# CVEs published 2020-06-16

53 CVEs were published on June 16, 2020: 0 critical, 2 high. Days are UTC.

- [CVE-2020-14214](https://cve.now/CVE-2020-14214.md): Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. (no CVSS)
- [CVE-2020-14213](https://cve.now/CVE-2020-14213.md): In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge). (no CVSS)
- [CVE-2020-4054](https://cve.now/CVE-2020-4054.md): Cross-site Scripting in Sanitize (CVSS 7.3, rgrove Sanitize · sanitize)
- [CVE-2020-4053](https://cve.now/CVE-2020-4053.md): Path Traversal in Helm Plugin Archive (CVSS 3.7, The Helm Project Helm · helm.sh/helm/v3)
- [CVE-2020-14212](https://cve.now/CVE-2020-14212.md): FFmpeg through 4.3 has a heap-based buffer overflow in avio\_get\_str in libavformat/aviobuf.c because dnn\_backend\_native.c calls… (no CVSS)
- [CVE-2020-4052](https://cve.now/CVE-2020-4052.md): Stored XSS through template injection in Wiki.js (CVSS 6.3, Requarks.io Wiki.js)
- [CVE-2020-14210](https://cve.now/CVE-2020-14210.md): Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL… (no CVSS)
- [CVE-2019-17655](https://cve.now/CVE-2019-17655.md): A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy… (CVSS 5.3, Fortinet FortiOS and FortiProxy)
- [CVE-2020-9289](https://cve.now/CVE-2020-9289.md): Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3… (no CVSS, Fortinet FortiManager)
- [CVE-2020-7513](https://cve.now/CVE-2020-7513.md): A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could… (no CVSS, Easergy T300)
- [CVE-2020-7512](https://cve.now/CVE-2020-7512.md): A CWE-1103: Use of Platform-Dependent Third Party Components with vulnerabilities vulnerability exists in Easergy T300 (Firmware version… (no CVSS, Easergy T300)
- [CVE-2020-7511](https://cve.now/CVE-2020-7511.md): A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which… (no CVSS, Easergy T300)
- [CVE-2020-7510](https://cve.now/CVE-2020-7510.md): A CWE-200: Information Exposure vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow attacker to… (no CVSS, Easergy T300)
- [CVE-2020-7509](https://cve.now/CVE-2020-7509.md): A CWE-269: Improper privilege management (write) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow… (no CVSS, Easergy T300)
- [CVE-2020-7508](https://cve.now/CVE-2020-7508.md): A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and… (no CVSS, Easergy T300)
- [CVE-2020-7507](https://cve.now/CVE-2020-7507.md): A CWE-400: Uncontrolled Resource Consumption vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an… (no CVSS, Easergy T300)
- [CVE-2020-7506](https://cve.now/CVE-2020-7506.md): A CWE-200: Information Exposure vulnerability exists in Easergy T300, Firmware V1.5.2 and prior, which could allow an attacker to pack or… (no CVSS, Easergy T300 Firmware V1.5.2 and prior)
- [CVE-2020-7505](https://cve.now/CVE-2020-7505.md): A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could… (no CVSS, Easergy T300)
- [CVE-2020-7504](https://cve.now/CVE-2020-7504.md): A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker… (no CVSS, Easergy T300)
- [CVE-2020-7503](https://cve.now/CVE-2020-7503.md): A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an… (no CVSS, Easergy T300)
- [CVE-2020-13162](https://cve.now/CVE-2020-13162.md): A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for… (CVSS 7.0)
- [CVE-2020-7502](https://cve.now/CVE-2020-7502.md): A CWE-787: Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (Firmware version 4.3 and prior), which may cause a… (no CVSS, Modicon M218 Logic Controller)
- [CVE-2020-7501](https://cve.now/CVE-2020-7501.md): A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2… (no CVSS, Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo D…)
- [CVE-2020-7500](https://cve.now/CVE-2020-7500.md): A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and… (no CVSS, U.motion Servers and Touch Panels)
- [CVE-2020-7499](https://cve.now/CVE-2020-7499.md): A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security… (no CVSS, U.motion Servers and Touch Panels)
- [CVE-2020-7498](https://cve.now/CVE-2020-7498.md): A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). (no CVSS, Unity Loader and OS Loader Software)
