Vulnerability Summary for the Week of June 1, 2020

Original release date: June 8, 2020

 

High Vulnerabilities

Primary
Vendor — Product
Description Published CVSS Score Source & Patch Info
asus — aura_sync
 
Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, which allows local users to cause a denial of service (system crash) or gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption. 2020-06-02 7.2 CVE-2019-17603
MISC
cisco — ios_xe_software
 
A vulnerability in the processing of boot options of specific Cisco IOS XE Software switches could allow an authenticated, local attacker with root shell access to the underlying operating system (OS) to conduct a command injection attack during device boot. This vulnerability is due to insufficient input validation checks while processing boot options. An attacker could exploit this vulnerability by modifying device boot options to execute attacker-provided code. A successful exploit may allow an attacker to bypass the Secure Boot process and execute malicious code on an affected device with root-level privileges. 2020-06-03 7.2 CVE-2020-3207
CISCO
cisco — ios_xe_software
 
A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to escalate their privileges to a user with root-level privileges. The vulnerability is due to insufficient validation of user-supplied content. This vulnerability could allow an attacker to load malicious software onto an affected device. 2020-06-03 7.2 CVE-2020-3214
CISCO
clearpass — policy_manager
 
The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then execute an exploit that would allow to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. 2020-06-03 10 CVE-2020-7115
MISC
clearpass — policy_manager
 
The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. 2020-06-03 9 CVE-2020-7116
MISC
clearpass — policy_manager
 
The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher. 2020-06-03 9 CVE-2020-7117
MISC
d-link — dir-865l_devices
 
D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection. 2020-06-03 7.5 CVE-2020-13782
MISC
docker — engine
 
An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service. 2020-06-02 7.5 CVE-2020-13401
MISC
MISC
CONFIRM
farsite — farlinx_x25_gateway
 
FarLinX X25 Gateway through 2014-09-25 allows attackers to write arbitrary data to fsUI.xyz via fsSaveUIPersistence.php. 2020-06-01 7.5 CVE-2014-7175
MISC
farsite — farlinx_x25_gateway
 
FarLinX X25 Gateway through 2014-09-25 allows command injection via shell metacharacters to sysSaveMonitorData.php, fsx25MonProxy.php, syseditdate.php, iframeupload.php, or sysRestoreX25Cplt.php. 2020-06-01 7.5 CVE-2014-7173
MISC
fortinet — foritap-s/w2_and_fortiap-u
 
An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI. 2020-06-01 8.5 CVE-2019-15709
MISC
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has an out-of-bounds write when Internet Explorer is used. 2020-06-04 7.5 CVE-2019-20830
CONFIRM
freerdp — freerdp
 
In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0. 2020-05-29 7.5 CVE-2020-11038
CONFIRM
freerdp — freerdp
 
In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. 2020-05-29 7.5 CVE-2020-11039
CONFIRM
gesio — erp
 
There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information. 2020-06-01 7.5 CVE-2020-8967
CONFIRM
github — enterprise_server
 
An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program. 2020-06-03 7.5 CVE-2020-10516
MISC
MISC
MISC
ibm — security_guardium
 
IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 174735. 2020-06-03 9 CVE-2020-4180
XF
CONFIRM
ibm — security_guardium
 
IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174732. 2020-06-03 7.5 CVE-2020-4177
XF
CONFIRM
micro_focus — service_management_automation
 
There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation (SMA) product affecting version 2018.05 to 2020.02. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation. 2020-05-29 7.5 CVE-2020-11844
CONFIRM
piwigo — lexiglot
 
admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields. 2020-06-01 7.5 CVE-2014-8945
MISC
piwigo — lexiglot
 
Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI. 2020-06-01 7.5 CVE-2014-8941
MISC
qualcomm — multiple_snapdragon_products
 
Improper permissions in XBL_SEC region enable user to update XBL_SEC code and data and divert the RAM dump path to normal cold boot path in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, MSM8998, QCS404, QCS605, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SM8150, SXR1130, SXR2130 2020-06-02 7.2 CVE-2019-14054
CONFIRM
qualcomm — multiple_snapdragon_products
 
Firmware will hit assert in WLAN firmware If encrypted data length in FILS IE of reassoc response is more than 528 bytes in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ6018, IPQ8074, Kamorta, Nicobar, QCA6390, QCA8081, QCN7605, QCS404, QCS405, QCS605, Rennell, SC7180, SC8180X, SDA845, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SXR1130, SXR2130 2020-06-02 7.8 CVE-2020-3645
CONFIRM
qualcomm — multiple_snapdragon_products
 
NULL exception due to accessing bad pointer while posting events on RT FIFO in Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ6018, IPQ8074, QCA8081, SC8180X, SXR2130 2020-06-02 7.2 CVE-2020-3618
CONFIRM
qualcomm — multiple_snapdragon_products
 
When making query to DSP capabilities, Stack out of bounds occurs due to wrong buffer length configured for DSP attributes in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in SM8250, SXR2130 2020-06-02 7.2 CVE-2020-3625
CONFIRM
qualcomm — multiple_snapdragon_products
 
Valid deauth/disassoc frames is dropped in case if RMF is enabled and some rouge peer keep on sending rogue deauth/disassoc frames due to improper enum values used to check the frame subtype in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8009, APQ8053, APQ8096AU, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS605, SC8180X, SDM630, SDM636, SDM660, SDM845, SDX20, SDX24, SDX55, SM8150, SXR1130 2020-06-02 7.5 CVE-2020-3615
CONFIRM
qualcomm — multiple_snapdragon_products
 
Integer overflow in calculating estimated output buffer size when getting a list of installed Feature IDs, Serial Numbers or checking Feature ID status in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Kamorta, MDM9205, MDM9607, Nicobar, QCS404, QCS405, Rennell, SA6155P, SC7180, SC8180X, SDX55, SM6150, SM7150, SXR2130 2020-06-02 7.2 CVE-2019-14066
CONFIRM
qualcomm — multiple_snapdragon_products
 
Array out of bound may occur while playing mp3 file as no check is there on offset if it is greater than the buffer allocated or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, MSM8998, QCS405, QCS605, QM215, Rennell, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR2130 2020-06-02 10 CVE-2020-3633
CONFIRM
qualcomm — multiple_snapdragon_products
 
Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, MSM8998, QCA6574AU, QCM2150, QCS405, QCS605, QM215, Rennell, SA6155P, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR2130 2020-06-02 10 CVE-2020-3641
CONFIRM
qualcomm — multiple_snapdragon_products
 
Buffer overflow in display function due to memory copy without checking length of size using strcpy function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8909W, MSM8917, MSM8953, MSM8996AU, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SM6150, SM7150, SM8150 2020-06-02 7.2 CVE-2020-3616
CONFIRM
qualcomm — multiple_snapdragon_products
 
Failure in buffer management while accessing handle for HDR blit when color modes not supported by display in Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wearables in MSM8909W, QCS605 2020-06-02 7.2 CVE-2019-14087
CONFIRM
qualcomm — sm8250_and_sxr2130_devices
 
kernel failure due to load failures while running v1 path directly via kernel in Snapdragon Mobile in SM8250, SXR2130 2020-06-02 7.2 CVE-2020-3623
CONFIRM
quickbox — quickbox_community_and_pro_editions
 
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/*.db or /etc/shadow file. 2020-06-01 9 CVE-2020-13695
MISC
quickbox — quickbox_community_and_pro_editions
 
In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password, which means that the www-data user can execute arbitrary OS commands via the mysql -e option. 2020-06-01 9 CVE-2020-13694
MISC
quickbox — quickbox_community_and_pro_editions
 
QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter. 2020-06-01 9 CVE-2020-13448
MISC
MISC
rconfig — rconfig
 
rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. 2020-06-04 7.5 CVE-2020-10548
MISC
rconfig — rconfig
 
rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. 2020-06-04 7.5 CVE-2020-10549
MISC
rconfig — rconfig
 
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. 2020-06-04 7.5 CVE-2020-10546
MISC
rconfig — rconfig
 
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. 2020-06-04 7.5 CVE-2020-10547
MISC
sabberworm — php_css_parser
 
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker. 2020-06-03 7.5 CVE-2020-13756
MISC
MISC
MISC
MISC
samsung — multiple_mobile_devices
 
An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software. The Widevine Trustlet allows arbitrary code execution because of memory disclosure, The Samsung IDs are SVE-2020-17117, SVE-2020-17118, SVE-2020-17119, and SVE-2020-17161 (June 2020). 2020-06-04 7.5 CVE-2020-13832
CONFIRM
samsung — multiple_mobile_devices
 
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 7570 chipsets) software. The Trustonic Kinibi component allows arbitrary memory mapping. The Samsung ID is SVE-2019-16665 (June 2020). 2020-06-04 7.5 CVE-2020-13831
CONFIRM
swarco — cpu_ls4000_series
 
An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4… grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices. 2020-05-29 10 CVE-2020-12493
CONFIRM
systemd — systemd
 
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082. 2020-06-03 10 CVE-2020-13776
MISC
verizon — serialize-javascript
 
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function “deleteFunctions” within “index.js”. 2020-06-01 7.5 CVE-2020-7660
MISC
wordpress — wordpress
 
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. 2020-05-29 7.5 CVE-2020-13693
MISC
MISC
MISC
MISC

Back to top

 

Medium Vulnerabilities

Primary
Vendor — Product
Description Published CVSS Score Source & Patch Info
2pisoftware — cmfive system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information (username and password) via any request, such as a password reset request. 2020-06-01 5 CVE-2014-9702
MISC
apache — ignite
 
Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem. 2020-06-03 6.4 CVE-2020-1963
MLIST
MISC
MLIST
MLIST
MLIST
atlassian — companion_app
 
The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who control a Confluence Server instance that the Companion App is connected to, execute arbitrary .exe files via a Protection Mechanism Failure. 2020-06-01 6.5 CVE-2020-4020
MISC
atlassian — companion_app
 
The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different executable in place of the app’s cmd.exe via a untrusted search path vulnerability. 2020-06-01 4.4 CVE-2020-4019
MISC
atlassian — fisheye_and_crucible
 
