Archive
August 2020
Vulnerabilities first published in this month (UTC), newest first.
1,173 results · Feed
-
High 8.8
TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDD…
KEV Sep 2, 2025 -
Unscored —
The flash memory readout protection in Gigadevice GD32F103 devices allows physical attackers to extract firmware via th…
-
Unscored —
Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious…
-
Unscored —
Apex Microelectronics APM32F103 devices allow physical attackers to execute arbitrary code via a power glitch and a spe…
-
Unscored —
Gigadevice GD32F103 and GD32F130 devices allow physical attackers to extract data via the probing of easily accessible …
-
Unscored —
The flash memory readout protection in Gigadevice GD32VF103 devices allows physical attackers to extract firmware via t…
-
Unscored —
The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
-
Unscored —
Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection …
-
Unscored —
Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vul…
-
Unscored —
The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attacke…
-
Unscored —
STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power …
-
Unscored —
The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execu…
-
Unscored —
The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attacke…
-
Unscored —
The flash memory readout protection in Apex Microelectronics APM32F103 devices allows physical attackers to extract fir…
-
Medium 5.4
Dolibarr stored Cross-Site Scripting (XSS) vulnerability
Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter;…
-
Medium 6.7
RabbitMQ arbitrary code execution using local binary planting
RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An attacker with write privileges to the RabbitMQ installation directory and local access on Windows could …
-
Unscored —
The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) retur…
-
Unscored —
The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does …
-
Unscored —
The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640…
-
Unscored —
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in th…
-
Unscored —
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.
-
Unscored —
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed v…
-
Unscored —
OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API.
-
Unscored —
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing…
-
Unscored —
THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes have their TELNET service hardcoded to start…
-
Unscored —
The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the …
-
Unscored —
An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is …
-
Unscored —CVE-2020-24786 EPSS 13%
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number…
-
Unscored —
In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access.
-
Medium 6.2
IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a den…
-
Unscored —
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve sto…
-
Unscored —
The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= r…
-
High 7.5
Flask-Cors Directory Traversal vulnerability
An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
-
Unscored —
checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 exec…
-
Unscored —
XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials wi…
-
High 8.1
Improper authentication vulnerability in Bitdefender Endpoint Security Tools and Endpoint Security SDK (VA-8646)
An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings. This issue affects: …
-
Unscored —
Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.
-
Unscored —
osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.ph…
-
Unscored —
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to…
-
Medium 6.5
Remote Memory Exposure in bl
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking …