Security Vulnerabilities - CVEs Published In 2020
Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to create or overwrite arbitrary files and run arbitrary commands via unspecified vectors.
CVSS Score
9.8
EPSS Score
0.021
Published
2020-08-05
An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
CVSS Score
6.7
EPSS Score
0.006
Published
2020-08-05
Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
CVSS Score
6.1
EPSS Score
0.009
Published
2020-08-05
**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
CVSS Score
9.8
EPSS Score
0.335
Published
2020-08-05
An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.
CVSS Score
6.7
EPSS Score
0.005
Published
2020-08-05
A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable.
CVSS Score
5.5
EPSS Score
0.004
Published
2020-08-05
The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.
CVSS Score
4.3
EPSS Score
0.004
Published
2020-08-05
The PgHero gem through 2.6.0 for Ruby allows CSRF.
CVSS Score
8.1
EPSS Score
0.005
Published
2020-08-05
scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.
CVSS Score
9.8
EPSS Score
0.023
Published
2020-08-05
IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information using man in the middle techniques due to not properly invalidating session tokens. IBM X-Force ID: 175420.
CVSS Score
3.7
EPSS Score
0.009
Published
2020-08-05