Skip to content
OpenAdvisories

Archive

August 2020

Vulnerabilities first published in this month (UTC), newest first.

← July 2020 2020 / August September 2020 →
  1. 1 
  2. 2 
  3. 332
  4. 427
  5. 530
  6. 629
  7. 731
  8. 815
  9. 93
  10. 1048
  11. 1163
  12. 1262
  13. 13112
  14. 1430
  15. 15 
  16. 162
  17. 17169
  18. 1817
  19. 1957
  20. 2016
  21. 2170
  22. 22 
  23. 231
  24. 2441
  25. 2553
  26. 26105
  27. 2754
  28. 2817
  29. 298
  30. 307
  31. 3174
All Critical High Medium Low Exploited only Public exploit

1,173 results · Feed

  • Medium 5.5
    CVE-2020-15704

    pppd arbitrary file read information disclosure vulnerability

    The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBE_OPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu…

    Canonical ppp ppp Ubuntu
  • High 7.5
    CVE-2014-8882

    Regular Expression Denial of Service in validator

    Versions of `validator` prior to 3.22.1 are affected by a regular expression denial of service vulnerability in the `isURL` method. ## Recommendation Update to version 3.22.1 or later.

    validator npm
  • Critical —
    CVE-2015-4130

    Command Injection in ungit

    Versions of `ungit` prior to 0.9.0 are affected by a command injection vulnerability in the `url` parameter. ## Recommendation Update version 0.9.0 or later.

    ungit npm
  • Medium 5.3
    CVE-2014-8883

    Directory Traversal in nhouston

    All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory. ## Recommendation It is recommended that a different module be used, as we…

    nhouston npm
  • Medium 6.5
    GHSA-6qqj-rx4w-r3cj

    CSRF Vulnerability in jquery-ujs

    Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains. When an attacker controls the href attribute of an ancho…

    jquery-ujs npm
  • High 8.2
    CVE-2013-3364

    Unauthenticated Remote Command Injection in ep_imageconvert

    ep_imageconvert is a plugin for [Etherpad Lite](https://github.com/ether/etherpad-lite). ep_imageconvert <= 0.0.2 is vulnerable to remote command injection. Authentication is not required for remote exploitation. ## Recommendation Update to version 0.0.3 or g…

    ep_imageconvert npm
  • Unscored —
    CVE-2020-25057

    An issue was discovered on LG mobile devices with Android OS 10 software. MDMService does not properly restrict APK ins…

  • Unscored —
    CVE-2020-25059

    An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A service crash may occ…

  • Unscored —
    CVE-2020-25060

    An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Local users can gain pr…

  • Unscored —
    CVE-2020-25061

    An issue was discovered on LG mobile devices with Android OS 9 and 10 software on the VZW network. lge_property allows …

  • Unscored —
    CVE-2020-25062

    An issue was discovered on LG mobile devices with Android OS 9 and 10 software. LGTelephonyProvider allows a bypass of …

  • Unscored —
    CVE-2020-25063

    An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. An application crash ca…

  • Unscored —
    CVE-2020-25064

    An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 softwa…

  • Unscored —
    CVE-2020-25065

    An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 softwa…

  • Unscored —
    CVE-2020-25058

    An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. The network_management servi…

  • Unscored —
    CVE-2020-25046

    An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The USB driver leaks addre…

  • Unscored —
    CVE-2020-25047

    An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (released in China and India) software. The S…

  • Unscored —
    CVE-2020-25048

    An issue was discovered on Samsung mobile devices with Q(10.0) (with ONEUI 2.1) software. In the Lockscreen state, the …

  • Unscored —
    CVE-2020-25049

    An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. StatusBarService has insufficient D…

  • Unscored —
    CVE-2020-25050

    An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The CMC service allows attackers to…

  • Unscored —
    CVE-2020-25051

    An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Attackers can bypass Factory Reset …

  • Unscored —
    CVE-2020-25052

    An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. H-Arx allows attackers t…

  • Unscored —
    CVE-2020-25054

    An issue was discovered on Samsung mobile devices with software through 2020-04-02 (Exynos modem chipsets). There is a …

  • Unscored —
    CVE-2020-25055

    An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The persona service allows…

  • Unscored —
    CVE-2020-25056

    An issue was discovered on Samsung mobile devices with Q(10.0) (Galaxy S20) software. Because HAL improperly checks ver…

  • Unscored —
    CVE-2020-25053

    An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. RKP allows arbitrary cod…

  • Unscored —
    CVE-2020-24354

    Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by shel…

  • Unscored —
    CVE-2020-14364 Public exploit

    An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue …

    qemu qemu xen qemu Virtualization Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-2075

    Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulksc…

  • Unscored —
    CVE-2020-7527

    Incorrect Default Permission vulnerability exists in SoMove (V2.8.1) and prior which could cause elevation of privilege…

  • Unscored —
    CVE-2020-7526

    Improper Input Validation vulnerability exists in PowerChute Business Edition (software V9.0.x and earlier) which could…

  • Unscored —
    CVE-2020-7525

    Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk an…

  • Unscored —
    CVE-2020-7524

    Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (V5.0.0.7 and prior) which could cause Denial…

  • Unscored —
    CVE-2020-7523

    Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notificatio…

  • Unscored —
    CVE-2020-7522

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC …

  • Unscored —
    CVE-2020-7521

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC …

  • Unscored —
    CVE-2020-20628

    controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS.

  • Unscored —
    CVE-2020-20627

    The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unaut…

  • Unscored —
    CVE-2020-20626

    lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.

  • Unscored —
    CVE-2020-20625

    Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated …

    Web / CMS