# CVEs published 2020-06-03

127 CVEs were published on June 3, 2020: 3 critical, 20 high. Days are UTC.

- [CVE-2020-7030](https://cve.now/CVE-2020-7030.md): IPO Information Disclosure (CVSS 5.5, Avaya IP Office)
- [CVE-2020-11094](https://cve.now/CVE-2020-11094.md): Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar (CVSS 6.1, rainlab debugbar-plugin · rainlab/debugbar-plugin)
- [CVE-2020-11091](https://cve.now/CVE-2020-11091.md): Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements (CVSS 5.8, weaveworks Weave · github.com/weaveworks/weave)
- [CVE-2020-6504](https://cve.now/CVE-2020-6504.md): Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass notification… (no CVSS, Google Chrome)
- [CVE-2020-6502](https://cve.now/CVE-2020-6502.md): Incorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a… (no CVSS, Google Chrome)
- [CVE-2020-6503](https://cve.now/CVE-2020-6503.md): Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially… (no CVSS, Google Chrome)
- [CVE-2020-6500](https://cve.now/CVE-2020-6500.md): Inappropriate implementation in interstitials in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of… (no CVSS, Google Chrome)
- [CVE-2020-6501](https://cve.now/CVE-2020-6501.md): Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy… (no CVSS, Google Chrome)
- [CVE-2020-6497](https://cve.now/CVE-2020-6497.md): Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain… (no CVSS, Google Chrome)
- [CVE-2020-6498](https://cve.now/CVE-2020-6498.md): Incorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain… (no CVSS, Google Chrome)
- [CVE-2020-6499](https://cve.now/CVE-2020-6499.md): Inappropriate implementation in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass AppCache security… (no CVSS, Google Chrome)
- [CVE-2020-6495](https://cve.now/CVE-2020-6495.md): Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to… (no CVSS, Google Chrome)
- [CVE-2020-6496](https://cve.now/CVE-2020-6496.md): Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox… (no CVSS, Google Chrome)
- [CVE-2020-6493](https://cve.now/CVE-2020-6493.md): Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer… (no CVSS, Google Chrome)
- [CVE-2020-6494](https://cve.now/CVE-2020-6494.md): Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof the contents of the… (no CVSS, Google Chrome)
- [CVE-2020-6419](https://cve.now/CVE-2020-6419.md): Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a… (no CVSS, Google Chrome)
- [CVE-2020-6453](https://cve.now/CVE-2020-6453.md): Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap… (no CVSS, Google Chrome)
- [CVE-2011-1805](https://cve.now/CVE-2011-1805.md): Bad cast in CSS in Google Chrome prior to 11.0.0.0 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (no CVSS, Google Chrome)
- [CVE-2011-2863](https://cve.now/CVE-2011-2863.md): Insufficient policy enforcement in V8 in Google Chrome prior to 14.0.0.0 allowed a remote attacker to obtain potentially sensitive… (no CVSS, Google Chrome)
- [CVE-2020-5299](https://cve.now/CVE-2020-5299.md): Potential CSV Injection vector in OctoberCMS (CVSS 4.0, octobercms october · october/backend)
- [CVE-2020-5296](https://cve.now/CVE-2020-5296.md): Arbitrary File Deletion vulnerability in OctoberCMS (CVSS 6.2, octobercms october · october/cms)
- [CVE-2020-5297](https://cve.now/CVE-2020-5297.md): Upload whitelisted files to any directory in OctoberCMS (CVSS 3.4, octobercms october · october/cms)
- [CVE-2020-5298](https://cve.now/CVE-2020-5298.md): Reflected XSS when importing CSV in OctoberCMS (CVSS 4.0, octobercms october · october/backend)
- [CVE-2020-5295](https://cve.now/CVE-2020-5295.md): Local File read vulnerability in OctoberCMS (CVSS 4.8, octobercms october · october/cms)
- [CVE-2020-13795](https://cve.now/CVE-2020-13795.md): An issue was discovered in Navigate CMS through 2.8.7. (no CVSS)
- [CVE-2020-13796](https://cve.now/CVE-2020-13796.md): An issue was discovered in Navigate CMS through 2.8.7. (no CVSS)
- [CVE-2020-13797](https://cve.now/CVE-2020-13797.md): An issue was discovered in Navigate CMS through 2.8.7. (no CVSS)
