# CVEs published 2020-07-01

71 CVEs were published on July 1, 2020: 2 critical, 6 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-5238](https://cve.now/CVE-2020-5238.md): Denial of service in table parsing in cmark-gfm (CVSS 6.5, github cmark-gfm)
- [CVE-2020-15500](https://cve.now/CVE-2020-15500.md): An issue was discovered in server.js in TileServer GL through 3.0.0. (no CVSS, tileserver-gl)
- [CVE-2020-15489](https://cve.now/CVE-2020-15489.md): An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. (no CVSS)
- [CVE-2020-15490](https://cve.now/CVE-2020-15490.md): An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. (no CVSS)
- [CVE-2019-15312](https://cve.now/CVE-2019-15312.md): An issue was discovered on Zolo Halo devices via the Linkplay firmware. (no CVSS)
- [CVE-2019-15311](https://cve.now/CVE-2019-15311.md): An issue was discovered on Zolo Halo devices via the Linkplay firmware. (no CVSS)
- [CVE-2019-15310](https://cve.now/CVE-2019-15310.md): An issue was discovered on various devices via the Linkplay firmware. (no CVSS)
- [CVE-2020-14196](https://cve.now/CVE-2020-14196.md): In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not… (no CVSS)
- [CVE-2020-13619](https://cve.now/CVE-2020-13619.md): php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution. (no CVSS, locutus)
- [CVE-2020-7688](https://cve.now/CVE-2020-7688.md): Command Injection (CVSS 8.4, mversion)
- [CVE-2020-14057](https://cve.now/CVE-2020-14057.md): Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. (no CVSS)
- [CVE-2020-14055](https://cve.now/CVE-2020-14055.md): Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output… (no CVSS)
- [CVE-2020-14056](https://cve.now/CVE-2020-14056.md): Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch… (no CVSS)
- [CVE-2020-2500](https://cve.now/CVE-2020-2500.md): This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. (CVSS 9.8, QNAP Systems Helpdesk)
- [CVE-2020-12497](https://cve.now/CVE-2020-12497.md): Phoenix Contact Automation Worx \<= 1.87: stack-based overflow (CVSS 7.8, Phoenix Contact Automation Worx)
- [CVE-2020-12498](https://cve.now/CVE-2020-12498.md): Phoenix Contact Automation Worx \<= 1.87: out-of-bounds read remote code execution (CVSS 7.8, Phoenix Contact Automation Worx)
- [CVE-2020-6089](https://cve.now/CVE-2020-6089.md): An exploitable code execution vulnerability exists in the ANI file format parser of Leadtools 20. (CVSS 8.8, Leadtools)
- [CVE-2020-5907](https://cve.now/CVE-2020-5907.md): In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided… (no CVSS, BIG-IP)
- [CVE-2020-5903](https://cve.now/CVE-2020-5903.md): In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vulnerability exists… (no CVSS, BIG-IP)
- [CVE-2020-5905](https://cve.now/CVE-2020-5905.md): In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network \> WCCP page, the system does not sanitize all user-provided… (no CVSS, BIG-IP)
- [CVE-2020-5904](https://cve.now/CVE-2020-5904.md): In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability… (no CVSS, BIG-IP)
- [CVE-2020-5908](https://cve.now/CVE-2020-5908.md): In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files. (no CVSS, Edge Client for Linux)
- [CVE-2020-12605](https://cve.now/CVE-2020-12605.md): Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field… (no CVSS)
- [CVE-2020-5906](https://cve.now/CVE-2020-5906.md): In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the… (no CVSS, BIG-IP)
- [CVE-2020-4420](https://cve.now/CVE-2020-4420.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker… (CVSS 7.5, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2020-4414](https://cve.now/CVE-2020-4414.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local attacker to perform… (CVSS 5.1, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2020-4387](https://cve.now/CVE-2020-4387.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain… (CVSS 6.2, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2020-4386](https://cve.now/CVE-2020-4386.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain… (CVSS 6.2, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2020-4376](https://cve.now/CVE-2020-4376.md): IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow an attacker to cause a denial of service caused by an error… (CVSS 5.3, IBM MQ for HPE NonStop)
- [CVE-2020-4363](https://cve.now/CVE-2020-4363.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow… (CVSS 8.4, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2020-4355](https://cve.now/CVE-2020-4355.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service… (CVSS 5.3, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2019-4706](https://cve.now/CVE-2019-4706.md): IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable… (CVSS 2.7, IBM Security Identity Manager Virtual Appliance)
