CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2020

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
701 CVE-2020-8602 732 Exec Code Bypass 2020-08-27 2021-07-21
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability in the management consoles of Trend Micro Deep Security 10.0-12.0 and Trend Micro Vulnerability Protection 2.0 SP2 may allow an authenticated attacker with full control privileges to bypass file integrity checks, leading to remote code execution.
702 CVE-2020-8575 DoS 2020-08-03 2020-08-09
2.1
None Local Low Not required None None Partial
Active IQ Unified Manager for VMware vSphere and Windows versions prior to 9.5 are susceptible to a vulnerability which allows administrative users to cause Denial of Service (DoS).
703 CVE-2020-8574 Exec Code 2020-08-03 2020-08-12
4.6
None Local Low Not required Partial Partial Partial
Active IQ Unified Manager for Linux versions prior to 9.6 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service enabled allowing unauthorized code execution to local users.
704 CVE-2020-8244 125 2020-08-30 2022-05-24
6.4
None Remote Low Not required Partial None Partial
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
705 CVE-2020-8234 613 2020-08-21 2020-08-31
10.0
None Remote Low Not required Complete Complete Complete
A vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cookie for admin can be guessed, enabling the attacker to obtain high privileges and get a root shell by a Command injection.
706 CVE-2020-8233 78 Exec Code 2020-08-17 2022-05-24
9.0
None Remote Low ??? Complete Complete Complete
A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.
707 CVE-2020-8232 200 +Info 2020-08-17 2021-09-23
4.0
None Remote Low ??? Partial None None
An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.
708 CVE-2020-8230 787 Mem. Corr. 2020-08-17 2020-08-21
2.1
None Local Low Not required None None Partial
A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in for windows allowed to corrupt memory.
709 CVE-2020-8229 401 2020-08-10 2021-09-23
4.9
None Local Low Not required None None Complete
A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system.
710 CVE-2020-8227 22 Dir. Trav. 2020-08-21 2022-05-24
7.1
None Remote High ??? Complete Complete Complete
Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory.
711 CVE-2020-8226 918 2020-08-17 2020-08-21
5.0
None Remote Low Not required Partial None None
A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.
712 CVE-2020-8224 94 2020-08-10 2022-05-24
4.6
None Local Low Not required Partial Partial Partial
A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.
713 CVE-2020-8212 863 2020-08-17 2020-08-20
7.5
None Remote Low Not required Partial Partial Partial
Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows access to privileged functionality.
714 CVE-2020-8211 89 Sql 2020-08-17 2020-08-20
7.5
None Remote Low Not required Partial Partial Partial
Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows SQL Injection.
715 CVE-2020-8210 522 2020-08-17 2020-08-20
5.0
None Remote Low Not required Partial None None
Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 discloses credentials of a service account.
716 CVE-2020-8209 22 Dir. Trav. 2020-08-17 2020-08-20
5.0
None Remote Low Not required Partial None None
Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 and leads to the ability to read arbitrary files.
717 CVE-2020-8208 79 XSS 2020-08-17 2020-08-19
4.3
None Remote Medium Not required None Partial None
Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.11 before RP6 and Citrix XenMobile Server before 10.9 RP5 allows Cross-Site Scripting (XSS).
718 CVE-2020-8189 79 XSS 2020-08-21 2022-05-24
3.5
None Remote Medium ??? None Partial None
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.
719 CVE-2020-8108 287 2020-08-03 2020-08-04
4.6
None Local Low Not required Partial Partial Partial
Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially inject third-party code into a trusted process. This issue affects: Bitdefender Endpoint Security for Mac versions prior to 4.12.80.
720 CVE-2020-8097 287 2020-08-30 2020-09-04
4.6
None Local Low Not required Partial Partial Partial
An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings. This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261. This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261. Bitdefender Endpoint Security SDK versions prior to 6.6.18.261.
721 CVE-2020-8026 276 2020-08-07 2020-09-18
7.2
None Local Low Not required Complete Complete Complete
A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new user to escalate their privileges to root. This issue affects: openSUSE Leap 15.2 inn version 2.6.2-lp152.1.26 and prior versions. openSUSE Tumbleweed inn version 2.6.2-4.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.3.3.1 and prior versions.
722 CVE-2020-8025 279 2020-08-07 2020-08-12
4.6
None Local Low Not required Partial Partial Partial
A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.
723 CVE-2020-7923 755 DoS 2020-08-21 2020-12-01
4.0
None Remote Low ??? None None Partial
A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8; v4.0 versions prior to 4.0.19.
724 CVE-2020-7831 494 Dir. Trav. 2020-08-24 2020-09-02
6.8
None Remote Medium Not required Partial Partial Partial
A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. The attacker is able to use startup menu directory via directory traversal for automatic execution. The victim user need to reboot, however.
725 CVE-2020-7824 276 2020-08-25 2020-08-31
4.0
None Remote Low ??? Partial None None
A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission. The vulnerability is due to insecure permission when handling session cookies. An attacker could exploit this vulnerability by modification the cookie value to an affected device. A successful exploit could allow the attacker access to sensitive device information, which includes configuration files.
