Weekly Vulnerabilities Reports > July 20 to 26, 2020
Overview
198 new vulnerabilities reported during this period, including 16 critical vulnerabilities and 44 high severity vulnerabilities. This weekly summary report vulnerabilities in 527 products from 96 vendors including Google, Debian, Fedoraproject, Opensuse, and Adobe. Vulnerabilities are notably categorized as "Out-of-bounds Write", "Cross-site Scripting", "Path Traversal", "OS Command Injection", and "Improper Authentication".
- 161 reported vulnerabilities are remotely exploitables.
- 74 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
- 158 reported vulnerabilities are exploitable by an anonymous user.
- Google has the most reported vulnerabilities, with 30 reported vulnerabilities.
- Google has the most reported critical vulnerabilities, with 3 reported vulnerabilities.
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
EXPLOITABLE
EXPLOITABLE
AVAILABLE
ANONYMOUSLY
WEB APPLICATION
Vulnerability Details
The following table list reported vulnerabilities for the period covered by this report:
16 Critical Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2020-07-24 | CVE-2020-15922 | Midasolutions | OS Command Injection vulnerability in Midasolutions Eframework 2.8.0/2.8.9/2.9.0 There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. | 10.0 |
2020-07-23 | CVE-2020-15477 | Raspberrytorte | Injection vulnerability in Raspberrytorte Raspberrytortoise 20121028 The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. | 10.0 |
2020-07-23 | CVE-2020-15916 | Tenda | OS Command Injection vulnerability in Tenda Ac15 Firmware 15.03.05.19 goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in the lanIp POST parameter. | 10.0 |
2020-07-24 | CVE-2020-15860 | Parallels | Unspecified vulnerability in Parallels Remote Application Server 17.1.1 Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. | 9.9 |
2020-07-24 | CVE-2020-12812 | Fortinet | Improper Handling of Case Sensitivity vulnerability in Fortinet Fortios An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username. | 9.8 |
2020-07-24 | CVE-2020-15920 | Midasolutions | OS Command Injection vulnerability in Midasolutions Eframework 2.8.0/2.8.9/2.9.0 There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. | 9.8 |
2020-07-23 | CVE-2020-15917 | Claws Mail Fedoraproject Opensuse | common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled. | 9.8 |
2020-07-22 | CVE-2020-15893 | Dlink | OS Command Injection vulnerability in Dlink Dir-816L Firmware 2.06/2.06.B09 An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. | 9.8 |
2020-07-22 | CVE-2020-15892 | Dlink | Incorrect Resource Transfer Between Spheres vulnerability in Dlink Dap-1520 Firmware 1.0.8/1.10B04 An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. | 9.8 |
2020-07-21 | CVE-2016-7063 | Pritunl | Path Traversal vulnerability in Pritunl Pritunl-Client A flaw was found in pritunl-client before version 1.0.1116.6. | 9.8 |
2020-07-22 | CVE-2020-6522 | Google Debian Opensuse Fedoraproject | Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. | 9.6 |
2020-07-22 | CVE-2020-6509 | Use After Free vulnerability in Google Chrome Use after free in extensions in Google Chrome prior to 83.0.4103.116 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. | 9.6 | |
2020-07-22 | CVE-2020-6505 | Use After Free vulnerability in Google Chrome Use after free in speech in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. | 9.6 | |
2020-07-20 | CVE-2020-15121 | Radare Fedoraproject | OS Command Injection vulnerability in multiple products In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. | 9.6 |
2020-07-24 | CVE-2020-8174 | Nodejs Oracle Netapp | Integer Underflow (Wrap or Wraparound) vulnerability in multiple products napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0. | 9.3 |
2020-07-24 | CVE-2020-15932 | Overwolf | Link Following vulnerability in Overwolf Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges. | 9.0 |
44 High Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2020-07-23 | CVE-2020-15633 | D Link | Authentication Bypass Using an Alternate Path or Channel vulnerability in D-Link products This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. | 8.8 |
2020-07-23 | CVE-2020-15886 | Reportdata Project | SQL Injection vulnerability in Reportdata Project Reportdata A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute arbitrary SQL commands via the req parameter of the /module/reportdata/ip endpoint. | 8.8 |
2020-07-23 | CVE-2020-15688 | Embedthis | Authentication Bypass by Capture-replay vulnerability in Embedthis Goahead The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. | 8.8 |
2020-07-22 | CVE-2020-15901 | Nagios | Unspecified vulnerability in Nagios XI In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys. | 8.8 |
