Archive
31 August 2020
Vulnerabilities first published on this day (UTC), newest first.
74 results · Feed
-
High 8.8
TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDD…
KEV Sep 2, 2025 -
Unscored —
The flash memory readout protection in Gigadevice GD32F103 devices allows physical attackers to extract firmware via th…
-
Unscored —
Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious…
-
Unscored —
Apex Microelectronics APM32F103 devices allow physical attackers to execute arbitrary code via a power glitch and a spe…
-
Unscored —
Gigadevice GD32F103 and GD32F130 devices allow physical attackers to extract data via the probing of easily accessible …
-
Unscored —
The flash memory readout protection in Gigadevice GD32VF103 devices allows physical attackers to extract firmware via t…
-
Unscored —
The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
-
Unscored —
Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection …
-
Unscored —
Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vul…
-
Unscored —
The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attacke…
-
Unscored —
STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power …
-
Unscored —
The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execu…
-
Unscored —
The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attacke…
-
Unscored —
The flash memory readout protection in Apex Microelectronics APM32F103 devices allows physical attackers to extract fir…
-
Medium 5.4
Dolibarr stored Cross-Site Scripting (XSS) vulnerability
Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter;…
-
Medium 6.7
RabbitMQ arbitrary code execution using local binary planting
RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An attacker with write privileges to the RabbitMQ installation directory and local access on Windows could …
-
Unscored —
The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) retur…
-
Unscored —
The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does …
-
Unscored —
The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640…
-
Unscored —
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in th…
-
Unscored —
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.
-
Unscored —
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed v…
-
Unscored —
OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API.
-
Unscored —
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing…
-
Unscored —
THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes have their TELNET service hardcoded to start…
-
Unscored —
The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the …
-
Unscored —
An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is …
-
Unscored —CVE-2020-24786 EPSS 13%
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number…
-
Unscored —
In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access.
-
Medium 6.2
IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a den…
-
Unscored —
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve sto…
-
Unscored —
The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= r…
-
High 7.5
Flask-Cors Directory Traversal vulnerability
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
-
Unscored —
checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 exec…