726 CVE-2020-7823 787 Exec Code Mem. Corr. 2020-08-04 2021-08-27
6.8
None Remote Medium Not required Partial Partial Partial
DaviewIndy has a Memory corruption vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
727 CVE-2020-7822 787 Exec Code Overflow 2020-08-04 2020-08-05
6.8
None Remote Medium Not required Partial Partial Partial
DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
728 CVE-2020-7817 494 2020-08-06 2020-08-11
4.6
None Local Low Not required Partial Partial Partial
MyBrowserPlus downloads the files needed to run the program through the setup file (Setup.inf). At this time, there is a vulnerability in downloading arbitrary files due to insufficient integrity verification of the files.
729 CVE-2020-7810 354 Exec Code 2020-08-07 2020-08-10
6.8
None Remote Medium Not required Partial Partial Partial
hslogin2.dll ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the activex method. This is due to a lack of integrity verification of the policy files referenced in the update process, and a remote attacker could induce a user to crafted web page, causing damage such as malicious code infection.
730 CVE-2020-7712 78 2020-08-30 2022-03-01
6.5
None Remote Low ??? Partial Partial Partial
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
731 CVE-2020-7711 476 2020-08-23 2020-08-27
5.0
None Remote Low Not required None None Partial
This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
732 CVE-2020-7710 269 2020-08-21 2021-07-21
7.5
None Remote Low Not required Partial Partial Partial
This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine.
733 CVE-2020-7708 20 2020-08-18 2021-07-21
7.5
None Remote Low Not required Partial Partial Partial
The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.
734 CVE-2020-7707 20 2020-08-18 2021-07-21
7.5
None Remote Low Not required Partial Partial Partial
The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.
735 CVE-2020-7706 20 2020-08-18 2021-07-21
7.5
None Remote Low Not required Partial Partial Partial
The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.
736 CVE-2020-7705 1021 2020-08-24 2020-09-02
5.8
None Remote Medium Not required Partial Partial None
This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads.
737 CVE-2020-7704 20 2020-08-17 2021-07-21
7.5
None Remote Low Not required Partial Partial Partial
The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.
738 CVE-2020-7703 400 2020-08-17 2021-07-21
7.5
None Remote Low Not required Partial Partial Partial
All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.
739 CVE-2020-7702 400 2020-08-17 2021-07-21
7.5
None Remote Low Not required Partial Partial Partial
All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.
740 CVE-2020-7701 400 2020-08-14 2021-07-21
7.5
None Remote Low Not required Partial Partial Partial
madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
741 CVE-2020-7700 400 2020-08-14 2021-07-21
7.5
None Remote Low Not required Partial Partial Partial
All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
742 CVE-2020-7583 863 +Priv 2020-08-14 2020-08-21
4.6
None Local Low Not required Partial Partial Partial
A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0.8). The application does not properly validate the users' privileges when executing some operations, which could allow a user with low permissions to arbitrary modify files that should be protected against writing.
743 CVE-2020-7527 276 2020-08-31 2020-09-04
4.6
None Local Low Not required Partial Partial Partial
Incorrect Default Permission vulnerability exists in SoMove (V2.8.1) and prior which could cause elevation of privilege and provide full access control to local system users to SoMove component and services when a SoMove installer script is launched.
744 CVE-2020-7526 20 Exec Code 2020-08-31 2020-09-04
6.5
None Remote Low ??? Partial Partial Partial
Improper Input Validation vulnerability exists in PowerChute Business Edition (software V9.0.x and earlier) which could cause remote code execution when a script is executed during a shutdown event.
745 CVE-2020-7525 307 2020-08-31 2020-09-04
5.0
None Remote Low Not required Partial None None
Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (formerly homeLYnk) which could allow an attacker to guess a password when brute force is used.
746 CVE-2020-7524 787 DoS 2020-08-31 2022-01-31
5.0
None Remote Low Not required None None Partial
Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (V5.0.0.7 and prior) which could cause Denial of Service when sending specific crafted IPV4 packet to the controller: Sending a specific IPv4 protocol package to Schneider Electric Modicon M218 Logic Controller can cause IPv4 devices to go down. The device does not work properly and must be powered back on to return to normal.
747 CVE-2020-7523 269 2020-08-31 2021-06-04
4.4
None Local Medium Not required Partial Partial Partial
Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification for versions) which could cause local privilege escalation when the Modbus Serial Driver service is invoked. The driver does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
748 CVE-2020-7522 22 Dir. Trav. 2020-08-31 2020-09-04
7.5
None Remote Low Not required Partial Partial Partial
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earlier) when accessing a vulnerable method of `SoundUploadServlet` which may lead to uploading executable files to non-specified directories.
749 CVE-2020-7521 22 Dir. Trav. 2020-08-31 2020-09-04
7.5
None Remote Low Not required Partial Partial Partial
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earlier) when accessing a vulnerable method of `FileUploadServlet` which may lead to uploading executable files to non-specified directories.
750 CVE-2020-7460 367 2020-08-06 2022-07-01
4.4
None Local Medium Not required Partial Partial Partial
In FreeBSD 12.1-STABLE before r363918, 12.1-RELEASE before p8, 11.4-STABLE before r363919, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, the sendmsg system call in the compat32 subsystem on 64-bit platforms has a time-of-check to time-of-use vulnerability allowing a mailcious userspace program to modify control message headers after they were validation.
Total number of vulnerabilities : 1155   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 (This Page)16 17 18 19 20 21 22 23 24
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.