The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability. 2020-06-01 5 CVE-2020-4016
MISC
MISC
atlassian — fisheye_and_crucible
 
The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability. 2020-06-01 4 CVE-2020-4015
MISC
MISC
atlassian — fisheye_and_crucible
 
The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability. 2020-06-01 5 CVE-2020-4017
MISC
MISC
atlassian — fisheye_and_crucible
 
The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user’s watching settings for a repository via an improper authorization vulnerability. 2020-06-01 4 CVE-2020-4014
MISC
MISC
atlassian — fisheye_and_crucible
 
The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter. 2020-06-01 4.3 CVE-2020-4023
MISC
MISC
atlassian — fisheye_and_crucible
 
The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability. 2020-06-01 6.8 CVE-2020-4018
MISC
MISC
atlassian — navigator_links
 
The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check. 2020-06-03 4 CVE-2020-4026
MISC
MISC
bitrix — bitrix24
 
modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload. 2020-06-01 4.3 CVE-2020-13758
MISC
celluloid — reel
 
reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks. Note: This project is deprecated, and is not maintained any more. 2020-06-01 5 CVE-2020-7659
MISC
cisco — multiple_products
 
Multiple products that implement the IP Encapsulation within IP standard (RFC 2003, STD 1) decapsulate and route IP-in-IP traffic without any validation, which could allow an unauthenticated remote attacker to route arbitrary traffic via an exposed network interface and lead to spoofing, access control bypass, and other unexpected network behaviors. 2020-06-02 5 CVE-2020-10136
CERT-VN
MISC
MISC
cisco — prime_infrastructure
 
A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain and modify sensitive information that is stored in the underlying database. 2020-06-03 6.4 CVE-2020-3339
CISCO
cisco — webex_network_recording_player_and_cisco_webex_player_for_microsoft_windows
 
A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the player application on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to cause the Webex player application to crash when trying to view the malicious file. 2020-06-03 4.3 CVE-2020-3322
CISCO
cisco — webex_network_recording_player_and_webex_player_for_microsoft_windows
 
A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the player application on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to cause the Webex player application to crash when trying to view the malicious file. 2020-06-03 4.3 CVE-2020-3321
CISCO
compound — finance_compound_price_oracle
 
The price oracle in PriceOracle.sol in Compound Finance Compound Price Oracle 1.0 through 2.0 allows a price poster to set an invalid asset price via the setPrice function, and consequently violate the intended limits on price swings. 2020-06-03 5 CVE-2019-20809
MISC
cybele — thinfinity_virtualUI
 
Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring. The victim user must load an application request to view a PDF, containing the malicious payload. This results in a reflected XSS payload being executed. 2020-06-04 4.3 CVE-2019-16385
MISC
cybele — thinfinity_virtualui
 
Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration. This enables files outside of the web directory to be retrieved if the exact location is known and the user has permissions. 2020-06-04 4 CVE-2019-16384
MISC
d-link — dir-856l_devices
 
D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF. 2020-06-03 6.8 CVE-2020-13786
MISC
d-link — dir-865l_devices
 
D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information. 2020-06-03 5 CVE-2020-13787
MISC
d-link — dir-865l_devices
 
D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength. 2020-06-03 5 CVE-2020-13785
MISC
d-link — dir-865l_devices
 
D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator. 2020-06-03 5 CVE-2020-13784
MISC
d-link — dir-865l_devices
 
D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information. 2020-06-03 5 CVE-2020-13783
MISC
django-project — django
 
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack. 2020-06-03 4.3 CVE-2020-13596
MISC
MISC
CONFIRM
django_project — django
 
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. 2020-06-03 5 CVE-2020-13254
MISC
MISC
CONFIRM
elastic — elastic_app_search
 
Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victim�s web browser. 2020-06-03 4.3 CVE-2020-7011
N/A
elastic — elastic_cloud_on_kubernetes
 
Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK. 2020-06-03 5 CVE-2020-7010
N/A
elastic — kibana
 
Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system. 2020-06-03 6.5 CVE-2020-7013
N/A
elastic — kibana
 
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system. 2020-06-03 6.5 CVE-2020-7012
N/A
farsite — farlinx_x25_gateway
 
FarLinX X25 Gateway through 2014-09-25 allows directory traversal via the log-handling feature. 2020-06-01 5 CVE-2014-7174
MISC
fastecdsa — fastecdsa
 
An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail. 2020-06-02 5 CVE-2020-12607
CONFIRM
CONFIRM
CONFIRM
CONFIRM
fortiguard — forticlient_for_windows
 
An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack. 2020-06-01 4.6 CVE-2020-9291
MISC
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference. 2020-06-04 5 CVE-2019-20813
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows stack consumption via nested function calls for XML parsing. 2020-06-04 5 CVE-2019-20815
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference. 2020-06-04 5 CVE-2019-20816
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows memory consumption because data is created for each page of an application level. 2020-06-04 5 CVE-2019-20814
CONFIRM
foxit — phantompdf_mac_and_foxit_reader_for_mac
 
An issue was discovered in Foxit PhantomPDF Mac and Foxit Reader for Mac before 4.0. It allows signature validation bypass via a modified file or a file with non-standard signatures. 2020-06-04 5 CVE-2020-13803
CONFIRM
foxit — reader_and_phantompdf An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows memory consumption because data is created for each page of an application level. 2020-06-04 5 CVE-2019-20818
CONFIRM
foxit — reader_and_phantompdf An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It allows signature validation bypass via a modified file or a file with non-standard signatures. 2020-06-04 5 CVE-2019-20837
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has homograph mishandling. 2020-06-04 4.3 CVE-2019-20835
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference. 2020-06-04 5 CVE-2019-20820
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has a use-after-free because of JavaScript execution after a deletion or close operation. 2020-06-04 5 CVE-2020-13806
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has circular reference mishandling that causes a loop. 2020-06-04 5 CVE-2020-13807
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows resource consumption via crafted cross-reference stream data. 2020-06-04 5 CVE-2020-13808
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows resource consumption via long strings in the content stream. 2020-06-04 5 CVE-2020-13809
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference. 2020-06-04 5 CVE-2019-20817
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows stack consumption via nested function calls for XML parsing. 2020-06-04 5 CVE-2019-20819
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failures. 2020-06-04 5 CVE-2020-13805
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field APs. 2020-06-04 5 CVE-2019-20828
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file. 2020-06-04 5 CVE-2019-20829
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has mishandling of cloud credentials, as demonstrated by Google Drive. 2020-06-04 5 CVE-2019-20836
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows information disclosure of a hardcoded username and password in the DocuSign plugin. 2020-06-04 6.8 CVE-2020-13804
CONFIRM
freerdp — freerdp
 
In FreeRDP less than or equal to 2.0.0, when running with logger set to “WLOG_TRACE”, a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. 2020-05-29 5 CVE-2020-11019
CONFIRM
freerdp — freerdp
 
In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. 2020-05-29 6.4 CVE-2020-11085
MISC
CONFIRM
freerdp — freerdp
 
In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. 2020-05-29 5.5 CVE-2020-11088
MISC
CONFIRM
freerdp — freerdp
 
In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0. 2020-05-29 5.5 CVE-2020-11087
MISC
CONFIRM
freerdp — freerdp
 
In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. 2020-05-29 5.5 CVE-2020-11086
MISC
CONFIRM
freerdp — freerdp
 
In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset. Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0. 2020-05-29 5 CVE-2020-11043
CONFIRM
freerdp — freerdp
 
In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0. 2020-05-29 4 CVE-2020-11040
CONFIRM
freerdp — freerdp
 
In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, …). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0. 2020-05-29 4 CVE-2020-11041
CONFIRM
freerdp — freerdp
 
In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. 2020-05-29 6.5 CVE-2020-11089
MISC
MISC
CONFIRM
google — chrome
 
Incorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page. 2020-06-03 4.3 CVE-2020-6502
MISC
MISC
google — chrome
 
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. 2020-06-03 4.3 CVE-2020-6495
MISC
MISC
google — chrome
 
Inappropriate implementation in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass AppCache security restrictions via a crafted HTML page. 2020-06-03 4.3 CVE-2020-6499
MISC
MISC
google — chrome
 
Inappropriate implementation in interstitials in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. 2020-06-03 4.3 CVE-2020-6500
MISC
MISC
google — chrome
 
Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-06-03 6.8 CVE-2020-6419
MISC
MISC
google — chrome
 
Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2020-06-03 4.3 CVE-2020-6501
MISC
MISC
google — chrome
 
Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. 2020-06-03 6.8 CVE-2020-6493
MISC
MISC
google — chrome
 
Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-06-03 6.8 CVE-2020-6453
MISC
MISC
google — chrome
 
Insufficient policy enforcement in V8 in Google Chrome prior to 14.0.0.0 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. 2020-06-03 4.3 CVE-2011-2863
MISC
google — chrome
 
Bad cast in CSS in Google Chrome prior to 11.0.0.0 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-06-03 6.8 CVE-2011-1805
MISC
google — chrome
 
Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass notification restrictions via a crafted HTML page. 2020-06-03 4.3 CVE-2020-6504
MISC
MISC
google — chrome_on_android
 
Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. 2020-06-03 4.3 CVE-2020-6494
MISC
MISC
google — chrome_on_ios
 
Incorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted HTML page. 2020-06-03 4.3 CVE-2020-6498
MISC
MISC
google — chrome_on_ios
 
Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted URI. 2020-06-03 4.3 CVE-2020-6497
MISC
MISC
google — chrome_on_macos
 
Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. 2020-06-03 6.8 CVE-2020-6496
MISC
MISC
grafana_labs — grafana
 
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. 2020-06-03 5 CVE-2020-13379
CONFIRM
MISC
MISC
MISC
CONFIRM
grafana_labs — grafana
 
Grafana 5.3.1 has XSS via a link on the “Dashboard > All Panels > General” screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. 2020-06-02 4.3 CVE-2018-18625
MISC
grafana_labs — grafana
 
