Utility)
- [CVE-2020-24916](https://cve.now/CVE-2020-24916.md): CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection. (no CVSS)
- [CVE-2020-24379](https://cve.now/CVE-2020-24379.md): WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. (no CVSS)
- [CVE-2020-10051](https://cve.now/CVE-2020-10051.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \< V2.10.2). (no CVSS, Siemens AG SIMATIC RTLS Locating Manager)
- [CVE-2020-10050](https://cve.now/CVE-2020-10050.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \< V2.10.2). (no CVSS, Siemens AG SIMATIC RTLS Locating Manager)
- [CVE-2020-10049](https://cve.now/CVE-2020-10049.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \< V2.10.2). (no CVSS, Siemens AG SIMATIC RTLS Locating Manager)
- [CVE-2020-7068](https://cve.now/CVE-2020-7068.md): Use of freed hash key in the phar\_parse\_zipfile function (CVSS 4.8, PHP Group PHP)
- [CVE-2020-15163](https://cve.now/CVE-2020-15163.md): Invalid root may become trusted root in The Update Framework (TUF) (CVSS 8.7, theupdateframework tuf · tuf)
- [CVE-2020-13127](https://cve.now/CVE-2020-13127.md): A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.04.1 allows remote authenticated attackers to execute arbitrary S (no CVSS)
- [CVE-2020-2044](https://cve.now/CVE-2020-2044.md): PAN-OS: Passwords may be logged in clear text while storing operational command (op command) history (CVSS 3.3, Palo Alto Networks PAN-OS)
- [CVE-2020-2043](https://cve.now/CVE-2020-2043.md): PAN-OS: Passwords may be logged in clear text when using after-change-detail custom syslog field for config logs (CVSS 3.3, Palo Alto Networks PAN-OS)
- [CVE-2020-2042](https://cve.now/CVE-2020-2042.md): PAN-OS: Buffer overflow in the management web interface (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2020-2041](https://cve.now/CVE-2020-2041.md): PAN-OS: Management web interface denial-of-service (DoS) (CVSS 7.5, Palo Alto Networks PAN-OS)
- [CVE-2020-2040](https://cve.now/CVE-2020-2040.md): PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled (CVSS 9.8, Palo Alto Networks PAN-OS)
- [CVE-2020-2039](https://cve.now/CVE-2020-2039.md): PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload (CVSS 5.3, Palo Alto Networks PAN-OS)
- [CVE-2020-2038](https://cve.now/CVE-2020-2038.md): PAN-OS: OS command injection vulnerability in the management web interface (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2020-2037](https://cve.now/CVE-2020-2037.md): PAN-OS: OS command injection vulnerability in the management web interface (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2020-2036](https://cve.now/CVE-2020-2036.md): PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface (CVSS 8.8, Palo Alto Networks PAN-OS)
- [CVE-2020-14292](https://cve.now/CVE-2020-14292.md): In the COVIDSafe application through 1.0.21 for Android, unsafe use of the Bluetooth transport option in the GATT connection allows attacker (no CVSS)
- [CVE-2020-25212](https://cve.now/CVE-2020-25212.md): A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly hav (no CVSS)
- [CVE-2020-25211](https://cve.now/CVE-2020-25211.md): In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing cra (no CVSS)
- [CVE-2020-24566](https://cve.now/CVE-2020-24566.md): In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process us (no CVSS)
- [CVE-2020-11986](https://cve.now/CVE-2020-11986.md): To be able to analyze gradle projects, the build scripts need to be executed. (no CVSS, Apache NetBeans)
- [CVE-2020-24794](https://cve.now/CVE-2020-24794.md): Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75. (no CVSS)
- [CVE-2020-1749](https://cve.now/CVE-2020-1749.md): A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. (CVSS 7.5, Linux Kernel kernel)
- [CVE-2020-24195](https://cve.now/CVE-2020-24195.md): An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to condu (no CVSS)
- [CVE-2020-24199](https://cve.now/CVE-2020-24199.md): Arbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental Management System v1.0 allows attackers to conduct (no CVSS)
- [CVE-2020-24198](https://cve.now/CVE-2020-24198.md): A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2020-24074](https://cve.now/CVE-2020-24074.md): The decode program in silk-v3-decoder Version:20160922 Build By kn007 does not strictly check data, resulting in a buffer overflow. (no CVSS)
- [CVE-2020-24197](https://cve.now/CVE-2020-24197.md): A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL command (no CVSS)
- [CVE-2020-24194](https://cve.now/CVE-2020-24194.md): A Cross-site scripting (XSS) vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inje (no CVSS)
- [CVE-2020-1968](https://cve.now/CVE-2020-1968.md): Raccoon attack (CVSS 3.7, OpenSSL)
- [CVE-2020-14384](https://cve.now/CVE-2020-14384.md): A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. (no CVSS, JBossWeb)
