Skip to content
OpenAdvisories

Archive

2 September 2020

Vulnerabilities first published on this day (UTC), newest first.

← August 2020 2020 / September /2 October 2020 →
  1. 1192
  2. 2134
  3. 3364
  4. 4123
  5. 51
  6. 6 
  7. 7 
  8. 852
  9. 9124
  10. 1043
  11. 11223
  12. 12 
  13. 136
  14. 1460
  15. 1553
  16. 1682
  17. 17138
  18. 18105
  19. 1912
  20. 20 
  21. 2158
  22. 2234
  23. 2376
  24. 2499
  25. 25112
  26. 26 
  27. 2711
  28. 2810
  29. 2939
  30. 3054
All Critical High Medium Low Exploited only Public exploit

134 results · Feed

  • High —
    GHSA-44vf-8ffm-v2qh

    Sensitive Data Exposure in rails-session-decoder

    All versions of `rails-session-decoder` are missing verification of the Message Authentication Code appended to the cookies. This may lead to decryption of cipher text thus exposing encrypted information. ## Recommendation No fix is currently available. Consi…

    rails-session-decoder npm
  • High —
    GHSA-w32g-5hqp-gg6q

    Cross-Site Scripting in mermaid

    Versions of `mermaid` prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input such as `A["<img src=invalid onerror=alert('XSS')></img>"] ` is provided to the application, it will execute the code instead of rendering it as text due to improp…

    mermaid npm
  • High 7.5
    CVE-2020-25078 Exploited Public exploit Scanner template EPSS 98%

    An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticat…

    KEV Aug 5, 2025
  • High 8.8
    CVE-2020-25079 Exploited EPSS 54%

    An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.…

    KEV Aug 5, 2025
  • Critical —
    GHSA-4qqc-mp5f-ccv4

    Command Injection in bestzip

    Versions of `bestzip` prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `zip` function . This may allow attackers to execute arbitrary code in the system as long as th…

    bestzip npm
  • Unscored —
    CVE-2020-24601

    In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary maliciou…

  • Unscored —
    CVE-2020-24604

    A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows re…

  • Unscored —
    CVE-2020-24602

    Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute a…

  • Unscored —
    CVE-2020-17458

    A post-authenticated stored XSS was found in MultiUx v.3.1.12.0 via the /multiux/SaveMailbox LastName field.

  • Unscored —
    CVE-2020-16602 Public exploit

    Razer Chroma SDK Rest Server through 3.12.17 allows remote attackers to execute arbitrary programs because there is a r…

  • Unscored —
    CVE-2020-24355

    Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by inse…

  • Unscored —
    CVE-2020-5622

    Shadankun Server Security Type (excluding normal blocking method types) Ver.1.5.3 and earlier allows remote attackers t…

    Cyber Security Cloud Shadankun Server Security Type (excluding normal blocking method types)
  • Unscored —
    CVE-2020-25073

    FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Ap…

    plinth Ubuntu
  • Unscored —
    CVE-2020-16150

    A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.2…

    mbedtls mbedtls mbedtls3 mbedtls Debian Ubuntu Alpine