Grafana 5.3.1 has XSS via the “Dashboard > Text Panel” screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. 2020-06-02 4.3 CVE-2018-18623
MISC
grafana_labs — grafana
 
Grafana 5.3.1 has XSS via a column style on the “Dashboard > Table Panel” screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. 2020-06-02 4.3 CVE-2018-18624
MISC
huawei — cloudengine_12800_products
 
CloudEngine 12800 products with versions of V200R019C00, V200R019C10SPC800, V200R019C00SPC600, V200R019C10; and CloudEngine 6800 products with versions of V200R019C00SPC800 have a denial of service vulnerability. Due to improper memory management, memory leakage may occur in some special cases. Attackers can perform a series of operations to exploit this vulnerability. Successful exploit may cause a denial of service. 2020-05-29 5 CVE-2020-1870
CONFIRM
huawei — e6878-370_products
 
E6878-370 products with versions of 10.0.3.1(H557SP27C233) and 10.0.3.1(H563SP1C00) have a stack buffer overflow vulnerability. The program copies an input buffer to an output buffer without verification. An attacker in the adjacent network could send a crafted message, successful exploit could lead to stack buffer overflow which may cause malicious code execution. 2020-05-29 5.8 CVE-2020-1832
CONFIRM
huawei — multiple_products
 
There is a few bytes out-of-bounds read vulnerability in some Huawei products. The software reads data past the end of the intended buffer when parsing certain message, an authenticated attacker could exploit this vulnerability by sending crafted messages to the device. Successful exploit may cause service abnormal in specific scenario.Affected product versions include:AR120-S versions V200R007C00SPC900,V200R007C00SPCa00 2020-06-01 4 MISC
ibm — planning_analytics_local
 
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178965. 2020-06-02 4.3 CVE-2020-4366
XF
CONFIRM
ibm — planning_analytics_local
 
IBM Planning Analytics Local 2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 179001. 2020-06-02 5 CVE-2020-4367
XF
CONFIRM
ibm — planning_analytics_local
 
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182283. 2020-06-02 4.3 CVE-2020-4503
XF
CONFIRM
ibm — qradar_siem
 
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 182364. 2020-06-04 5.5 CVE-2020-4509
XF
CONFIRM
ibm — security_guardium
 
IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174738. 2020-06-03 4.3 CVE-2020-4182
XF
CONFIRM
ibm — security_guardium
 
IBM Security Guardium 10.6, 11.0, and 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174851. 2020-06-03 4.6 CVE-2020-4190
XF
CONFIRM
ibm — security_guardium
 
IBM Security Guardium 11.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 174857. 2020-06-04 5 CVE-2020-4193
XF
CONFIRM
ibm — security_guardium
 
IBM Security Guardium 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM X-Force ID: 174805. 2020-06-03 5 CVE-2020-4187
XF
CONFIRM
ibm — security_guardium
 
IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174739. 2020-06-04 4.3 CVE-2020-4183
XF
CONFIRM
istio — istio
 
Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet, an attacker could trigger a Null Pointer Exception resulting in a Denial of Service. This could be sent to the ingress gateway or a sidecar, triggering a null pointer exception which results in a denial of service. This also affects servicemesh-proxy where a null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 (not on by default in version 1.4.x), an attacker could send a specially crafted packet to the ingress gateway or proxy sidecar, triggering a denial of service. 2020-06-02 5 CVE-2020-10739
CONFIRM
MISC
CONFIRM
jenkins — jenkins Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master. 2020-06-03 6.5 CVE-2020-2200
MLIST
CONFIRM
jenkins — jenkins
 
Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability. 2020-06-03 4.3 CVE-2020-2199
MLIST
CONFIRM
jenkins — jenkins
 
A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent labels. 2020-06-03 4.3 CVE-2020-2192
MLIST
CONFIRM
jenkins — jenkins
 
Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and removing agent labels. 2020-06-03 4 CVE-2020-2191
MLIST
CONFIRM
jenkins — jenkins
 
Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the ‘getConfigAsXML’ API URL when transmitting job config.xml data to users without Job/Configure. 2020-06-03 4 CVE-2020-2198
MLIST
CONFIRM
jenkins — jenkins
 
Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format. 2020-06-03 4 CVE-2020-2197
MLIST
CONFIRM
jenkins — jenkins
 
Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin. 2020-06-03 6 CVE-2020-2196
MLIST
CONFIRM
joomla! — joomla!
 
In Joomla! before 3.9.19, lack of input validation in the heading tag option of the “Articles – Newsflash” and “Articles – Categories” modules allows XSS. 2020-06-02 4.3 CVE-2020-13761
MISC
joomla! — joomla!
 
In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users. 2020-06-02 5 CVE-2020-13763
MISC
joomla! — joomla!
 
In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF. 2020-06-02 6.8 CVE-2020-13760
MISC
joomla! — joomla!
 
In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS. 2020-06-02 4.3 CVE-2020-13762
MISC
kubernetes — containernetworking/plugins
 
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container. 2020-06-03 6 CVE-2020-10749
CONFIRM
MISC
libipeg-turbo — libipeg-turbo
 
libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file. 2020-06-03 5.8 CVE-2020-13790
MISC
MISC
libvirt — libvirt
 
A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service. 2020-06-02 4 CVE-2020-10703
REDHAT
CONFIRM
CONFIRM
CONFIRM
CONFIRM
linux — linux_kernel
 
go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586. 2020-06-03 4.9 CVE-2019-20810
MISC
MISC
linux — linux_kernel
 
An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067. 2020-06-03 4.9 CVE-2019-20812
MISC
MISC
mediawiki — mediawiki
 
resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page. 2020-06-02 5.8 CVE-2020-10959
MISC
MISC
MISC
mulesoft — mulesoft_ce/ee
 
A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion. 2020-05-29 5 CVE-2020-6937
CONFIRM
naviwebs — navigate_cms An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/feeds/feed.class.php. 2020-06-03 4.3 CVE-2020-13798
MISC
naviwebs — navigate_cms
 
An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/structure/structure.class.php. 2020-06-03 4.3 CVE-2020-13796
MISC
naviwebs — navigate_cms
 
An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/websites/website.class.php. 2020-06-03 4.3 CVE-2020-13797
MISC
naviwebs — navigate_cms
 
An issue was discovered in Navigate CMS through 2.8.7. It allows Directory Traversal because lib/packages/templates/template.class.php mishandles ../ and .. substrings. 2020-06-03 5 CVE-2020-13795
MISC
MISC
october — october_cms
 
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466). 2020-06-03 4 CVE-2020-5296
MISC
CONFIRM
october — october_cms
 
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466). 2020-06-03 4 CVE-2020-5297
MISC
CONFIRM
october — october_cms
 
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466). 2020-06-03 4 CVE-2020-5295
MISC
CONFIRM
phplist — phplist
 
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php. 2020-06-04 4.3 CVE-2020-13827
MISC
pi-hole — pi-hole_web
 
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. 2020-05-29 6.5 CVE-2020-8816
CONFIRM
MISC
MISC
MISC
MISC
MISC
piwigo — lexiglot
 
Lexiglot through 2014-11-20 allows CSRF. 2020-06-01 6.8 CVE-2014-8942
MISC
piwigo — lexiglot
 
Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources. 2020-06-01 5 CVE-2014-8937
MISC
piwigo — lexiglot
 
Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request if PHP has a non-recommended configuration that produces warning messages. 2020-06-01 4.3 CVE-2014-8939
MISC
piwigo — lexiglot
 
Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI. 2020-06-01 5 CVE-2014-8940
MISC
piwigo — lexiglot
 
Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter. 2020-06-01 6.5 CVE-2014-8943
MISC
playtube — playtube
 
PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion. 2020-06-03 4 CVE-2020-13792
MISC
python-rsa — python-rsa
 
Python-RSA 4.0 ignores leading ‘’ bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation). 2020-06-01 5 CVE-2020-13757
MISC
qemu — qemu
 
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. 2020-06-02 5 CVE-2020-13659
CONFIRM
MISC
qemu — qemu
 
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. 2020-06-02 4.6 CVE-2020-13754
CONFIRM
MISC
qualcomm — multiple_snapdragon_products
 
A race condition can occur when using the fastrpc memory mapping API. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8053, MSM8909W, MSM8917, MSM8953, QCS605, QM215, SA415M, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SDX24, SXR1130 2020-06-02 6.9 CVE-2020-3680
CONFIRM
qualcomm — multiple_snapdragon_products
 
Possibility of out of bound access while processing the responses from video firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8917, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS405, QCS605, QM215, Rennell, SA415M, SA6155P, Saipan, SC8180X, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-02 4.6 CVE-2020-3630
CONFIRM
qualcomm — multiple_snapdragon_products
 
Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount taken for this object in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, APQ8098, MSM8909W, MSM8917, MSM8953, MSM8996AU, Nicobar, QCS405, QCS605, QM215, Rennell, SA415M, Saipan, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130 2020-06-02 4.6 CVE-2020-3610
CONFIRM
qualcomm — multiple_snapdragon_products
 
Out of bound memory access while processing qpay due to not validating length of the response buffer provided by User. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8098, MSM8909, MSM8998, SDA660, SDA845, SDM630, SDM636, SDM660, SDM845 2020-06-02 4.6 CVE-2019-14078
CONFIRM
qualcomm — multiple_snapdragon_products
 
Out of bound memory access while processing ese transmit command due to passing Response buffer received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8098, IPQ6018, Kamorta, MDM9150, MDM9205, MDM9607, MDM9650, MSM8909, MSM8998, Nicobar, QCS404, QCS405, QCS605, Rennell, SA415M, SA6155P, SC7180, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-02 4.6 CVE-2019-14077
CONFIRM
rust-vmm — vm-memory
 
rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obj and write_obj do not properly access memory. This affects aarch64 (with musl or glibc) and x86_64 (with musl). 2020-06-02 5 CVE-2020-13759
MISC
MISC
MISC
samsung — multiple_mobile_devices
 