- [CVE-2020-13798](https://cve.now/CVE-2020-13798.md): An issue was discovered in Navigate CMS through 2.8.7. (no CVSS)
- [CVE-2020-13792](https://cve.now/CVE-2020-13792.md): PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local… (no CVSS)
- [CVE-2020-13790](https://cve.now/CVE-2020-13790.md): libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get\_rgb\_row() in rdppm.c via a malformed PPM input file. (no CVSS)
- [CVE-2020-13379](https://cve.now/CVE-2020-13379.md): The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. (no CVSS, github.com/grafana/grafana)
- [CVE-2020-3353](https://cve.now/CVE-2020-3353.md): Cisco Identity Services Engine Denial of Service Vulnerability (CVSS 5.9, Cisco Identity Services Engine Software)
- [CVE-2020-3339](https://cve.now/CVE-2020-3339.md): Cisco Prime Infrastructure SQL Injection Vulnerability (CVSS 5.4, Cisco Prime Infrastructure)
- [CVE-2020-3335](https://cve.now/CVE-2020-3335.md): Cisco Application Services Engine Software Authorization Vulnerability (CVSS 5.5, Cisco Application Policy Infrastructure Controller)
- [CVE-2020-3333](https://cve.now/CVE-2020-3333.md): Cisco Application Services Engine Software Unauthenticated Event Policies Update Vulnerability (CVSS 5.3, Cisco Application Policy Infrastructure Controller)
- [CVE-2020-3281](https://cve.now/CVE-2020-3281.md): Cisco Digital Network Architecture Center Information Disclosure Vulnerability (CVSS 4.3, Cisco Digital Network Architecture Center)
- [CVE-2020-3267](https://cve.now/CVE-2020-3267.md): Cisco Unified Contact Center Express Improper API Authorization Vulnerability (CVSS 5.4, Cisco Unified Contact Center Express)
- [CVE-2020-3258](https://cve.now/CVE-2020-3258.md): Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution Vulnerabilities (CVSS 9.8, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3257](https://cve.now/CVE-2020-3257.md): Cisco IOx Application Environment for IOS Software for Cisco Industrial Routers Vulnerabilities (CVSS 8.1, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3238](https://cve.now/CVE-2020-3238.md): Cisco IOx Application Framework Arbitrary File Creation Vulnerability (CVSS 8.1, Cisco IOx)
- [CVE-2020-3237](https://cve.now/CVE-2020-3237.md): Cisco IOx Application Framework Arbitrary File Overwrite Vulnerability (CVSS 6.3, Cisco IOx)
- [CVE-2020-3235](https://cve.now/CVE-2020-3235.md): Cisco IOS and IOS XE Software Simple Network Management Protocol Denial of Service Vulnerability (CVSS 7.7, Cisco IOS 12.2(53)SG1)
- [CVE-2020-3234](https://cve.now/CVE-2020-3234.md): Cisco IOS Software for Cisco Industrial Routers Virtual Device Server Static Credentials Vulnerability (CVSS 8.8, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-7013](https://cve.now/CVE-2020-7013.md): Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. (no CVSS, Elastic Kibana)
- [CVE-2020-7014](https://cve.now/CVE-2020-7014.md): The fix for CVE-2020-7009 was found to be incomplete. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2020-7015](https://cve.now/CVE-2020-7015.md): Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. (no CVSS, Elastic Kibana)
- [CVE-2020-7011](https://cve.now/CVE-2020-7011.md): Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. (no CVSS, Elastic App Search)
- [CVE-2020-7012](https://cve.now/CVE-2020-7012.md): Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. (no CVSS, Elastic Kibana)
- [CVE-2020-7010](https://cve.now/CVE-2020-7010.md): Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. (no CVSS, Elastic Cloud on Kubernetes · github.com/elastic/cloud-on-k…)
- [CVE-2020-3233](https://cve.now/CVE-2020-3233.md): Cisco IOx Application Framework Local Manager Stored Cross-Site Scripting Vulnerability (CVSS 6.4, Cisco IOx)
- [CVE-2020-3232](https://cve.now/CVE-2020-3232.md): Cisco ASR 920 Series Aggregation Services Router Model 12SZ-IM SNMP Denial of Service Vulnerability (CVSS 6.3, Cisco ASR 920 Series Aggregation Services Router)
- [CVE-2020-3200](https://cve.now/CVE-2020-3200.md): Cisco IOS and IOS XE Software Secure Shell Denial of Service Vulnerability (CVSS 7.7, Cisco IOS 12.2(58)SE)