- [CVE-2020-6311](https://cve.now/CVE-2020-6311.md): Banking services from SAP 9.0 (Bank Analyzer), version - 500, and SAP S/4HANA for financial products subledger, version � 100, does not corr (CVSS 6.5, SAP SE BANKING SERVICES FROM SAP · SAP SE S/4HANA FIN PROD…)
- [CVE-2020-6324](https://cve.now/CVE-2020-6324.md): SAP Netweaver AS ABAP(BSP Test Application sbspext\_table), version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticate (CVSS 6.1, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2020-6359](https://cve.now/CVE-2020-6359.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PLT file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6358](https://cve.now/CVE-2020-6358.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FBX file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6360](https://cve.now/CVE-2020-6360.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6355](https://cve.now/CVE-2020-6355.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TGA file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6361](https://cve.now/CVE-2020-6361.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE files received from untrusted sources which results in c (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6357](https://cve.now/CVE-2020-6357.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated U3D file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6353](https://cve.now/CVE-2020-6353.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6356](https://cve.now/CVE-2020-6356.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6354](https://cve.now/CVE-2020-6354.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6352](https://cve.now/CVE-2020-6352.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FBX file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6351](https://cve.now/CVE-2020-6351.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FBX file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6349](https://cve.now/CVE-2020-6349.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6347](https://cve.now/CVE-2020-6347.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HDR file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6350](https://cve.now/CVE-2020-6350.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6346](https://cve.now/CVE-2020-6346.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6348](https://cve.now/CVE-2020-6348.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6288](https://cve.now/CVE-2020-6288.md): SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload (CVSS 4.6, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6302](https://cve.now/CVE-2020-6302.md): SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. (CVSS 6.4, SAP SE SAP Commerce)
- [CVE-2020-6345](https://cve.now/CVE-2020-6345.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TGA file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6344](https://cve.now/CVE-2020-6344.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6329](https://cve.now/CVE-2020-6329.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6283](https://cve.now/CVE-2020-6283.md): SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the lau (CVSS 4.8, SAP SE SAP Fiori)
- [CVE-2020-6330](https://cve.now/CVE-2020-6330.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6327](https://cve.now/CVE-2020-6327.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6331](https://cve.now/CVE-2020-6331.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in c (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6328](https://cve.now/CVE-2020-6328.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6326](https://cve.now/CVE-2020-6326.md): SAP NetWeaver (Knowledge Management), version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, whe (CVSS 5.4, SAP SE SAP NetWeaver)
- [CVE-2020-6321](https://cve.now/CVE-2020-6321.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated U3D file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6322](https://cve.now/CVE-2020-6322.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6318](https://cve.now/CVE-2020-6318.md): A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server, up to release 7.40) and ABAP Platform (\> release 7.40).Becau (CVSS 9.1, SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform)
- [CVE-2020-6340](https://cve.now/CVE-2020-6340.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6320](https://cve.now/CVE-2020-6320.md): SAP Marketing (Servlet), version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted. (CVSS 9.6, SAP SE SAP Marketing)