An issue was discovered on Samsung mobile devices with P(9.0) software. One UI HOME logging can leak information. The Samsung ID is SVE-2019-16382 (June 2020). 2020-06-04 5 CVE-2020-13830
CONFIRM
samsung — multiple_mobile_devices
 
An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The Gatekeeper Trustlet allows a brute-force attack on user credentials. The Samsung ID is SVE-2020-16908 (June 2020). 2020-06-04 5 CVE-2020-13835
CONFIRM
samsung — multiple_mobile_devices
 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The system area allows arbitrary file overwrites via a symlink attack. The Samsung ID is SVE-2020-17183 (June 2020). 2020-06-04 6.4 CVE-2020-13833
CONFIRM
samsung — multiple_mobile_devices
 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. HWRResProvider allows path traversal for data exposure. The Samsung ID is SVE-2020-16954 (June 2020). 2020-06-04 5 CVE-2020-13836
CONFIRM
samsung — multiple_mobile_devices
 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (with TEEGRIS) software. Secure Folder does not properly restrict use of Android Debug Bridge (adb) for arbitrary installations. The Samsung ID is SVE-2020-17369 (June 2020). 2020-06-04 5 CVE-2020-13834
CONFIRM
samsung — multiple_mobile_devices
 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Attackers can disable the SEAndroid protection mechanism in the RKP. The Samsung ID is SVE-2019-15998 (June 2020). 2020-06-04 5 CVE-2020-13829
CONFIRM
synk — broker All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk’s internal network by creating symlinks to match whitelisted paths. 2020-05-29 4 CVE-2020-7653
MISC
MISC
synk — broker
 
All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG. 2020-05-29 4.3 CVE-2020-7654
MISC
MISC
synk — broker
 
All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk’s internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json` 2020-05-29 4 CVE-2020-7648
MISC
MISC
synk — broker
 
All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk’s internal network via directory traversal. 2020-05-29 4 CVE-2020-7652
MISC
MISC
synk — broker
 
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk’s internal network of any files ending in the following extensions: yaml, yml or json. 2020-05-29 4 CVE-2020-7650
MISC
MISC
synk — broker
 
All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk’s internal network via patch history from GitHub Commits API. 2020-05-29 4 CVE-2020-7651
MISC
MISC
sysax — multi_server
 
An issue was discovered in Sysax Multi Server 6.90. An attacker can determine the username (under which the web server is running) by triggering an invalid path permission error. This bypasses the fakepath protection mechanism. 2020-06-02 5 CVE-2020-13227
MISC
MISC
MISC
sysax — multi_server
 
An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter. 2020-06-02 4.3 CVE-2020-13228
MISC
MISC
MISC
sysax — multi_server
 
An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token. 2020-06-02 6.8 CVE-2020-13229
MISC
MISC
upx — upx
 
p_lx_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT_DYNAMIC segment. 2020-06-01 4.3 CVE-2019-20805
MISC
MISC
vmware — multiple_products
 
VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior) and VMware Horizon Client for Mac (5.x and prior) contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use (TOCTOU) issue in the service opener. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC and Horizon Client are installed. 2020-05-29 6.9 CVE-2020-3957
CONFIRM
vmware — spring_cloud_config
 
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. 2020-06-02 5 CVE-2020-5410
CONFIRM
websocket-extensions — websocket-extensions websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. 2020-06-02 5 CVE-2020-7663
MISC
MISC
MISC
MISC
websocket-extensions — websocket-extensions websocket-extensions npm module prior to 1.0.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. 2020-06-02 5 CVE-2020-7662
MISC
MISC
MISC
MISC
wordpress — wordpress
 
common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call. 2020-06-02 5 CVE-2020-13764
MISC
MISC
wordpress — wordpress
 
The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS). 2020-06-02 4.3 CVE-2019-11843
MISC
MISC
MISC
zimbra — zimbra
 
Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a “Corrupt File” error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution. 2020-06-03 6 CVE-2020-12846
MISC
CONFIRM
MISC
znc — znc
 
ZNC 1.8.0 up to 1.8.1-rc1 allows attackers to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network. 2020-06-02 4.3 CVE-2020-13775
MISC
CONFIRM
zoho — manageengine_opmanager
 
In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed. 2020-06-04 5 CVE-2020-13818
MISC

Back to top

 

Low Vulnerabilities

Primary
Vendor — Product
Description Published CVSS Score Source & Patch Info
abb — device_library_wizard
 
Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read file that contains confidential data 2020-05-29 2.1 CVE-2020-8482
CONFIRM
atlassian — fisheye_and_crucible
 
The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives. 2020-06-01 3.5 CVE-2020-4013
MISC
MISC
atlassian — jira_server_and_data_center
 
Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view. 2020-06-01 3.5 CVE-2020-4021
MISC
avaya — ip_office
 
A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 though 11.0.4.3. 2020-06-04 2.1 CVE-2020-7030
MISC
CONFIRM
elastic — kibana
 
Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensitive information from, or perform destructive actions, on behalf of Kibana users who edit the TSVB visualization. 2020-06-03 3.5 CVE-2020-7015
N/A
fortiguard — fortianalyzer
 
An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Description Area. 2020-06-04 3.5 CVE-2020-6640
MISC
huawei — honor_9x_smartphones
 
Honor 9X smartphones with versions earlier than 9.1.1.172(C00E170R8P1) have an improper authentication vulnerability. A logic error occurs when handling clock function, an attacker should do a series of crafted operations quickly before the phone is unlocked, successful exploit could allow the attacker to access clock information without unlock the phone. 2020-05-29 2.1 CVE-2020-1833
CONFIRM
huawei — mate_10_smartphones
 
HUAWEI Mate 10 smartphones with versions earlier than 10.0.0.143(C00E143R2P4) have an information disclosure vulnerability. The attacker could wake up voice assistant then do a series of crafted voice operation, successful exploit could allow the attacker read certain files without unlock the phone leading to information disclosure. 2020-05-29 2.1 CVE-2020-1809
CONFIRM
huawei — mate_20_smartphones HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. The system does not properly restrict certain operation in ADB mode, successful exploit could allow certain user break the limit of digital balance function. 2020-05-29 2.1 CVE-2020-1797
CONFIRM
huawei — mate_20_smartphones
 
HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.195(SP31C00E74R3P8) have an improper authorization vulnerability. The digital balance function does not sufficiently restrict the using time of certain user, successful exploit could allow the user break the limit of digital balance function after a series of operations with a PC. 2020-05-29 1.9 CVE-2020-1831
CONFIRM
ibm — planning_analytics_local
 
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178765. 2020-06-02 3.5 CVE-2020-4360
XF
CONFIRM
ibm — planning_analytics_local
 
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 180761. 2020-06-02 3.5 CVE-2020-4431
XF
CONFIRM
ibm — security_guardium
 
IBM Security Guardium 11.1 could allow an attacker on the same network to gain access to the Solr dashboard and cause a denial of service attack. IBM X-Force ID: 176997. 2020-06-03 3.3 CVE-2020-4307
XF
CONFIRM
ibm — security_guardium
 
IBM Security Guardium 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174852. 2020-06-04 2.1 CVE-2020-4191
XF
CONFIRM
jenkins — jenkins
 
Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission. 2020-06-03 3.5 CVE-2020-2195
MLIST
CONFIRM
jenkins — jenkins
 
Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability. 2020-06-03 3.5 CVE-2020-2190
MLIST
CONFIRM
jenkins — jenkins
 
Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability. 2020-06-03 3.5 CVE-2020-2194
MLIST
CONFIRM
jenkins — jenkins
 
Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerability. 2020-06-03 3.5 CVE-2020-2193
MLIST
CONFIRM
linux — linux_kernel
 
An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c. 2020-06-03 2.1 CVE-2019-20811
MISC
MISC
october — october_cms
 
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466). 2020-06-03 3.5 CVE-2020-5298
MISC
CONFIRM
piwigo — lexiglot
 
Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_message, or new_file_content parameter. 2020-06-01 3.5 CVE-2014-8944
MISC
piwigo — lexiglot
 
Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line. 2020-06-01 2.1 CVE-2014-8938
MISC
qualcomm — multiple_snapdragon_products When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where the mode is set to a value that does not resolve to a valid XFRM mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, QCA4531, QCN7605, QCS605, QM215, SA415M, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130 2020-06-02 3.6 CVE-2019-14053
CONFIRM
qualcomm — multiple_snapdragon_products
 
Buffer over-read in ADSP parse function due to lack of check for availability of sufficient data payload received in command response in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8953, QCS605, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM670, SDM710, SDM845, SDX20, SDX24 2020-06-02 3.6 CVE-2019-14038
CONFIRM
qualcomm — multiple_snapdragon_products
 
Out of bound read in adm call back function due to incorrect boundary check for payload in command response in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8953, QCS605, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM670, SDM710, SDM845, SDX20, SDX24 2020-06-02 3.6 CVE-2019-14039
CONFIRM
qualcomm — multiple_snapdragon_products
 
Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing side channel issue. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS404, QCS405, QCS605, QM215, Rennell, SA415M, SA6155P, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130, SXR2130 2020-06-02 2.1 CVE-2019-14067
CONFIRM
qualcomm — multiple_snapdragon_products
 
Out of bound read in Fingerprint application due to requested data is being used without length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Kamorta, MDM9150, MDM9205, MDM9650, MSM8998, Nicobar, QCS404, QCS405, QCS605, Rennell, SA415M, SA6155P, SC7180, SC8180X, SDA660, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-02 3.6 CVE-2019-14043
CONFIRM
qualcomm — multiple_snapdragon_products
 
Out of bound read in in fingerprint application due to requested data assigned to a local buffer without length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Kamorta, MDM9205, Nicobar, QCS404, QCS405, QCS605, Rennell, SA415M, SA6155P, SC7180, SC8180X, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-02 3.6 CVE-2019-14042
CONFIRM
samsung — multiple_mobile_devices
 