2020-07-22 | CVE-2020-6534 | Google Opensuse Debian Fedoraproject | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in WebRTC in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2020-07-22 | CVE-2020-6533 | Google Opensuse Debian Fedoraproject | Type Confusion vulnerability in multiple products Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2020-07-22 | CVE-2020-6530 | Google Opensuse Fedoraproject Debian | Out-of-bounds Write vulnerability in multiple products Out of bounds memory access in developer tools in Google Chrome prior to 84.0.4147.89 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. | 8.8 |
2020-07-22 | CVE-2020-6525 | Google Debian Opensuse Fedoraproject | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2020-07-22 | CVE-2020-6524 | Google Debian Opensuse Fedoraproject | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in WebAudio in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2020-07-22 | CVE-2020-6523 | Google Debian Opensuse Fedoraproject | Integer Overflow or Wraparound vulnerability in multiple products Out of bounds write in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2020-07-22 | CVE-2020-6520 | Google Debian Opensuse Fedoraproject | Out-of-bounds Write vulnerability in multiple products Buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2020-07-22 | CVE-2020-6518 | Google Debian Opensuse Fedoraproject | Use After Free vulnerability in multiple products Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had convinced the user to use developer tools to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2020-07-22 | CVE-2020-6517 | Google Debian Opensuse Fedoraproject | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in history in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2020-07-22 | CVE-2020-6515 | Google Debian Opensuse Fedoraproject | Use After Free vulnerability in multiple products Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2020-07-22 | CVE-2020-6513 | Google Opensuse Fedoraproject Debian | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | 8.8 |
2020-07-22 | CVE-2020-6512 | Google Debian Opensuse Fedoraproject | Type Confusion vulnerability in multiple products Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2020-07-21 | CVE-2020-15888 | LUA | Use After Free vulnerability in LUA 5.4.0 Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free. | 8.8 |
2020-07-24 | CVE-2020-15778 | Openbsd Netapp Broadcom | OS Command Injection vulnerability in multiple products scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. | 7.8 |
2020-07-24 | CVE-2020-15923 | Midasolutions | Path Traversal vulnerability in Midasolutions Eframework 2.8.0/2.8.9/2.9.0 Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal. | 7.8 |
2020-07-22 | CVE-2020-15904 | Pypi | Out-of-bounds Write vulnerability in Pypi Bsdiff4 A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file. | 7.8 |
2020-07-22 | CVE-2020-6510 | Google Debian Opensuse Fedoraproject | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in background fetch in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 7.8 |
2020-07-20 | CVE-2020-15852 | Linux XEN Netapp | Incorrect Default Permissions vulnerability in multiple products An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. | 7.8 |
2020-07-25 | CVE-2020-10604 | Osisoft | Improper Handling of Exceptional Conditions vulnerability in Osisoft PI Data Archive 2018 In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requests. | 7.5 |
2020-07-24 | CVE-2020-15921 | Midasolutions | Improper Authentication vulnerability in Midasolutions Eframework 2.8.0/2.8.9/2.9.0 Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution. | 7.5 |
2020-07-23 | CVE-2020-11624 | Avertx | Weak Password Requirements vulnerability in Avertx Hd438 Firmware and Hd838 Firmware An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. | 7.5 |
2020-07-23 | CVE-2020-15492 | Inneo | Path Traversal vulnerability in Inneo Startup Tools 12.0.66.3784/13.0.70.3804 An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. | 7.5 |
2020-07-23 | CVE-2020-15391 | Devspace | Improper Authentication vulnerability in Devspace 4.13.0 The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. | 7.5 |
2020-07-23 | CVE-2020-10921 | Automationdirect | Missing Authentication for Critical Function vulnerability in Automationdirect C-More HMI EA9 Firmware 6.52 This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. | 7.5 |
2020-07-23 | CVE-2020-10920 | Automationdirect | Missing Authentication for Critical Function vulnerability in Automationdirect C-More HMI EA9 Firmware 6.52 This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. | 7.5 |
2020-07-22 | CVE-2020-10917 | NEC | Deserialization of Untrusted Data vulnerability in NEC Esmpro Manager 6.42 This vulnerability allows remote attackers to execute arbitrary code on affected installations of NEC ESMPRO Manager 6.42. | 7.5 |
2020-07-22 | CVE-2020-4385 | IBM | Use of Hard-coded Credentials vulnerability in IBM Verify Gateway 1.0.0/1.0.1 IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. | 7.5 |
