# CVEs published 2020-06-23 27 CVEs were published on June 23, 2020: 1 critical, 1 high. Days are UTC. - [CVE-2020-9480](https://cve.now/CVE-2020-9480.md): In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate)… (no CVSS, Apache Software Foundation Apache Spark · pyspark +1) - [CVE-2020-12033](https://cve.now/CVE-2020-12033.md): In Rockwell Automation FactoryTalk Services Platform, all versions, the redundancy host service (RdcyHost.exe) does not validate supplied… (no CVSS, Rockwell Automation FactoryTalk Services Platform) - [CVE-2020-12021](https://cve.now/CVE-2020-12021.md): In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting… (no CVSS, OSIsoft PI Web API) - [CVE-2020-5367](https://cve.now/CVE-2020-5367.md): Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17… (CVSS 7.4, Dell Unisphere for PowerMax, Unisphere for PowerMax Virtual…) - [CVE-2020-5345](https://cve.now/CVE-2020-5345.md): Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17… (CVSS 6.4, Dell Unisphere for PowerMax) - [CVE-2020-13155](https://cve.now/CVE-2020-13155.md): clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the… (no CVSS, nukeviet/nukeviet) - [CVE-2020-13156](https://cve.now/CVE-2020-13156.md): modules\\users\\admin\\add\_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=user\_add URI. (no CVSS, nukeviet/nukeviet) - [CVE-2020-13157](https://cve.now/CVE-2020-13157.md): modules\\users\\admin\\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI. (no CVSS, nukeviet/nukeviet) - [CVE-2020-14073](https://cve.now/CVE-2020-14073.md): XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. (no CVSS) - [CVE-2020-14974](https://cve.now/CVE-2020-14974.md): The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to unlock a file and kill processes (even ones running as SYSTEM) that… (no CVSS) - [CVE-2020-14975](https://cve.now/CVE-2020-14975.md): The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to delete, move, or copy arbitrary files via IOCTL code 0x222124. (no CVSS) - [CVE-2020-14976](https://cve.now/CVE-2020-14976.md): GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary files because it… (no CVSS) - [CVE-2020-14977](https://cve.now/CVE-2020-14977.md): An issue was discovered in F-Secure SAFE 17.7 on macOS. (no CVSS) - [CVE-2020-14978](https://cve.now/CVE-2020-14978.md): An issue was discovered in F-Secure SAFE 17.7 on macOS. (no CVSS) - [CVE-2020-4188](https://cve.now/CVE-2020-4188.md): IBM Security Guardium 10.6 and 11.1 may use insufficiently random numbers or values in a security context that depends on unpredictable… (CVSS 5.3, IBM Security Guardium) - [CVE-2020-11068](https://cve.now/CVE-2020-11068.md): Potential Buffer Overflow in LoRaMac-node (CVSS 5.0, LoRaMac-node) - [CVE-2020-9438](https://cve.now/CVE-2020-9438.md): Tinxy Door Lock with firmware before 3.2 allow attackers to unlock a door by replaying an Unlock request that occurred when the attacker… (no CVSS) - [CVE-2020-14971](https://cve.now/CVE-2020-14971.md): Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then… (no CVSS) - [CVE-2020-14965](https://cve.now/CVE-2020-14965.md): On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML… (no CVSS) - [CVE-2020-4028](https://cve.now/CVE-2020-4028.md): Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in… (no CVSS, Atlassian Jira Server and Data Center) - [CVE-2020-14993](https://cve.now/CVE-2020-14993.md): A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attackers to execute… (no CVSS) - [CVE-2020-14938](https://cve.now/CVE-2020-14938.md): An issue was discovered in map.c in FreedroidRPG 1.0rc2. (no CVSS) - [CVE-2020-14939](https://cve.now/CVE-2020-14939.md): An issue was discovered in savestruct\_internal.c in FreedroidRPG 1.0rc2. (no CVSS) - [CVE-2020-14940](https://cve.now/CVE-2020-14940.md): An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. (no CVSS) - [CVE-2020-5594](https://cve.now/CVE-2020-5594.md): Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L, and FX series CPU modules all versions contain a vulnerability that allows cleartext… (no CVSS, Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L, and FX series…) - [CVE-2020-12782](https://cve.now/CVE-2020-12782.md): Openfind MailGates - Command Injection (CVSS 9.8, Openfind MailGates · Openfind MailAudit) - [CVE-2019-20409](https://cve.now/CVE-2019-20409.md): The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to… (no CVSS, Atlassian Jira Server) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2020-06-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.