An issue was discovered on Samsung mobile devices with Q(10.0) software. The Lockscreen feature does not block Quick Panel access to Music Share. The Samsung ID is SVE-2020-17145 (June 2020). 2020-06-04 3.6 CVE-2020-13837
CONFIRM
samsung — multiple_mobile_devices
 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The DeX Lockscreen feature does not block access to Quick Panel and notifications. The Samsung ID is SVE-2020-17187 (June 2020). 2020-06-04 3.6 CVE-2020-13838
CONFIRM
sane — backends
 
A NULL pointer dereference in sanei_epson_net_read in SANE Backends through 1.0.29 allows a malicious device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075. 2020-06-01 2.1 CVE-2020-12867
CONFIRM
CONFIRM
vmware — esxi_and_workstation_and_fusion
 
VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), VMware Workstation (15.x before 15.5.2) and VMware Fusion (11.x before 11.5.2) contain a denial-of-service vulnerability in the shader functionality. Successful exploitation of this issue may allow attackers with non-administrative access to a virtual machine to crash the virtual machine’s vmx process leading to a denial of service condition. 2020-05-29 2.1 CVE-2020-3958
MISC
CONFIRM
vmware — esxi_and_workstation_and_fusion
 
VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), VMware Workstation (15.x before 15.1.0) and VMware Fusion (11.x before 11.1.0) contain a memory leak vulnerability in the VMCI module. A malicious actor with local non-administrative access to a virtual machine may be able to crash the virtual machine’s vmx process leading to a partial denial of service. 2020-05-29 2.1 CVE-2020-3959
CONFIRM
zte — ft680_router
 
ZTE’s PON terminal product is impacted by the access control vulnerability. Due to the system not performing correct access control on some program interfaces, an attacker could use this vulnerability to tamper with the program interface parameters to perform unauthenticated operations. This affects: <ZTE F680><V9.0.10P1N6> 2020-06-01 3.3 CVE-2020-6868
MISC

Back to top

 

Severity Not Yet Assigned

Primary
Vendor — Product
Description Published CVSS Score Source & Patch Info
apache — unomi
 
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process. 2020-06-05 not yet calculated CVE-2020-11975
MISC
apple — multiple_products
 
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges. 2020-06-05 not yet calculated CVE-2020-9859
MISC
athom — homey_and_homey_pro_devices
 
An issue was discovered in all Athom Homey and Homey Pro devices up to the current version 4.2.0. An attacker within RF range can obtain a cleartext copy of the network configuration of the device, including the Wi-Fi PSK, during device setup. Upon success, the attacker is able to further infiltrate the target’s Wi-Fi networks. 2020-06-04 not yet calculated CVE-2020-9462
MISC
bitdefender — antivirus_free
 
A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects Bitdefender Antivirus Free versions prior to 1.0.17.178. 2020-06-05 not yet calculated CVE-2020-8103
CONFIRM
bludit — bludit
 
showAlert() in the administration panel in Bludit 3.12.0 allows XSS. 2020-06-06 not yet calculated CVE-2020-13889
MISC
castel — nextgen_dvr
 
Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/Users/Edit/:UserId fails to check that the request was submitted by an Administrator. This allows a normal user to escalate their privileges by adding additional roles to their account. 2020-06-04 not yet calculated CVE-2020-11679
MISC
FULLDISC
MISC
castel — nextgen_dvr
 
Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, and included in requests sent by web interface. However, this token is not verified by the application: the token can be removed from all requests and the request will succeed. 2020-06-04 not yet calculated CVE-2020-11682
MISC
FULLDISC
MISC
castel — nextgen_dvr
 
Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials. 2020-06-04 not yet calculated CVE-2020-11681
MISC
FULLDISC
MISC
castel — nextgen_dvr
 
Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted by an administrator. Consequently, a normal user can perform actions including, but not limited to, creating/modifying the file store, creating/modifying alerts, creating/modifying users, etc. 2020-06-04 not yet calculated CVE-2020-11680
MISC
FULLDISC
MISC

cisco — 4300_series_integrated_services_routers_and_catalyst_9800-l_wireless_controllers

A vulnerability in the hardware crypto driver of Cisco IOS XE Software for Cisco 4300 Series Integrated Services Routers and Cisco Catalyst 9800-L Wireless Controllers could allow an unauthenticated, remote attacker to disconnect legitimate IPsec VPN sessions to an affected device. The vulnerability is due to insufficient verification of authenticity of received Encapsulating Security Payload (ESP) packets. An attacker could exploit this vulnerability by tampering with ESP cleartext values as a man-in-the-middle. 2020-06-03 not yet calculated CVE-2020-3220
CISCO
cisco — 809_and_829_industrial_services_routers
 
A vulnerability in the image verification feature of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) could allow an authenticated, local attacker to boot a malicious software image on an affected device. The vulnerability is due to insufficient access restrictions on the area of code that manages the image verification feature. An attacker could exploit this vulnerability by first authenticating to the targeted device and then logging in to the Virtual Device Server (VDS) of an affected device. The attacker could then, from the VDS shell, disable Cisco IOS Software integrity (image) verification. A successful exploit could allow the attacker to boot a malicious Cisco IOS Software image on the targeted device. To exploit this vulnerability, the attacker must have valid user credentials at privilege level 15. 2020-06-03 not yet calculated CVE-2020-3208
CISCO
cisco — application_services_engine_software
 
A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of other users on an affected device. The vulnerability is due to insufficient authorization limitations. An attacker could exploit this vulnerability by logging in to an affected device locally with valid credentials. A successful exploit could allow the attacker to read the sensitive information of other users on the affected device. 2020-06-03 not yet calculated CVE-2020-3335
CISCO
cisco — application_services_engine_software
 
A vulnerability in the API of Cisco Application Services Engine Software could allow an unauthenticated, remote attacker to update event policies on an affected device. The vulnerability is due to insufficient authentication of users who modify policies on an affected device. An attacker could exploit this vulnerability by crafting a malicious HTTP request to contact an affected device. A successful exploit could allow the attacker to update event policies on the affected device. 2020-06-03 not yet calculated CVE-2020-3333
CISCO

cisco — asr_920_series_aggregation_service_router

A vulnerability in the Simple Network Management Protocol (SNMP) implementation in Cisco ASR 920 Series Aggregation Services Router model ASR920-12SZ-IM could allow an authenticated, remote attacker to cause the device to reload. The vulnerability is due to incorrect handling of data that is returned for Cisco Discovery Protocol queries to SNMP. An attacker could exploit this vulnerability by sending a request for Cisco Discovery Protocol information by using SNMP. An exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. 2020-06-03 not yet calculated CVE-2020-3232
CISCO

cisco — catalyst-2960-l_series_switches_and_catalyst_cdp-8p_switches

A vulnerability in the 802.1X feature of Cisco Catalyst 2960-L Series Switches and Cisco Catalyst CDB-8P Switches could allow an unauthenticated, adjacent attacker to forward broadcast traffic before being authenticated on the port. The vulnerability exists because broadcast traffic that is received on the 802.1X-enabled port is mishandled. An attacker could exploit this vulnerability by sending broadcast traffic on the port before being authenticated. A successful exploit could allow the attacker to send and receive broadcast traffic on the 802.1X-enabled port before authentication. 2020-06-03 not yet calculated CVE-2020-3231
CISCO
cisco — catalyst_4500_series_switches
 
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient input validation when the software processes specific SNMP object identifiers. An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Note: To exploit this vulnerability by using SNMPv2c or earlier, the attacker must know the SNMP read-only community string for an affected system. To exploit this vulnerability by using SNMPv3, the attacker must know the user credentials for the affected system. 2020-06-03 not yet calculated CVE-2020-3235
CISCO
cisco — catalyst_9800_series_wireless_controllers
 
A vulnerability in the Flexible NetFlow Version 9 packet processor of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of parameters in a Flexible NetFlow Version 9 record. An attacker could exploit this vulnerability by sending a malformed Flexible NetFlow Version 9 packet to the Control and Provisioning of Wireless Access Points (CAPWAP) data port of an affected device. An exploit could allow the attacker to trigger an infinite loop, resulting in a process crash that would cause a reload of the device. 2020-06-03 not yet calculated CVE-2020-3221
CISCO
cisco — catalyst_9800_series_wireless_controllers
 
A vulnerability in the locally significant certificate (LSC) provisioning feature of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak that could lead to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain public key infrastructure (PKI) packets. An attacker could exploit this vulnerability by sending crafted Secure Sockets Layer (SSL) packets to an affected device. A successful exploit could cause an affected device to continuously consume memory, which could result in a memory allocation failure that leads to a crash and causes a DoS condition. 2020-06-03 not yet calculated CVE-2020-3203
CISCO
cisco — catalyst_9800_series_wireless_controllers
 
A vulnerability in the handling of IEEE 802.11w Protected Management Frames (PMFs) of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to terminate a valid user connection to an affected device. The vulnerability exists because the affected software does not properly validate 802.11w disassociation and deauthentication PMFs that it receives. An attacker could exploit this vulnerability by sending a spoofed 802.11w PMF from a valid, authenticated client on a network adjacent to an affected device. A successful exploit could allow the attacker to terminate a single valid user connection to the affected device. 2020-06-03 not yet calculated CVE-2020-3206
CISCO
cisco — digital_network_architecture_center
 
A vulnerability in the audit logging component of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to view sensitive information in clear text. The vulnerability is due to the storage of certain unencrypted credentials. An attacker could exploit this vulnerability by accessing the audit logs and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to use those credentials to discover and manage network devices. 2020-06-03 not yet calculated CVE-2020-3281
CISCO
cisco — identity_services_engine
 
A vulnerability in the syslog processing engine of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a race condition that may occur when syslog messages are processed. An attacker could exploit this vulnerability by sending a high rate of syslog messages to an affected device. A successful exploit could allow the attacker to cause the Application Server process to crash, resulting in a DoS condition. 2020-06-03 not yet calculated CVE-2020-3353
CISCO
cisco — ios_and_ios_xe_software
 