2020-07-22 | CVE-2020-9664 | Magento | Code Injection vulnerability in Magento Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. | 7.5 |
2020-07-22 | CVE-2020-3452 | Cisco | Path Traversal vulnerability in Cisco Adaptive Security Appliance Software A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. | 7.5 |
2020-07-22 | CVE-2020-15894 | Dlink | Missing Authentication for Critical Function vulnerability in Dlink Dir-816L Firmware 2.06/2.06.B09 An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. | 7.5 |
2020-07-22 | CVE-2019-16244 | Openmicroscopy | Incorrect Authorization vulnerability in Openmicroscopy Omero.Server 5.0.0/5.6.0 OMERO.server before 5.6.1 allows attackers to bypass the security filters and access hidden objects via a crafted query. | 7.5 |
2020-07-21 | CVE-2020-15890 | Luajit Debian Canonical | Out-of-bounds Read vulnerability in multiple products LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is mishandled. | 7.5 |
2020-07-21 | CVE-2020-15889 | LUA | Out-of-bounds Read vulnerability in LUA 5.4.0 Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members. | 7.5 |
2020-07-21 | CVE-2016-7064 | Pritunl | Improper Verification of Cryptographic Signature vulnerability in Pritunl Pritunl-Client A flaw was found in pritunl-client before version 1.0.1116.6. | 7.5 |
2020-07-21 | CVE-2020-15866 | Mruby Debian | Out-of-bounds Write vulnerability in multiple products mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb_yield_with_class function in vm.c because of incorrect VM stack handling. | 7.5 |
2020-07-20 | CVE-2020-6871 | ZTE | Improper Authentication vulnerability in ZTE products The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute some commands for high-level users. | 7.5 |
2020-07-20 | CVE-2020-3481 | Clamav Debian Canonical Fedoraproject | NULL Pointer Dereference vulnerability in multiple products A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. | 7.5 |
2020-07-20 | CVE-2020-14485 | Openclinic GA Project | Improper Authentication vulnerability in Openclinic GA Project Openclinic GA 5.09.02/5.89.05B OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries. | 7.5 |
2020-07-24 | CVE-2020-10610 | Osisoft | Untrusted Search Path vulnerability in Osisoft products In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification. | 7.2 |
2020-07-23 | CVE-2020-11623 | Avertx | Unspecified vulnerability in Avertx Hd438 Firmware and Hd838 Firmware An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. | 7.2 |
122 Medium Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2020-07-24 | CVE-2020-8326 | Lenovo | Unquoted Search Path or Element vulnerability in Lenovo Drivers Management An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code with elevated privileges. | 6.9 |
2020-07-24 | CVE-2020-8317 | Lenovo | Untrusted Search Path vulnerability in Lenovo Drivers Management A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code with elevated privileges. | 6.9 |
2020-07-21 | CVE-2020-15724 | 360Totalsecurity | Untrusted Search Path vulnerability in 360Totalsecurity 360 Total Security In the version 12.1.0.1005 and below of 360 Total Security, when the Gamefolde calls GameChrome.exe, there exists a local privilege escalation vulnerability. | 6.9 |
2020-07-21 | CVE-2020-15723 | 360Totalsecurity | Untrusted Search Path vulnerability in 360Totalsecurity 360 Total Security 12.1.0.1004/3.5.0.1033/9.0.0.1202 In the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total Security calls GameChrome.exe, there exists a local privilege escalation vulnerability. | 6.9 |
2020-07-21 | CVE-2020-15722 | 360Totalsecurity | Untrusted Search Path vulnerability in 360Totalsecurity 360 Total Security 12.1.0.1004/3.5.0.1033/9.0.0.1202 In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privilege escalation vulnerability. | 6.9 |
2020-07-22 | CVE-2020-9687 | Adobe | Out-of-bounds Write vulnerability in Adobe Photoshop and Photoshop CC Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. | 6.8 |
2020-07-22 | CVE-2020-9685 | Adobe | Out-of-bounds Write vulnerability in Adobe Photoshop and Photoshop CC Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. | 6.8 |
2020-07-22 | CVE-2020-9684 | Adobe | Out-of-bounds Write vulnerability in Adobe Photoshop and Photoshop CC Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. | 6.8 |
2020-07-22 | CVE-2020-9683 | Adobe | Out-of-bounds Write vulnerability in Adobe Photoshop and Photoshop CC Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. | 6.8 |
2020-07-22 | CVE-2020-9680 | Adobe | Out-of-bounds Write vulnerability in Adobe Prelude 9.0 Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. | 6.8 |
2020-07-22 | CVE-2020-9678 | Adobe | Out-of-bounds Write vulnerability in Adobe Prelude 9.0 Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. | 6.8 |
2020-07-22 | CVE-2020-9677 | Adobe | Out-of-bounds Write vulnerability in Adobe Prelude 9.0 Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability. | 6.8 |