- [CVE-2020-3199](https://cve.now/CVE-2020-3199.md): Cisco IOx Application Environment for IOS Software for Cisco Industrial Routers Vulnerabilities (CVSS 8.1, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3198](https://cve.now/CVE-2020-3198.md): Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution Vulnerabilities (CVSS 9.8, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3228](https://cve.now/CVE-2020-3228.md): Cisco IOS, IOS XE, and NX-OS Software Security Group Tag Exchange Protocol Denial of Service Vulnerability (CVSS 6.8, Cisco IOS 15.3(2)T)
- [CVE-2020-3231](https://cve.now/CVE-2020-3231.md): Cisco IOS Software for Catalyst 2960-L Series Switches and Catalyst CDB-8P Switches 802.1X Authentication Bypass Vulnerability (CVSS 4.7, Cisco IOS 15.2(5a)E)
- [CVE-2020-3230](https://cve.now/CVE-2020-3230.md): Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerability (CVSS 7.5, Cisco IOS 15.1(2)T)
- [CVE-2020-3229](https://cve.now/CVE-2020-3229.md): Cisco IOS XE Software Web UI Privilege Escalation Vulnerability (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2020-3227](https://cve.now/CVE-2020-3227.md): Cisco IOx for IOS XE Software Privilege Escalation Vulnerability (CVSS 9.8, Cisco IOS XE Software)
- [CVE-2020-3226](https://cve.now/CVE-2020-3226.md): Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service Vulnerability (CVSS 8.6, Cisco IOS 15.0(2)SG11a)
- [CVE-2020-3225](https://cve.now/CVE-2020-3225.md): Cisco IOS and IOS XE Software Common Industrial Protocol Denial of Service Vulnerabilities (CVSS 8.6, Cisco IOS 12.2(55)SE)
- [CVE-2020-3224](https://cve.now/CVE-2020-3224.md): Cisco IOS XE Software Web UI Command Injection Vulnerability (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2020-3223](https://cve.now/CVE-2020-3223.md): Cisco IOS XE Software Web UI Arbitrary File Read Vulnerability (CVSS 4.5, Cisco IOS XE Software)
- [CVE-2020-3222](https://cve.now/CVE-2020-3222.md): Cisco IOS XE Software Web UI Unauthenticated Proxy Service Vulnerability (CVSS 4.3, Cisco IOS XE Software)
- [CVE-2020-3221](https://cve.now/CVE-2020-3221.md): Cisco IOS XE Software Flexible NetFlow Version 9 Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2020-3220](https://cve.now/CVE-2020-3220.md): Cisco IOS XE Software IPsec VPN Denial of Service Vulnerability (CVSS 6.8, Cisco IOS XE Software)
- [CVE-2020-3219](https://cve.now/CVE-2020-3219.md): Cisco IOS XE Software Web UI Command Injection Vulnerability (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2020-3218](https://cve.now/CVE-2020-3218.md): Cisco IOS XE Software Web UI Remote Code Execution Vulnerability (CVSS 7.2, Cisco IOS XE Software)
- [CVE-2020-3217](https://cve.now/CVE-2020-3217.md): Cisco IOS, IOS XE, IOS XR, and NX-OS Software One Platform Kit Remote Code Execution Vulnerability (CVSS 8.8, Cisco IOS XR Software)
- [CVE-2020-3216](https://cve.now/CVE-2020-3216.md): Cisco IOS XE SD-WAN Software Authentication Bypass Vulnerability (CVSS 6.8, Cisco IOS XE SD-WAN Software)
- [CVE-2020-3215](https://cve.now/CVE-2020-3215.md): Cisco IOS XE Software Privilege Escalation Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2020-3214](https://cve.now/CVE-2020-3214.md): Cisco IOS XE Software Privilege Escalation Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2020-3213](https://cve.now/CVE-2020-3213.md): Cisco IOS XE Software Privilege Escalation Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2020-3212](https://cve.now/CVE-2020-3212.md): Cisco IOS XE Software Web UI Command Injection Vulnerability (CVSS 7.2, Cisco IOS XE Software)
- [CVE-2020-3211](https://cve.now/CVE-2020-3211.md): Cisco IOS XE Software Web UI Command Injection Vulnerability (CVSS 7.2, Cisco IOS XE Software)
- [CVE-2020-3210](https://cve.now/CVE-2020-3210.md): Cisco IOS Software for Cisco Industrial Routers Virtual Device Server CLI Command Injection Vulnerability (CVSS 6.7, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3209](https://cve.now/CVE-2020-3209.md): Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability (CVSS 6.8, Cisco IOS XE Software 3.2.0SG)