A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient input validation of data passed to the Tcl interpreter. An attacker could exploit this vulnerability by executing crafted Tcl arguments on an affected device. An exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. 2020-06-03 not yet calculated CVE-2020-3201
CISCO
cisco — ios_and_ios_xe_software
 
A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker with privileged EXEC credentials to execute arbitrary code on the underlying operating system (OS) with root privileges. The vulnerability is due to insufficient input validation of data passed to the Tcl interpreter. An attacker could exploit this vulnerability by loading malicious Tcl code on an affected device. A successful exploit could allow the attacker to cause memory corruption or execute the code with root privileges on the underlying OS of the affected device. 2020-06-03 not yet calculated CVE-2020-3204
CISCO
cisco — ios_and_ios_xe_software
 
A vulnerability in the Secure Shell (SSH) server code of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. The vulnerability is due to an internal state not being represented correctly in the SSH state machine, which leads to an unexpected behavior. An attacker could exploit this vulnerability by creating an SSH connection to an affected device and using a specific traffic pattern that causes an error condition within that connection. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition. 2020-06-03 not yet calculated CVE-2020-3200
CISCO
cisco — ios_and_ios_xe_software
 
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to prevent IKEv2 from establishing new security associations. The vulnerability is due to incorrect handling of crafted IKEv2 SA-Init packets. An attacker could exploit this vulnerability by sending crafted IKEv2 SA-Init packets to the affected device. An exploit could allow the attacker to cause the affected device to reach the maximum incoming negotiation limits and prevent further IKEv2 security associations from being formed. 2020-06-03 not yet calculated CVE-2020-3230
CISCO
cisco — ios_xe_sd-wan_software
 
A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for certain commands. An attacker could exploit this vulnerability by stopping the boot initialization of an affected device. A successful exploit could allow the attacker to bypass authentication and gain unrestricted access to the root shell of the affected device. 2020-06-03 not yet calculated CVE-2020-3216
CISCO
cisco — ios_xe_software Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerabilities are due to insufficient input processing of CIP traffic. An attacker could exploit these vulnerabilities by sending crafted CIP traffic to be processed by an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. 2020-06-03 not yet calculated CVE-2020-3225
CISCO
cisco — ios_xe_software A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to read arbitrary files on the underlying filesystem of the device. The vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by creating a specific file reference on the filesystem and then accessing it through the web UI. An exploit could allow the attacker to read arbitrary files from the underlying operating system’s filesystem. 2020-06-03 not yet calculated CVE-2020-3223
CISCO
cisco — ios_xe_software
 
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker could exploit this vulnerability by uploading a crafted file to the web UI of an affected device. A successful exploit could allow the attacker to inject and execute arbitrary commands with root privileges on the device. 2020-06-03 not yet calculated CVE-2020-3212
CISCO
cisco — ios_xe_software
 
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of user-supplied input to the web UI. An attacker could exploit this vulnerability by submitting crafted input to the web UI. A successful exploit could allow an attacker to execute arbitrary commands with administrative privileges on an affected device. 2020-06-03 not yet calculated CVE-2020-3219
CISCO
cisco — ios_xe_software
 
A vulnerability in the Session Initiation Protocol (SIP) library of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient sanity checks on received SIP messages. An attacker could exploit this vulnerability by sending crafted SIP messages to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service condition. 2020-06-03 not yet calculated CVE-2020-3226
CISCO
cisco — ios_xe_software
 
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to inject IOS commands to an affected device. The injected commands should require a higher privilege level in order to be executed. The vulnerability is due to insufficient input validation of specific HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a specific web UI endpoint on an affected device. A successful exploit could allow the attacker to inject IOS commands to the affected device, which could allow the attacker to alter the configuration of the device or cause a denial of service (DoS) condition. 2020-06-03 not yet calculated CVE-2020-3224
CISCO
cisco — ios_xe_software
 
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to bypass access control restrictions on an affected device. The vulnerability is due to the presence of a proxy service at a specific endpoint of the web UI. An attacker could exploit this vulnerability by connecting to the proxy service. An exploit could allow the attacker to bypass access restrictions on the network by proxying their access request through the management network of the affected device. As the proxy is reached over the management virtual routing and forwarding (VRF), this could reduce the effectiveness of the bypass. 2020-06-03 not yet calculated CVE-2020-3222
CISCO
cisco — ios_xe_software
 
A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manages the verification of the digital signatures of system image files during the initial boot process. An attacker could exploit this vulnerability by loading unsigned software on an affected device. A successful exploit could allow the attacker to install and boot a malicious software image or execute unsigned binaries on the targeted device. 2020-06-03 not yet calculated CVE-2020-3209
CISCO
cisco — ios_xe_software
 
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system of an affected device. The vulnerability is due to improper input sanitization. An attacker who has valid administrative access to an affected device could exploit this vulnerability by supplying a crafted input parameter on a form in the web UI and then submitting that form. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device, which could lead to complete system compromise. 2020-06-03 not yet calculated CVE-2020-3211
CISCO
cisco — ios_xe_software
 
A vulnerability in the Virtual Services Container of Cisco IOS XE Software could allow an authenticated, local attacker to gain root-level privileges on an affected device. The vulnerability is due to insufficient validation of a user-supplied open virtual appliance (OVA). An attacker could exploit this vulnerability by installing a malicious OVA on an affected device. 2020-06-03 not yet calculated CVE-2020-3215
CISCO
cisco — ios_xe_software
 
A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the underlying operating system. The vulnerability is due to the ROMMON allowing for special parameters to be passed to the device at initial boot up. An attacker could exploit this vulnerability by sending parameters to the device at initial boot up. An exploit could allow the attacker to elevate from a Priv15 user to the root user and execute arbitrary commands with the privileges of the root user. 2020-06-03 not yet calculated CVE-2020-3213
CISCO
cisco — ios_xe_software
 
A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute Cisco IOx API commands without proper authorization. The vulnerability is due to incorrect handling of requests for authorization tokens. An attacker could exploit this vulnerability by using a crafted API call to request such a token. An exploit could allow the attacker to obtain an authorization token and execute any of the IOx API commands on an affected device. 2020-06-03 not yet calculated CVE-2020-3227
CISCO
cisco — ios_xe_software
 
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privileges on the underlying Linux shell. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by first creating a malicious file on the affected device itself and then uploading a second malicious file to the device. A successful exploit could allow the attacker to execute arbitrary code with root privileges or bypass licensing requirements on the device. 2020-06-03 not yet calculated CVE-2020-3218
CISCO
cisco — ios_xe_web_management_software
 
A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacker to execute commands or configuration changes as an Admin user. The vulnerability is due to incorrect handling of RBAC for the administration GUI. An attacker could exploit this vulnerability by sending a modified HTTP request to the affected device. An exploit could allow the attacker as a Read-Only user to execute CLI commands or configuration changes as if they were an Admin user. 2020-06-03 not yet calculated CVE-2020-3229
CISCO
cisco — iox_application
 
A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual instance that is running on the affected device. The vulnerability is due to insufficient input validation of user-supplied application packages. An attacker who can upload a malicious package within Cisco IOx could exploit the vulnerability to modify arbitrary files. The impacts of a successful exploit are limited to the scope of the virtual instance and do not affect the device that is hosting Cisco IOx. 2020-06-03 not yet calculated CVE-2020-3238
CISCO
cisco — iox_application
 
A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, local attacker to overwrite arbitrary files in the virtual instance that is running on the affected device. The vulnerability is due to insufficient path restriction enforcement. An attacker could exploit this vulnerability by including a crafted file in an application package. An exploit could allow the attacker to overwrite files. 2020-06-03 not yet calculated CVE-2020-3237
CISCO
cisco — iox_application_framework
 
A vulnerability in the web-based Local Manager interface of the Cisco IOx Application Framework could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based Local Manager interface of an affected device. The attacker must have valid Local Manager credentials. The vulnerability is due to insufficient validation of user-supplied input by the web-based Local Manager interface of the affected software. An attacker could exploit this vulnerability by injecting malicious code into a system settings tab. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information. 2020-06-03 not yet calculated CVE-2020-3233
CISCO
cisco — multiple_products
 
A vulnerability in the Topology Discovery Service of Cisco One Platform Kit (onePK) in Cisco IOS Software, Cisco IOS XE Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient length restrictions when the onePK Topology Discovery Service parses Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol message to an affected device. An exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges, or to cause a process crash, which could result in a reload of the device and cause a DoS condition. 2020-06-03 not yet calculated CVE-2020-3217
CISCO
cisco — multiple_products
 
A vulnerability in Security Group Tag Exchange Protocol (SXP) in Cisco IOS Software, Cisco IOS XE Software, and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because crafted SXP packets are mishandled. An attacker could exploit this vulnerability by sending specifically crafted SXP packets to the affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. 2020-06-03 not yet calculated CVE-2020-3228
CISCO
cisco — multiple_routers
 
Multiple vulnerabilities in the Cisco IOx application environment of Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) that are running Cisco IOS Software could allow an attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. 2020-06-03 not yet calculated CVE-2020-3199
CISCO
cisco — multiple_routers
 
A vulnerability in the virtual console authentication of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an authenticated but low-privileged, local attacker to log in to the Virtual Device Server (VDS) of an affected device by using a set of default credentials. The vulnerability is due to the presence of weak, hard-coded credentials. An attacker could exploit this vulnerability by authenticating to the targeted device and then connecting to VDS through the device&rsquo;s virtual console by using the static credentials. A successful exploit could allow the attacker to access the Linux shell of VDS as the root user. 2020-06-03 not yet calculated CVE-2020-3234
CISCO
cisco — multiple_routers
 
A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an authenticated, local attacker to execute arbitrary shell commands on the Virtual Device Server (VDS) of an affected device. The attacker must have valid user credentials at privilege level 15. The vulnerability is due to insufficient validation of arguments that are passed to specific VDS-related CLI commands. An attacker could exploit this vulnerability by authenticating to the targeted device and including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands in the context of the Linux shell of VDS with the privileges of the root user. 2020-06-03 not yet calculated CVE-2020-3210
CISCO
cisco — multiple_routers
 