2020-07-22 | CVE-2020-9676 | Adobe | Out-of-bounds Write vulnerability in Adobe Bridge Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. | 6.8 |
2020-07-22 | CVE-2020-9675 | Adobe | Out-of-bounds Read vulnerability in Adobe Bridge Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds read vulnerability. | 6.8 |
2020-07-22 | CVE-2020-9674 | Adobe | Out-of-bounds Write vulnerability in Adobe Bridge Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. | 6.8 |
2020-07-22 | CVE-2020-6507 | Out-of-bounds Write vulnerability in Google Chrome Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 6.8 | |
2020-07-22 | CVE-2020-8559 | Kubernetes | Open Redirect vulnerability in Kubernetes The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise. | 6.8 |
2020-07-20 | CVE-2020-15123 | Codecov | OS Command Injection vulnerability in Codecov In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. | 6.8 |
2020-07-20 | CVE-2020-8215 | Automattic | Classic Buffer Overflow vulnerability in Automattic Canvas A buffer overflow is present in canvas version <= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it processes a user-provided image. | 6.8 |
2020-07-20 | CVE-2020-12029 | Rockwellautomation | Improper Input Validation vulnerability in Rockwellautomation Factorytalk View All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. | 6.8 |
2020-07-20 | CVE-2020-15842 | Liferay | Deserialization of Untrusted Data vulnerability in Liferay DXP 7.0 Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization. | 6.8 |
2020-07-24 | CVE-2020-14307 | Redhat | Improper Resource Shutdown or Release vulnerability in Redhat products A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. | 6.5 |
2020-07-24 | CVE-2020-14297 | Redhat | Resource Exhaustion vulnerability in Redhat products A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. | 6.5 |
2020-07-23 | CVE-2020-15912 | Tesla | Unspecified vulnerability in Tesla Model 3 Firmware Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. | 6.5 |
2020-07-23 | CVE-2020-15887 | Softwareupdate Project | SQL Injection vulnerability in Softwareupdate Project Softwareupdate A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint. | 6.5 |
2020-07-23 | CVE-2020-15884 | Munkireport Project | SQL Injection vulnerability in Munkireport Project Munkireport A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order[0][dir] field on POST requests to /datatables/data. | 6.5 |
2020-07-22 | CVE-2020-6526 | Google Debian Opensuse Fedoraproject | Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. | 6.5 |
2020-07-22 | CVE-2020-6521 | Google Debian Opensuse Fedoraproject | Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. | 6.5 |
2020-07-22 | CVE-2020-6519 | Google Debian Opensuse Fedoraproject | Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page. | 6.5 |
2020-07-22 | CVE-2020-6514 | Google Opensuse Fedoraproject Debian Canonical Apple | Information Exposure vulnerability in multiple products Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream. | 6.5 |
2020-07-22 | CVE-2020-6511 | Google Debian Opensuse Fedoraproject | Information Exposure Through an Error Message vulnerability in multiple products Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | 6.5 |
2020-07-22 | CVE-2020-6506 | Unspecified vulnerability in Google Chrome Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isolation via a crafted HTML page. | 6.5 | |
2020-07-21 | CVE-2020-15877 | Librenms | Exposure of Resource to Wrong Sphere vulnerability in Librenms An issue was discovered in LibreNMS before 1.65.1. | 6.5 |
2020-07-20 | CVE-2020-6103 | AMD | Out-of-bounds Write vulnerability in AMD Radeon Directx 11 Driver Atidxx64.Dll 26.20.15019.19000 An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. | 6.5 |
2020-07-20 | CVE-2020-6102 | AMD | Out-of-bounds Write vulnerability in AMD Radeon Directx 11 Driver Atidxx64.Dll 26.20.15019.19000 An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. | 6.5 |
2020-07-20 | CVE-2020-6101 | AMD | Out-of-bounds Write vulnerability in AMD Radeon Directx 11 Driver Atidxx64.Dll 26.20.15019.19000 An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. | 6.5 |
2020-07-20 | CVE-2020-6100 | AMD | Out-of-bounds Write vulnerability in AMD Radeon Directx 11 Driver Atidxx64.Dll 26.20.15019.19000 An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. | 6.5 |
2020-07-22 | CVE-2020-15902 | Nagios | Cross-site Scripting vulnerability in Nagios XI Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option. | 6.1 |
2020-07-22 | CVE-2020-15895 | Dlink | Cross-site Scripting vulnerability in Dlink Dir-816L Firmware 2.06/2.06.B09 An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. | 6.1 |
2020-07-22 | CVE-2020-6535 | Google Opensuse Debian Fedoraproject | Cross-site Scripting vulnerability in multiple products Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page. | 6.1 |