- [CVE-2020-3208](https://cve.now/CVE-2020-3208.md): Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Image Verification Bypass Vulnerability (CVSS 6.7, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3207](https://cve.now/CVE-2020-3207.md): Cisco IOS XE Software Command Injection Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2020-3206](https://cve.now/CVE-2020-3206.md): Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service Vulnerability (CVSS 4.7, Cisco IOS XE Software)
- [CVE-2020-3205](https://cve.now/CVE-2020-3205.md): Cisco IOS Software for Cisco Industrial Routers Virtual Device Server Inter-VM Channel Command Injection Vulnerability (CVSS 8.8, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3204](https://cve.now/CVE-2020-3204.md): Cisco IOS and IOS XE Software Tcl Arbitrary Code Execution Vulnerability (CVSS 6.7, Cisco IOS 12.2(53)SE1)
- [CVE-2020-3203](https://cve.now/CVE-2020-3203.md): Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2020-3201](https://cve.now/CVE-2020-3201.md): Cisco IOS and IOS XE Software Tcl Denial of Service Vulnerability (CVSS 6.0, Cisco IOS 12.2(25)S)
- [CVE-2020-3322](https://cve.now/CVE-2020-3322.md): Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerability (CVSS 3.3, Cisco Webex Network Recording Player · Cisco Webex Player f…)
- [CVE-2020-3321](https://cve.now/CVE-2020-3321.md): Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerability (CVSS 3.3, Cisco Webex Network Recording Player · Cisco Webex Player f…)
- [CVE-2020-3319](https://cve.now/CVE-2020-3319.md): Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerability (CVSS 3.3, Cisco Webex Network Recording Player · Cisco Webex Player f…)
- [CVE-2019-20809](https://cve.now/CVE-2019-20809.md): The price oracle in PriceOracle.sol in Compound Finance Compound Price Oracle 1.0 through 2.0 allows a price poster to set an invalid… (no CVSS)
- [CVE-2020-4035](https://cve.now/CVE-2020-4035.md): DoS or local data modification via malicious record IDs in WatermelonDB (CVSS 5.9, Nozbe WatermelonDB · @nozbe/watermelondb)
- [CVE-2020-13597](https://cve.now/CVE-2020-13597.md): Calico nodes IPv6 traffic redirection from route advertisment (CVSS 6.0, Tigera Calico · github.com/projectcalico/calico)
- [CVE-2020-13782](https://cve.now/CVE-2020-13782.md): D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection. (no CVSS)
- [CVE-2020-13783](https://cve.now/CVE-2020-13783.md): D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information. (no CVSS)
- [CVE-2020-13784](https://cve.now/CVE-2020-13784.md): D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator. (no CVSS)
- [CVE-2020-13785](https://cve.now/CVE-2020-13785.md): D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength. (no CVSS)
- [CVE-2020-13786](https://cve.now/CVE-2020-13786.md): D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF. (no CVSS)
- [CVE-2020-13787](https://cve.now/CVE-2020-13787.md): D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information. (no CVSS)
- [CVE-2020-12846](https://cve.now/CVE-2020-12846.md): Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. (no CVSS)
- [CVE-2020-4307](https://cve.now/CVE-2020-4307.md): IBM Security Guardium 11.1 could allow an attacker on the same network to gain access to the Solr dashboard and cause a denial of service… (CVSS 6.5, IBM Security Guardium)
- [CVE-2020-4190](https://cve.now/CVE-2020-4190.md): IBM Security Guardium 10.6, 11.0, and 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its… (CVSS 4.1, IBM Security Guardium)
- [CVE-2020-4187](https://cve.now/CVE-2020-4187.md): IBM Security Guardium 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. (CVSS 5.3, IBM Security Guardium)
- [CVE-2020-4182](https://cve.now/CVE-2020-4182.md): IBM Security Guardium 11.1 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Guardium)
- [CVE-2020-4180](https://cve.now/CVE-2020-4180.md): IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. (CVSS 8.8, IBM Security Guardium)