Multiple vulnerabilities in Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an unauthenticated, remote attacker or an authenticated, local attacker to execute arbitrary code on an affected system or cause an affected system to crash and reload. For more information about these vulnerabilities, see the Details section of this advisory. 2020-06-03 not yet calculated CVE-2020-3198
CISCO
cisco — multiple_routers
 
A vulnerability in the implementation of the inter-VM channel of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an unauthenticated, adjacent attacker to execute arbitrary shell commands on the Virtual Device Server (VDS) of an affected device. The vulnerability is due to insufficient validation of signaling packets that are destined to VDS. An attacker could exploit this vulnerability by sending malicious packets to an affected device. A successful exploit could allow the attacker to execute arbitrary commands in the context of the Linux shell of VDS with the privileges of the root user. Because the device is designed on a hypervisor architecture, exploitation of a vulnerability that affects the inter-VM channel may lead to a complete system compromise. For more information about this vulnerability, see the Details section of this advisory. 2020-06-03 not yet calculated CVE-2020-3205
CISCO
cisco — multiple_routers
 
Multiple vulnerabilities in the Cisco IOx application environment of Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) that are running Cisco IOS Software could allow an attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. 2020-06-03 not yet calculated CVE-2020-3257
CISCO
cisco — multiple_routers
 
Multiple vulnerabilities in Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an unauthenticated, remote attacker or an authenticated, local attacker to execute arbitrary code on an affected system or cause an affected system to crash and reload. For more information about these vulnerabilities, see the Details section of this advisory. 2020-06-03 not yet calculated CVE-2020-3258
CISCO
cisco — unified_contact_center_express
 
A vulnerability in the API subsystem of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to change the availability state of any agent. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by authenticating to an affected system with valid agent credentials and performing a specific API call with crafted input. A successful exploit could allow the attacker to change the availability state of an agent, potentially causing a denial of service condition. 2020-06-03 not yet calculated CVE-2020-3267
CISCO

cisco — webex_network_recording_player_and_webex_player_for_microsoft_windows

A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the player application on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to cause the Webex player application to crash when trying to view the malicious file. This vulnerability affects Cisco Webex Network Recording Player and Webex Player releases earlier than Release 3.0 MR3 Security Patch 2 and 4.0 MR3. 2020-06-03 not yet calculated CVE-2020-3319
CISCO
combodo — itop In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4. 2020-06-05 not yet calculated CVE-2020-11697
CONFIRM
CONFIRM
combodo — itop
 
In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4. 2020-06-05 not yet calculated CVE-2020-11696
CONFIRM
CONFIRM
craft — craft_cms
 
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name. 2020-06-05 not yet calculated CVE-2020-13869
MISC
craft — craft_cms
 
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name. 2020-06-05 not yet calculated CVE-2020-13870
MISC
craft — craft_cms
 
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity. 2020-06-05 not yet calculated CVE-2020-13868
MISC
docker — desktop
 
An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and then impersonate their privileges. 2020-06-05 not yet calculated CVE-2020-11492
MISC
MISC
elastic — elasticsearch
 
The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication token being generated with elevated privileges. 2020-06-03 not yet calculated CVE-2020-7014
N/A
elliptic — elliptic
 
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading ‘’ bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature. 2020-06-04 not yet calculated CVE-2020-13822
MISC
MISC
MISC
MISC
fortiguard — forticlient_for_windows
 
Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with access to the local storage or the configuration backup file to decrypt the sensitive data via knowledge of the hard-coded key. 2020-06-04 not yet calculated CVE-2019-16150
MISC
fortiguard — fortisiem_windows_agent
 
An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path. 2020-06-04 not yet calculated CVE-2020-9292
MISC
foxit — e-mail_advertising_system
 
An issue was discovered in Foxit E-mail advertising system before September 2018. It allows authentication bypass and information disclosure, related to Interspire Email Marketer. 2020-06-04 not yet calculated CVE-2018-21235
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has an out-of-bounds write when Internet Explorer is used. 2020-06-04 not yet calculated CVE-2019-20825
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.10. It has homograph mishandling. 2020-06-04 not yet calculated CVE-2019-20832
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action. 2020-06-04 not yet calculated CVE-2018-21237
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows Remote Code Execution via a GoToE or GoToR action. 2020-06-04 not yet calculated CVE-2018-21242
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file. 2020-06-04 not yet calculated CVE-2019-20824
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.6. It has an untrusted search path that allows a DLL to execute remote code. 2020-06-04 not yet calculated CVE-2018-21241
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows arbitrary application execution via an embedded executable file in a PDF portfolio, aka FG-VD-18-029. 2020-06-04 not yet calculated CVE-2018-21244
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.10. It allows signature validation bypass via a modified file or a file with non-standard signatures. 2020-06-04 not yet calculated CVE-2019-20834
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field APs. 2020-06-04 not yet calculated CVE-2019-20823
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.6. It has COM object mishandling when Microsoft Word is used. 2020-06-04 not yet calculated CVE-2018-21243
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows memory consumption via an ArrayBuffer(0xfffffffe) call. 2020-06-04 not yet calculated CVE-2018-21238
CONFIRM
foxit — phantompdf
 
An issue was discovered in Foxit PhantomPDF before 8.3.10. It has mishandling of cloud credentials, as demonstrated by Google Drive. 2020-06-04 not yet calculated CVE-2019-20833
CONFIRM
foxit — phantompdf_mac
 
An issue was discovered in Foxit PhantomPDF Mac before 3.4. It has a NULL pointer dereference. 2020-06-04 not yet calculated CVE-2019-20821
CONFIRM
foxit — phantompdf_mac
 
An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It has a NULL pointer dereference. 2020-06-04 not yet calculated CVE-2019-20826
CONFIRM
foxit — phantompdf_mac_and_reader_for_mac
 
An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It allows stack consumption because of interaction between ICC-Based color space and Alternate color space. 2020-06-04 not yet calculated CVE-2019-20827
CONFIRM
foxit — reader
 
An issue was discovered in Foxit Reader before 2.4.4. It has a NULL pointer dereference. 2020-06-04 not yet calculated CVE-2018-21236
CONFIRM
foxit — reader_and_phantompdf An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.7.0.29430. It has an out-of-bounds write via incorrect image data. 2020-06-04 not yet calculated CVE-2019-20822
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential theft via a GoToE or GoToR action. 2020-06-04 not yet calculated CVE-2018-21239
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows memory consumption via an ArrayBuffer(0xfffffffe) call. 2020-06-04 not yet calculated CVE-2018-21240
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It has a use-after-free via a document that lacks a dictionary. 2020-06-04 not yet calculated CVE-2020-13814
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows signature validation bypass via a modified file or a file with non-standard signatures. 2020-06-04 not yet calculated CVE-2020-13810
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It allows stack consumption via a loop of an indirect object reference. 2020-06-04 not yet calculated CVE-2020-13815
CONFIRM
foxit — reader_and_phantompdf
 
An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.5.0.20733. It has void data mishandling, causing a crash. 2020-06-04 not yet calculated CVE-2019-20831
CONFIRM

foxit — studio_photo

An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory. 2020-06-04 not yet calculated CVE-2020-13812
CONFIRM
foxit — studio_photo
 
An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory when FoxitStudioPhoto366_3.6.6.916.exe is used. 2020-06-04 not yet calculated CVE-2020-13813
CONFIRM
foxit — studio_photo
 
An issue was discovered in Foxit Studio Photo before 3.6.6.922. It has an out-of-bounds write via a crafted TIFF file. 2020-06-04 not yet calculated CVE-2020-13811
CONFIRM
ge — multiple_grid_solutions_reason_rt_clocks
 
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the ‘configuration’ user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system. 2020-06-02 not yet calculated CVE-2020-12017
MISC
gnutls — gnutls
 
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application. 2020-06-04 not yet calculated CVE-2020-13777
CONFIRM
FEDORA
DEBIAN
google — chrome
 
Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. 2020-06-03 not yet calculated CVE-2020-6503
MISC
MISC
huawei — multiple_products
 
Huawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability. An attacker with high privileges exploits this vulnerability by continuously performing specific operations. Successful exploitation of this vulnerability can cause service abnormal. 2020-06-05 not yet calculated CVE-2020-1883
MISC
huawei — multiple_smartphones
 
Huawei Smartphones HONOR 20 PRO;Honor View 20;HONOR 20 have an improper handling of exceptional condition Vulnerability. A component cannot deal with an exception correctly. Attackers can exploit this vulnerability by sending malformed message. This could compromise normal service of affected phones. 2020-06-05 not yet calculated CVE-2020-9074
MISC
ibm — websphere_application_server
 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181230. 2020-06-05 not yet calculated CVE-2020-4449
XF
CONFIRM
MISC
ibm — websphere_application_server
 
IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181231. 2020-06-05 not yet calculated CVE-2020-4450
XF
CONFIRM
MISC

ibm — websphere_application_server_network_deployment

IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 181228. 2020-06-05 not yet calculated CVE-2020-4448
XF
CONFIRM
MISC
ibm — worklight/mobilefoundation
 
IBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user logs out of a session, which could allow another user to gain unauthorized access to a user’s session. IBM X-Force ID: 175211. 2020-06-05 not yet calculated CVE-2020-4229
XF
CONFIRM
kubernetes — kube-controller-manager
 
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master’s host network (such as link-local or loopback services). 2020-06-05 not yet calculated CVE-2020-8555
CONFIRM
MLIST
lg — multiple_mobile_devices An issue was discovered on LG mobile devices with Android OS 9 and 10 (MTK chipsets). An AT command handler allows attackers to bypass intended access restrictions. The LG ID is LVE-SMP-200009 (June 2020). 2020-06-05 not yet calculated CVE-2020-13841
CONFIRM
lg — multiple_mobile_devices
 
An issue was discovered on LG mobile devices with Android OS software before 2020-06-01. Local users can cause a denial of service because checking of the userdata partition is mishandled. The LG ID is LVE-SMP-200014 (June 2020). 2020-06-05 not yet calculated CVE-2020-13843
CONFIRM
lg — multiple_mobile_devices
 