2020-07-20 | CVE-2020-13932 | Apache | Cross-site Scripting vulnerability in Apache Activemq Artemis In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. | 6.1 |
2020-07-24 | CVE-2020-8207 | Citrix | Improper Authentication vulnerability in Citrix Workspace 1912/2002 Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the automatic updater service is running. | 6.0 |
2020-07-23 | CVE-2020-15632 | Dlink | Incorrect Implementation of Authentication Algorithm vulnerability in Dlink Dir-842 Firmware This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. | 5.8 |
2020-07-23 | CVE-2020-15631 | Dlink | OS Command Injection vulnerability in Dlink Dap-1860 Firmware 1.01B06/1.02B01/1.04B01 This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 1.04B03_HOTFIX WiFi extenders. | 5.8 |
2020-07-23 | CVE-2020-15882 | Munkireport Project | Cross-Site Request Forgery (CSRF) vulnerability in Munkireport Project Munkireport A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines from the MunkiReport database. | 5.8 |
2020-07-20 | CVE-2020-15111 | Gofiber | Injection vulnerability in Gofiber Fiber In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. | 5.8 |
2020-07-20 | CVE-2020-3442 | DUO | Cleartext Transmission of Sensitive Information vulnerability in DUO Duoconnect 1.0.0/1.1.0 The DuoConnect client enables users to establish SSH connections to hosts protected by a DNG instance. | 5.7 |
2020-07-24 | CVE-2020-15945 | LUA | Unspecified vulnerability in LUA Lua through 5.4.0 has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function. | 5.5 |
2020-07-23 | CVE-2020-8557 | Kubernetes | Resource Exhaustion vulnerability in Kubernetes The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. | 5.5 |
2020-07-20 | CVE-2020-4125 | IBM | Download of Code Without Integrity Check vulnerability in IBM Marketing Operations Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the link, giving the attacker access to confidential information. | 5.5 |
2020-07-20 | CVE-2020-12028 | Rockwellautomation | Missing Authentication for Critical Function vulnerability in Rockwellautomation Factorytalk View In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce appropriate permissions. | 5.5 |
2020-07-25 | CVE-2020-7687 | Fast Http Project | Path Traversal vulnerability in Fast-Http Project Fast-Http This affects all versions of package fast-http. | 5.0 |
2020-07-25 | CVE-2020-7686 | Rollup Plugin DEV Server Project | Path Traversal vulnerability in Rollup-Plugin-Dev-Server Project Rollup-Plugin-Dev-Server This affects all versions of package rollup-plugin-dev-server. | 5.0 |
2020-07-25 | CVE-2020-7683 | Rollup Plugin Server Project | Path Traversal vulnerability in Rollup-Plugin-Server Project Rollup-Plugin-Server This affects all versions of package rollup-plugin-server. | 5.0 |
2020-07-25 | CVE-2020-7682 | Marked Tree Project | Path Traversal vulnerability in Marked-Tree Project Marked-Tree This affects all versions of package marked-tree. | 5.0 |
2020-07-25 | CVE-2020-7681 | Indo Mars | Path Traversal vulnerability in Indo-Mars Marscode This affects all versions of package marscode. | 5.0 |
2020-07-24 | CVE-2020-15924 | Midasolutions | SQL Injection vulnerability in Midasolutions Eframework 2.8.0/2.8.9/2.9.0 There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. | 5.0 |
2020-07-23 | CVE-2020-7519 | Schneider Electric | Weak Password Requirements vulnerability in Schneider-Electric Easergy Builder 1.4.7.2 A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to compromise a user account. | 5.0 |
2020-07-23 | CVE-2020-7518 | Schneider Electric | Improper Input Validation vulnerability in Schneider-Electric Easergy Builder 1.4.7.2 A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to modify project configuration files. | 5.0 |
2020-07-23 | CVE-2020-7491 | Schneider Electric | Unspecified vulnerability in Schneider-Electric products **VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 through 10.5.3 is visible on the network and could allow inappropriate access. | 5.0 |
2020-07-23 | CVE-2020-11625 | Avertx | Information Exposure Through Discrepancy vulnerability in Avertx Hd438 Firmware and Hd838 Firmware An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. | 5.0 |
2020-07-23 | CVE-2020-10922 | Automationdirect | Improper Input Validation vulnerability in Automationdirect C-More HMI EA9 Firmware 6.52 This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. | 5.0 |
2020-07-23 | CVE-2020-10918 | Automationdirect | Improper Authentication vulnerability in Automationdirect C-More HMI EA9 Firmware 6.52 This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. | 5.0 |
2020-07-23 | CVE-2019-11252 | Kubernetes | Information Exposure Through an Error Message vulnerability in Kubernetes The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes. | 5.0 |
2020-07-23 | CVE-2020-11440 | Windriver | Information Exposure vulnerability in Windriver Vxworks httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root. | 5.0 |