- [CVE-2020-4177](https://cve.now/CVE-2020-4177.md): IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound… (CVSS 6.8, IBM Security Guardium)
- [CVE-2020-13756](https://cve.now/CVE-2020-13756.md): Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function… (no CVSS, sabberworm/php-css-parser)
- [CVE-2020-10749](https://cve.now/CVE-2020-10749.md): A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in… (CVSS 6.0, Red Hat containernetworking/plugins · github.com/containern…)
- [CVE-2020-10516](https://cve.now/CVE-2020-10516.md): Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member (no CVSS, GitHub Enterprise Server)
- [CVE-2020-13596](https://cve.now/CVE-2020-13596.md): An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. (no CVSS, django)
- [CVE-2020-13254](https://cve.now/CVE-2020-13254.md): An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. (no CVSS, django)
- [CVE-2020-1963](https://cve.now/CVE-2020-1963.md): Apache Ignite uses H2 database to build SQL distributed execution engine. (no CVSS, Apache Ignite · org.apache.ignite:ignite-core)
- [CVE-2020-7116](https://cve.now/CVE-2020-7116.md): The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. (no CVSS, ClearPass Policy Manager)
- [CVE-2020-7117](https://cve.now/CVE-2020-7117.md): The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. (no CVSS, ClearPass Policy Manager)
- [CVE-2020-7115](https://cve.now/CVE-2020-7115.md): The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. (no CVSS, ClearPass Policy Manager)
- [CVE-2020-2200](https://cve.now/CVE-2020-2200.md): Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the \`play\` command on the Jenkins master for a form… (no CVSS, Jenkins project Jenkins Play Framework Plugin · org.jenkins…)
- [CVE-2020-2197](https://cve.now/CVE-2020-2197.md): Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance… (no CVSS, Jenkins Project Inheritance Plugin · hudson.plugins:project…)
- [CVE-2020-2198](https://cve.now/CVE-2020-2198.md): Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when… (no CVSS, Jenkins Project Inheritance Plugin · hudson.plugins:project…)
- [CVE-2020-2199](https://cve.now/CVE-2020-2199.md): Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form… (no CVSS, Jenkins project Jenkins Subversion Partial Release Manager…)
- [CVE-2020-2195](https://cve.now/CVE-2020-2195.md): Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site… (no CVSS, Jenkins project Jenkins Compact Columns Plugin · org.jenkin…)
- [CVE-2020-2196](https://cve.now/CVE-2020-2196.md): Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all… (no CVSS, Jenkins project Jenkins Selenium Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2193](https://cve.now/CVE-2020-2193.md): Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored… (no CVSS, Jenkins project Jenkins ECharts API Plugin · io.jenkins.plu…)
- [CVE-2020-2194](https://cve.now/CVE-2020-2194.md): Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored… (no CVSS, Jenkins project Jenkins ECharts API Plugin · io.jenkins.plu…)
- [CVE-2020-2190](https://cve.now/CVE-2020-2190.md): Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script… (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2020-2191](https://cve.now/CVE-2020-2191.md): Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and… (no CVSS, Jenkins project Jenkins Self-Organizing Swarm Plug-in Modul…)
- [CVE-2020-2192](https://cve.now/CVE-2020-2192.md): A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to… (no CVSS, Jenkins project Jenkins Self-Organizing Swarm Plug-in Modul…)
- [CVE-2019-20811](https://cve.now/CVE-2019-20811.md): An issue was discovered in the Linux kernel before 5.0.6. (no CVSS)
- [CVE-2019-20812](https://cve.now/CVE-2019-20812.md): An issue was discovered in the Linux kernel before 5.4.7. (no CVSS)
- [CVE-2020-13776](https://cve.now/CVE-2020-13776.md): systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by (CVSS 6.7)
- [CVE-2020-11080](https://cve.now/CVE-2020-11080.md): Denial of service in nghttp2 (CVSS 3.7, nghttp2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-06-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.