- [CVE-2020-7497](https://cve.now/CVE-2020-7497.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator… (no CVSS, EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…)
- [CVE-2020-7496](https://cve.now/CVE-2020-7496.md): A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior… (no CVSS, EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…)
- [CVE-2020-7495](https://cve.now/CVE-2020-7495.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file extraction exists… (no CVSS, EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…)
- [CVE-2020-7494](https://cve.now/CVE-2020-7494.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator… (no CVSS, EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…)
- [CVE-2020-7493](https://cve.now/CVE-2020-7493.md): A CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in EcoStruxure… (no CVSS, EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…)
- [CVE-2020-7492](https://cve.now/CVE-2020-7492.md): A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the… (no CVSS, GP-Pro EX V1.00 to)
- [CVE-2020-10268](https://cve.now/CVE-2020-10268.md): RVD#2550: Terminate Critical Services in KUKA controller KR C4 (no CVSS, KUKA Roboter KR3R540, KRC4, KSS8.5.7HF1, Win7\_Embedded)
- [CVE-2020-14199](https://cve.now/CVE-2020-14199.md): BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into… (no CVSS)
- [CVE-2020-14195](https://cve.now/CVE-2020-14195.md): FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-8544](https://cve.now/CVE-2020-8544.md): OX App Suite through 7.10.3 allows SSRF. (no CVSS)
- [CVE-2020-8541](https://cve.now/CVE-2020-8541.md): OX App Suite through 7.10.3 allows XXE attacks. (no CVSS)
- [CVE-2020-8542](https://cve.now/CVE-2020-8542.md): OX App Suite through 7.10.3 allows XSS. (no CVSS)
- [CVE-2020-8543](https://cve.now/CVE-2020-8543.md): OX App Suite through 7.10.3 has Improper Input Validation. (no CVSS)
- [CVE-2020-4320](https://cve.now/CVE-2020-4320.md): IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the… (CVSS 5.3, IBM MQ)
- [CVE-2020-4310](https://cve.now/CVE-2020-4310.md): IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the… (CVSS 5.9, IBM WebSphere MQ · IBM MQ)
- [CVE-2019-18614](https://cve.now/CVE-2019-18614.md): On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. (no CVSS)
- [CVE-2020-0223](https://cve.now/CVE-2020-0223.md): This is an unbounded write into kernel global memory, via a user-controlled buffer size.Product: AndroidVersions: Android kernelAndroid… (no CVSS, Android)
- [CVE-2020-0235](https://cve.now/CVE-2020-0235.md): In crus\_sp\_shared\_ioctl we first copy 4 bytes from userdata into "size" variable, and then use that variable as the size parameter for… (no CVSS, Android)
- [CVE-2020-0232](https://cve.now/CVE-2020-0232.md): Function abc\_pcie\_issue\_dma\_xfer\_sync creates a transfer object, adds it to the session object then continues to work with it. (no CVSS, Android)
- [CVE-2020-0234](https://cve.now/CVE-2020-0234.md): In crus\_afe\_get\_param of msm-cirrus-playback.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-12494](https://cve.now/CVE-2020-12494.md): Beckhoff: Etherleak in TwinCAT RT network driver (CVSS 5.3, Beckhoff TwinCat Driver for Intel)
- [CVE-2020-9296](https://cve.now/CVE-2020-9296.md): Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. (no CVSS, Netflix Titus · com.netflix.conductor:conductor-core)
- [CVE-2020-11841](https://cve.now/CVE-2020-11841.md): Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x… (no CVSS, ArcSight Management Center.)
- [CVE-2020-11838](https://cve.now/CVE-2020-11838.md): Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x… (no CVSS, ArcSight Management Center.)
- [CVE-2020-11840](https://cve.now/CVE-2020-11840.md): Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x… (no CVSS, ArcSight Management Center.)
- [CVE-2020-9522](https://cve.now/CVE-2020-9522.md): Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, Affecting versions 7.0.x, 7.2… (no CVSS, ArcSight Enterprise Security Manager (ESM).)
- [CVE-2020-13431](https://cve.now/CVE-2020-13431.md): I2P before 0.9.46 allows local users to gain privileges via a Trojan horse I2PSvc.exe file because of weak permissions on a certain… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-06-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.