2020-07-23 | CVE-2020-15908 | Cauldrondevelopment | Path Traversal vulnerability in Cauldrondevelopment C! tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction from a TAR archive. | 5.0 |
2020-07-22 | CVE-2020-4400 | IBM | Insufficiently Protected Credentials vulnerability in IBM Verify Gateway 1.0.0/1.0.1 IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. | 5.0 |
2020-07-22 | CVE-2020-9663 | Adobe | Path Traversal vulnerability in Adobe Reader Adobe Reader Mobile versions 20.0.1 and earlier have a directory traversal vulnerability. | 5.0 |
2020-07-22 | CVE-2020-15896 | Dlink | Improper Authentication vulnerability in Dlink Dap-1522 Firmware 1.41/1.42 An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. | 5.0 |
2020-07-22 | CVE-2020-15806 | Codesys | Allocation of Resources Without Limits or Throttling vulnerability in Codesys products CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation. | 5.0 |
2020-07-21 | CVE-2020-15879 | Bitwarden | Server-Side Request Forgery (SSRF) vulnerability in Bitwarden Server 1.35.1 Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16). | 5.0 |
2020-07-21 | CVE-2018-21036 | Sailsjs | Improper Input Validation vulnerability in Sailsjs Sails Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request. | 5.0 |
2020-07-20 | CVE-2020-15052 | Articatech | SQL Injection vulnerability in Articatech Artica Proxy An issue was discovered in Artica Proxy CE before 4.28.030.418. | 5.0 |
2020-07-20 | CVE-2020-8214 | Servey Project | Path Traversal vulnerability in Servey Project Servey 2.2.0 A path traversal vulnerability in servey version < 3 allows an attacker to read content of any arbitrary file. | 5.0 |
2020-07-20 | CVE-2020-8205 | Transloadit | Server-Side Request Forgery (SSRF) vulnerability in Transloadit Uppy The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems. | 5.0 |
2020-07-20 | CVE-2020-14494 | Openclinic GA Project | Improper Restriction of Excessive Authentication Attempts vulnerability in Openclinic GA Project Openclinic GA 5.09.02/5.89.05B OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to access the system after no more than a fixed maximum number of attempts. | 5.0 |
2020-07-20 | CVE-2020-14484 | Openclinic GA Project | Improper Restriction of Excessive Authentication Attempts vulnerability in Openclinic GA Project Openclinic GA 5.09.02/5.89.05B OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attacks. | 5.0 |
2020-07-24 | CVE-2020-10600 | Osisoft | NULL Pointer Dereference vulnerability in Osisoft PI Data Archive 2018/2019/3.4.430.460 An authenticated remote attacker could crash PI Archive Subsystem when the subsystem is working under memory pressure. | 4.9 |
2020-07-24 | CVE-2020-10608 | Osisoft | Improper Verification of Cryptographic Signature vulnerability in Osisoft products In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. | 4.6 |
2020-07-24 | CVE-2020-10606 | Osisoft | Incorrect Default Permissions vulnerability in Osisoft products In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. | 4.6 |
2020-07-23 | CVE-2020-7514 | Schneider Electric | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Schneider-Electric Easergy Builder 1.4.7.2 A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker access to the authorization credentials for a device and gain full access. | 4.6 |
2020-07-22 | CVE-2019-18619 | Synaptics Lenovo HP | Release of Invalid Pointer or Reference vulnerability in multiple products Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers. | 4.6 |
2020-07-22 | CVE-2020-12774 | Dlink | OS Command Injection vulnerability in Dlink Dsl-7740C Firmware V6.Tr069.20180723 D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command. | 4.6 |
2020-07-20 | CVE-2020-12031 | Rockwellautomation | Out-of-bounds Write vulnerability in Rockwellautomation Factorytalk View In all versions of FactoryTalk View SE, after bypassing memory corruption mechanisms found in the operating system, a local, authenticated attacker may corrupt the associated memory space allowing for arbitrary code execution. | 4.6 |
2020-07-21 | CVE-2020-12499 | Phoenixcontact | Path Traversal vulnerability in Phoenixcontact Plcnext Engineer 202031 In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files. | 4.4 |
2020-07-20 | CVE-2020-15009 | Asus | Untrusted Search Path vulnerability in Asus Screenpad2 Upgrade Tool 1.0.3 AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2_Upgrade_Tool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 (UX450FDX, UX550GDX and UX550GEX) could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with a particular file name. | 4.4 |
2020-07-24 | CVE-2020-8175 | Jpeg JS Project | Resource Exhaustion vulnerability in Jpeg-Js Project Jpeg-Js Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image. | 4.3 |