- [CVE-2020-6343](https://cve.now/CVE-2020-6343.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated EPS file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6342](https://cve.now/CVE-2020-6342.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated U3D file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6339](https://cve.now/CVE-2020-6339.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6337](https://cve.now/CVE-2020-6337.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HDR file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6338](https://cve.now/CVE-2020-6338.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RH file received from untrusted sources which results in cra (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6313](https://cve.now/CVE-2020-6313.md): SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which (CVSS 5.4, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2020-6332](https://cve.now/CVE-2020-6332.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in c (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6314](https://cve.now/CVE-2020-6314.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in c (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6333](https://cve.now/CVE-2020-6333.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6336](https://cve.now/CVE-2020-6336.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6312](https://cve.now/CVE-2020-6312.md): SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), versions - 4.1, 4.2, allows an attacker with a non-adm (CVSS 5.4, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2020-6341](https://cve.now/CVE-2020-6341.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated EPS file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6334](https://cve.now/CVE-2020-6334.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-6335](https://cve.now/CVE-2020-6335.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in c (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-14342](https://cve.now/CVE-2020-14342.md): It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary co (CVSS 4.4, samba cifs-utils)
- [CVE-2020-7325](https://cve.now/CVE-2020-7325.md): Privilege Escalation vulnerability in MVISION Endpoint (CVSS 5.5, McAfee MVISION Endpoint)
- [CVE-2020-7324](https://cve.now/CVE-2020-7324.md): Improper Access Control vulnerability in MVISION Endpoint (CVSS 6.1, McAfee MVISION Endpoint)
- [CVE-2020-7323](https://cve.now/CVE-2020-7323.md): Authentication Protection Bypass vulnerability in ENS for Windows (CVSS 6.9, McAfee Endpoint Security for Windows)
- [CVE-2020-7322](https://cve.now/CVE-2020-7322.md): Exposure of Sensitive Information in ENS for Windows (CVSS 4.7, McAfee Endpoint Security for Windows)
- [CVE-2020-7319](https://cve.now/CVE-2020-7319.md): Improper Access Control Vulnerability in ENS for Windows (CVSS 8.8, McAfee Endpoint Security for Windows)
- [CVE-2020-7320](https://cve.now/CVE-2020-7320.md): Protection Mechanism Failure in ENS for Windows (CVSS 6.7, McAfee Endpoint Security for Windows)
- [CVE-2020-5627](https://cve.now/CVE-2020-5627.md): Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerabl (no CVSS, YODOBASHI CAMERA CO. Yodobashi App for Android)
- [CVE-2020-3674](https://cve.now/CVE-2020-3674.md): Information can leak into userspace due to improper transfer of data from kernel to userspace in Snapdragon Auto, Snapdragon Compute, Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3679](https://cve.now/CVE-2020-3679.md): u'During execution after Address Space Layout Randomization is turned on for QTEE, part of code is still mapped at known address including c (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3617](https://cve.now/CVE-2020-3617.md): u'Buffer over-read Issue in Q6 testbus framework due to diag packet length is not completely validated before accessing the field and leads (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2020-3634](https://cve.now/CVE-2020-3634.md): u'Multiple Read overflows issue due to improper length check while decoding Generic NAS transport/EMM info' in Snapdragon Auto, Snapdragon C (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3656](https://cve.now/CVE-2020-3656.md): Out of bound access can happen in MHI command process due to lack of check of command channel id value received from MHI devices in Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11129](https://cve.now/CVE-2020-11129.md): u'During the error occurrence in capture request, the buffer is freed and later accessed causing the camera APP to fail due to memory use-af (no CVSS, Qualcomm Snapdragon Consumer IOT, Snapdragon Mobile)
- [CVE-2020-11135](https://cve.now/CVE-2020-11135.md): u'Reachable assertion when wrong data size is returned by parser for ape clips' in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Indu (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2020-11124](https://cve.now/CVE-2020-11124.md): u'Possible use-after-free while accessing diag client map table since list can be reallocated due to exceeding max client limit.' in Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-25213](https://cve.now/CVE-2020-25213.md): The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because (CVSS 10.0, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-09-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.