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via a custom AT command handler buffer overflow. The LG ID is LVE-SMP-200007 (June 2020). 2020-06-05 not yet calculated CVE-2020-13839
CONFIRM
lg — multiple_mobile_devices
 
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). A dangerous AT command was made available even though it is unused. The LG ID is LVE-SMP-200010 (June 2020). 2020-06-05 not yet calculated CVE-2020-13842
CONFIRM
lg — multiple_mobile_devices
 
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via an MTK AT command handler buffer overflow. The LG ID is LVE-SMP-200008 (June 2020). 2020-06-05 not yet calculated CVE-2020-13840
CONFIRM
minishare — minishare
 
In MiniShare before 1.4.2, there is a stack-based buffer overflow via an HTTP PUT request, which allows an attacker to achieve arbitrary code execution, a similar issue to CVE-2018-19861, CVE-2018-19862, and CVE-2019-17601. NOTE: this product is discontinued. 2020-06-04 not yet calculated CVE-2020-13768
MISC
mqtt — mqtt
 
The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to cause a denial of service (loss of the ability to establish new connections), as demonstrated by SlowITe. 2020-06-04 not yet calculated CVE-2020-13849
MISC
MISC
neon — neon
 
The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard. 2020-06-06 not yet calculated CVE-2020-13890
MISC
network_time_foundation — network_time_protocol ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim’s ntpd instance. 2020-06-04 not yet calculated CVE-2020-13817
MISC
MISC
nghttp2 — nghttp2
 
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection. 2020-06-03 not yet calculated CVE-2020-11080
MISC
MISC
CONFIRM
DEBIAN
nozbe — watermelondb
 
In WatermelonDB (NPM package “@nozbe/watermelondb”) before versions 0.15.1 and 0.16.2, a maliciously crafted record ID can exploit a SQL Injection vulnerability in iOS adapter implementation and cause the app to delete all or selected records from the database, generally causing the app to become unusable. This may happen in apps that don’t validate IDs (valid IDs are `/^[a-zA-Z0-9_-.]+$/`) and use Watermelon Sync or low-level `database.adapter.destroyDeletedRecords` method. The integrity risk is low due to the fact that maliciously deleted records won’t synchronize, so logout-login will restore all data, although some local changes may be lost if the malicious deletion causes the sync process to fail to proceed to push stage. No way to breach confidentiality with this vulnerability is known. Full exploitation of SQL Injection is mitigated, because it’s not possible to nest an insert/update query inside a delete query in SQLite, and it’s not possible to pass a semicolon-separated second query. There’s also no known practicable way to breach confidentiality by selectively deleting records, because those records will not be synchronized. It’s theoretically possible that selective record deletion could cause an app to behave insecurely if lack of a record is used to make security decisions by the app. This is patched in versions 0.15.1, 0.16.2, and 0.16.1-fix 2020-06-03 not yet calculated CVE-2020-4035
MISC
CONFIRM
october — october_cms
 
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vulnerability in the victims spreadsheet software of choice. 2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software. Issue has been patched in Build 466 (v1.0.466). 2020-06-03 not yet calculated CVE-2020-5299
MISC
MISC
CONFIRM
october — october_cms
 
The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potential exists for them to use this feature to view all requests being made to the application and obtain sensitive information from those requests. There even exists the potential for account takeovers of authenticated users by non-authenticated public users, which would then lead to a number of other potential issues as an attacker could theoretically get full access to the system if the required conditions existed. Issue has been patched in v3.1.0 by locking down access to the debugbar to all users; it now requires an authenticated backend user with a specifically enabled permission before it is even usable, and the feature that allows access to stored request information is restricted behind a different permission that’s more restrictive. 2020-06-04 not yet calculated CVE-2020-11094
MISC
CONFIRM
open-iscsi — targetcli-fb
 
Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup files). 2020-06-05 not yet calculated CVE-2020-13867
MISC
pam_tacplus —  pam_tacplus
 
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used. 2020-06-06 not yet calculated CVE-2020-13881
MISC
MISC
perl — perl
 
regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. 2020-06-05 not yet calculated CVE-2020-12723
CONFIRM
CONFIRM
CONFIRM
MISC
MISC
perl — perl
 
Perl before 5.30.3 has an integer overflow related to mishandling of a “PL_regkind[OP(n)] == NOTHING” situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. 2020-06-05 not yet calculated CVE-2020-10878
CONFIRM
CONFIRM
CONFIRM
CONFIRM
perl — perl
 
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. 2020-06-05 not yet calculated CVE-2020-10543
CONFIRM
CONFIRM
CONFIRM
postgresql — jdbc_driver
 
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. 2020-06-04 not yet calculated CVE-2020-13692
CONFIRM
CONFIRM
pupnp — pupnp
 
Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c. 2020-06-04 not yet calculated CVE-2020-13848
MISC
MISC
pydio — cells
 
Pydio Cells 2.0.4 allows XSS. A malicious user can either upload or create a new file that contains potentially malicious HTML and JavaScript code to personal folders or accessible cells. 2020-06-04 not yet calculated CVE-2020-12853
MISC
pydio — cells
 
Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders (repositories) by uploading a custom generated ZIP file and leveraging the file extraction feature present in the web application. The extracted files will be placed in the targeted user folders. 2020-06-04 not yet calculated CVE-2020-12851
MISC
MISC
pydio — cells
 
The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating its checksum and signature with the provided public key and finally replacing the current application binary. To complete the update process, the application’s service or appliance needs to be restarted. An attacker with administrator access can leverage the software update feature to force the application to download a custom binary that will replace current Pydio Cells binary. When the server or service is eventually restarted the attacker will be able to execute code under the privileges of the user running the application. In the Pydio Cells enterprise appliance this is with the privileges of the user named “pydio”. 2020-06-04 not yet calculated CVE-2020-12852
MISC
MISC
pydio — cells
 
In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password and proceed to login to the web application. Once logged into the web application with the hidden user account, some actions that were not available with the public share link can now be performed. 2020-06-05 not yet calculated CVE-2020-12848
MISC
MISC
pydio — cells
 
Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user. 2020-06-05 not yet calculated CVE-2020-12849
MISC
MISC
pydio — cells
 
Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the application’s mailer configuration. It is possible to configure a few engines to be used by the mailer application to send emails. If the user selects the “sendmail” option as the default one, the web application offers to edit the full path where the sendmail binary is hosted. Since there is no restriction in place while editing this value, an attacker authenticated as an administrator user could force the web application into executing any arbitrary binary. 2020-06-04 not yet calculated CVE-2020-12847
MISC
MISC
qemu — qemu A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU. 2020-06-04 not yet calculated CVE-2020-10702
CONFIRM
CONFIRM
qemu — qemu
 
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call. 2020-06-04 not yet calculated CVE-2020-13800
MISC
CONFIRM
qemu — qemu
 
rom_copy() in hw/core/loader.c in QEMU 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation. 2020-06-04 not yet calculated CVE-2020-13765
MISC
CONFIRM
qemu — qemu
 
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space. 2020-06-04 not yet calculated CVE-2020-13791
MISC
CONFIRM
sqlite — sqlite
 
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. 2020-06-06 not yet calculated CVE-2020-13871
MISC
MISC
MISC
swift_networks — red_cheetah
 
In the cheetah free wifi 5.1 driver file liebaonat.sys, local users are allowed to cause a denial of service (BSOD) or other unknown impact due to failure to verify the value of a specific IOCTL. 2020-06-05 not yet calculated CVE-2020-13646
MISC
tigera — calico_and_calico_enterprise
 
Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod. 2020-06-03 not yet calculated CVE-2020-13597
CONFIRM
CONFIRM
CONFIRM
url-regex — url-regex
 
all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service. 2020-06-04 not yet calculated CVE-2020-7661
MISC
MISC
weaveworks — weave_net
 
In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it’s pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them. By sending rogue router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance you also have on the host a vulnerability like last year’s RCE in apt (CVE-2019-3462), you can now escalate to the host. Weave Net version 2.6.3 disables the accept_ra option on the veth devices that it creates. 2020-06-03 not yet calculated CVE-2020-11091
MISC
CONFIRM
wordpress — worpdress
 
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links. 2020-06-05 not yet calculated CVE-2020-13864
MISC
wordpress — worpdress
 
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes. 2020-06-05 not yet calculated CVE-2020-13865
MISC
wso2 — multiple_products
 
In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a Lifecycle. 2020-06-06 not yet calculated CVE-2020-13883
MISC
xack — dns
 
XACK DNS 1.11.0 to 1.11.4, 1.10.0 to 1.10.8, 1.8.0 to 1.8.23, 1.7.0 to 1.7.18, and versions before 1.7.0 allow remote attackers to cause a denial of service condition resulting in degradation of the recursive resolver’s performance or compromising the recursive resolver as a reflector in a reflection attack. 2020-06-05 not yet calculated CVE-2020-5591
MISC
MISC
zephyrproject — zephyr A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions. 2020-06-05 not yet calculated CVE-2020-10063
MISC
MISC
MISC
MISC
MISC
MISC
zephyrproject — zephyr An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions. 2020-06-05 not yet calculated CVE-2020-10062
MISC
MISC
MISC
MISC
zephyrproject — zephyr
 
The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions. 2020-06-05 not yet calculated CVE-2020-10071
MISC
MISC
MISC
MISC
zephyrproject — zephyr
 
In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions. 2020-06-05 not yet calculated CVE-2020-10070
MISC
MISC
MISC
MISC
zephyrproject — zephyr
 
Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions. 2020-06-05 not yet calculated CVE-2020-10061
MISC
MISC
MISC
MISC
MISC
MISC
zephyrproject — zephyr
 
In the Zephyr project Bluetooth subsystem, certain duplicate and back-to-back packets can cause incorrect behavior, resulting in a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions. 2020-06-05 not yet calculated CVE-2020-10068
MISC
MISC
MISC
MISC
MISC
MISC

Back to top

This product is provided subject to this Notification and this Privacy & Use policy.