2020-07-24 | CVE-2020-15919 | Midasolutions | Cross-site Scripting vulnerability in Midasolutions Eframework 2.8.0/2.8.9/2.9.0 A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0. | 4.3 |
2020-07-23 | CVE-2019-18834 | Woocommerce | Cross-site Scripting vulnerability in Woocommerce Subscriptions Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php. | 4.3 |
2020-07-23 | CVE-2020-12638 | Espressif | Improper Authentication vulnerability in Espressif Esp-Idf An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices through 3.3. | 4.3 |
2020-07-23 | CVE-2020-10919 | Automationdirect | Inadequate Encryption Strength vulnerability in Automationdirect C-More HMI EA9 Firmware 6.52 This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. | 4.3 |
2020-07-23 | CVE-2020-15883 | Managedinstalls Project | Cross-site Scripting vulnerability in Managedinstalls Project Managedinstalls A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported). | 4.3 |
2020-07-23 | CVE-2020-15881 | Munki Facts Project | Cross-site Scripting vulnerability in Munki Facts Project Munki Facts A Cross-Site Scripting (XSS) vulnerability in the munki_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the key name. | 4.3 |
2020-07-22 | CVE-2020-4397 | IBM | Cleartext Transmission of Sensitive Information vulnerability in IBM Verify Gateway 1.0.0/1.0.1 IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an attacker using man in the middle techniques. | 4.3 |
2020-07-22 | CVE-2020-9686 | Adobe | Out-of-bounds Read vulnerability in Adobe Photoshop and Photoshop CC Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. | 4.3 |
2020-07-22 | CVE-2020-9679 | Adobe | Out-of-bounds Read vulnerability in Adobe Prelude 9.0 Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability. | 4.3 |
2020-07-22 | CVE-2020-9665 | Magento | Cross-site Scripting vulnerability in Magento Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. | 4.3 |
2020-07-22 | CVE-2020-6536 | Google Debian Opensuse Fedoraproject | Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox (URL bar) via a crafted PWA. | 4.3 |
2020-07-22 | CVE-2020-6531 | Google Debian Opensuse Fedoraproject | Information Exposure Through Discrepancy vulnerability in multiple products Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | 4.3 |
2020-07-22 | CVE-2020-6529 | Google Debian Opensuse Fedoraproject | Improper Certificate Validation vulnerability in multiple products Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak cross-origin data via a crafted HTML page. | 4.3 |
2020-07-22 | CVE-2020-6528 | Google Debian Opensuse Fedoraproject | Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. | 4.3 |
2020-07-22 | CVE-2020-6527 | Google Debian Opensuse Fedoraproject | Incorrect Default Permissions vulnerability in multiple products Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page. | 4.3 |
2020-07-22 | CVE-2020-6516 | Google Debian Opensuse Fedoraproject | Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | 4.3 |
2020-07-21 | CVE-2020-14063 | TC Custom Javascript Project | Cross-site Scripting vulnerability in TC Custom Javascript Project TC Custom Javascript A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. | 4.3 |
2020-07-21 | CVE-2020-12432 | Collaboraoffice | Cross-site Scripting vulnerability in Collaboraoffice Collabora Online Development Edition The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. | 4.3 |
2020-07-20 | CVE-2020-1776 | Otrs | Insufficient Session Expiration vulnerability in Otrs When an agent user is renamed or set to invalid the session belonging to the user is keept active. | 4.3 |
2020-07-20 | CVE-2020-6872 | ZTE | Cross-site Scripting vulnerability in ZTE products The server management software module of ZTE has a storage XSS vulnerability. | 4.3 |
2020-07-20 | CVE-2020-15053 | Articatech | Cross-site Scripting vulnerability in Articatech Artica Proxy An issue was discovered in Artica Proxy CE before 4.28.030.418. | 4.3 |
2020-07-20 | CVE-2020-7680 | Docsifyjs | Cross-site Scripting vulnerability in Docsifyjs Docsify docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). | 4.3 |
2020-07-20 | CVE-2020-4527 | IBM | Session Fixation vulnerability in IBM Planning Analytics 2.0 IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag for the session cookie in TLS mode. | 4.3 |
2020-07-20 | CVE-2020-15841 | Liferay | Insufficiently Protected Credentials vulnerability in Liferay DXP and Liferay Portal Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature. | 4.3 |
2020-07-24 | CVE-2020-14725 | Oracle Netapp | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). | 4.0 |
2020-07-23 | CVE-2020-7520 | Schneider Electric | Open Redirect vulnerability in Schneider-Electric Software Update Utility A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could cause execution of malicious code on the victim's machine. | 4.0 |
2020-07-22 | CVE-2020-15126 | Parseplatform | Incorrect Authorization vulnerability in Parseplatform Parse Server In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object. | 4.0 |
2020-07-22 | CVE-2020-4399 | IBM | Unspecified vulnerability in IBM Verify Gateway 1.0.0/1.0.1 IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could allow an authenticated user to send malformed requests to cause a denial of service against the server. | 4.0 |
2020-07-22 | CVE-2020-15124 | Intranda | Path Traversal vulnerability in Intranda Goobi Viewer Core In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. | 4.0 |
2020-07-21 | CVE-2020-15102 | Prestashop | Missing Authorization vulnerability in Prestashop Dashboard products In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. | 4.0 |
2020-07-21 | CVE-2020-15873 | Librenms | SQL Injection vulnerability in Librenms In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php. | 4.0 |
2020-07-20 | CVE-2020-12027 | Rockwellautomation | Unspecified vulnerability in Rockwellautomation Factorytalk View All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. | 4.0 |
2020-07-20 | CVE-2020-14491 | Openclinic GA Project | Missing Authorization vulnerability in Openclinic GA Project Openclinic GA 5.09.02/5.89.05B OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege user to access privileged information. | 4.0 |
2020-07-20 | CVE-2020-4466 | IBM | Unspecified vulnerability in IBM MQ FOR HPE Nonstop 8.0.4/8.1.0 IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due to an error within the Queue processing function. | 4.0 |
2020-07-20 | CVE-2020-4361 | IBM | Information Exposure vulnerability in IBM Planning Analytics 2.0 IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responses. | 4.0 |
16 Low Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2020-07-22 | CVE-2019-18618 | Synaptics Lenovo HP | Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table. | 3.6 |
2020-07-25 | CVE-2020-10614 | Osisoft | Cross-site Scripting vulnerability in Osisoft PI Vision 2017/2019 In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject code into a display. | 3.5 |
2020-07-24 | CVE-2020-10602 | PI | NULL Pointer Dereference vulnerability in PI Data Archive 2018 In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager due to a race condition. | 3.5 |
2020-07-24 | CVE-2020-14175 | Atlassian | Cross-site Scripting vulnerability in Atlassian Confluence Data Center and Confluence Server Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in user macro parameters. | 3.5 |
2020-07-24 | CVE-2020-15918 | Midasolutions | Cross-site Scripting vulnerability in Midasolutions Eframework 2.8.0/2.8.9/2.9.0 Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0. | 3.5 |
2020-07-23 | CVE-2020-4447 | IBM | Cross-site Scripting vulnerability in IBM Filenet Content Manager 5.5.3/5.5.4 IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. | 3.5 |
2020-07-23 | CVE-2020-15885 | Munkireport Project | Cross-site Scripting vulnerability in Munkireport Project Comment A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment. | 3.5 |
2020-07-20 | CVE-2020-15118 | Torchbox | Cross-site Scripting vulnerability in Torchbox Wagtail In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard form rendering helpers such as form.as_p, any HTML tags used within a form field's help text will be rendered unescaped in the page. | 3.5 |
2020-07-23 | CVE-2020-7517 | Schneider Electric | Cleartext Storage of Sensitive Information vulnerability in Schneider-Electric Easergy Builder 1.4.7.2 A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to read user credentials. | 2.1 |
2020-07-23 | CVE-2020-7516 | Schneider Electric | Cleartext Storage of Sensitive Information vulnerability in Schneider-Electric Easergy Builder 1.4.7.2 A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker access to login credentials. | 2.1 |
2020-07-23 | CVE-2020-7515 | Schneider Electric | Use of Hard-coded Credentials vulnerability in Schneider-Electric Easergy Builder 1.4.7.2 A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker to decrypt a password. | 2.1 |
2020-07-22 | CVE-2020-4372 | IBM | Insufficiently Protected Credentials vulnerability in IBM Verify Gateway 1.0.0/1.0.1 IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. | 2.1 |
2020-07-22 | CVE-2020-4371 | IBM | Insecure Storage of Sensitive Information vulnerability in IBM Verify Gateway 1.0.0/1.0.1 IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system. | 2.1 |
2020-07-22 | CVE-2020-4369 | IBM | Cleartext Storage of Sensitive Information vulnerability in IBM Verify Gateway 1.0.0/1.0.1 IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user. | 2.1 |
2020-07-21 | CVE-2020-15859 | Qemu Debian | Use After Free vulnerability in multiple products QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address. | 2.1 |
2020-07-22 | CVE-2014-1422 | Canonical | Incorrect Permission Assignment for Critical Resource vulnerability in Canonical Trust-Store (Ubuntu) and Trust-Store (Ubuntu Rtm) In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. | 1.9 |