- [CVE-2019-4705](https://cve.now/CVE-2019-4705.md): IBM Security Identity Manager Virtual Appliance 7.0.2 discloses sensitive information to unauthorized users. (CVSS 2.7, IBM Security Identity Manager Virtual Appliance)
- [CVE-2019-4704](https://cve.now/CVE-2019-4704.md): IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.7, IBM Security Identity Manager Virtual Appliance)
- [CVE-2019-4676](https://cve.now/CVE-2019-4676.md): IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user. (CVSS 6.3, IBM Security Identity Manager Virtual Appliance)
- [CVE-2020-12604](https://cve.now/CVE-2020-12604.md): Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a… (no CVSS)
- [CVE-2020-13383](https://cve.now/CVE-2020-13383.md): openSIS through 7.4 allows Directory Traversal. (no CVSS)
- [CVE-2020-13382](https://cve.now/CVE-2020-13382.md): openSIS through 7.4 has Incorrect Access Control. (no CVSS)
- [CVE-2020-8663](https://cve.now/CVE-2020-8663.md): Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections. (no CVSS)
- [CVE-2020-13381](https://cve.now/CVE-2020-13381.md): openSIS through 7.4 allows SQL Injection. (no CVSS)
- [CVE-2020-13380](https://cve.now/CVE-2020-13380.md): openSIS before 7.4 allows SQL Injection. (no CVSS)
- [CVE-2020-5901](https://cve.now/CVE-2020-5901.md): In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. (no CVSS, NGINX Controller)
- [CVE-2020-5899](https://cve.now/CVE-2020-5899.md): In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain… (no CVSS, NGINX Controller)
- [CVE-2020-5900](https://cve.now/CVE-2020-5900.md): In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX… (no CVSS, NGINX Controller)
- [CVE-2020-7689](https://cve.now/CVE-2020-7689.md): Insecure Encryption (CVSS 5.9, bcrypt)
- [CVE-2020-12603](https://cve.now/CVE-2020-12603.md): Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with… (no CVSS)
- [CVE-2017-1712](https://cve.now/CVE-2017-1712.md): "A vulnerability in the TLS protocol implementation of the Domino server could allow an unauthenticated, remote attacker to access… (no CVSS, "HCL Domino")
- [CVE-2017-1659](https://cve.now/CVE-2017-1659.md): "HCL iNotes is susceptible to a Cross-Site Scripting (XSS) Vulnerability. (no CVSS, "HCL iNotes")
- [CVE-2020-6261](https://cve.now/CVE-2020-6261.md): SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete… (CVSS 5.3, SAP SE SAP Solution Manager)
- [CVE-2020-15478](https://cve.now/CVE-2020-15478.md): The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors. (no CVSS)
- [CVE-2020-15471](https://cve.now/CVE-2020-15471.md): In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi\_parse\_packet\_line\_info in… (no CVSS)
- [CVE-2020-15472](https://cve.now/CVE-2020-15472.md): In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi\_search\_h323 in lib/protocols/h323.c, as… (no CVSS)
- [CVE-2020-15473](https://cve.now/CVE-2020-15473.md): In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi\_search\_openvpn in lib/protocols/openvpn.c. (no CVSS)
- [CVE-2020-15474](https://cve.now/CVE-2020-15474.md): In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c. (no CVSS)
- [CVE-2020-15475](https://cve.now/CVE-2020-15475.md): In nDPI through 3.2, ndpi\_reset\_packet\_line\_info in lib/ndpi\_main.c omits certain reinitialization, leading to a use-after-free. (no CVSS)
- [CVE-2020-15476](https://cve.now/CVE-2020-15476.md): In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi\_search\_oracle in lib/protocols/oracle.c. (no CVSS)
- [CVE-2020-15470](https://cve.now/CVE-2020-15470.md): ffjpeg through 2020-02-24 has a heap-based buffer overflow in jfif\_decode in jfif.c. (no CVSS)
- [CVE-2020-15468](https://cve.now/CVE-2020-15468.md): Persian VIP Download Script 1.0 allows SQL Injection via the cart\_edit.php active parameter. (no CVSS)
- [CVE-2020-4029](https://cve.now/CVE-2020-4029.md): The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before… (no CVSS, Atlassian Jira Server and Data Center)
- [CVE-2020-4027](https://cve.now/CVE-2020-4027.md): Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass… (no CVSS, Atlassian Confluence Server · Atlassian Confluence Data Cen…)
- [CVE-2020-4025](https://cve.now/CVE-2020-4025.md): The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and… (no CVSS, Atlassian Jira Server and Data Center)
- [CVE-2020-4024](https://cve.now/CVE-2020-4024.md): The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before… (no CVSS, Atlassian Jira Server and Data Center)
- [CVE-2020-4022](https://cve.now/CVE-2020-4022.md): The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before… (no CVSS, Atlassian Jira Server and Data Center)
- [CVE-2020-14169](https://cve.now/CVE-2020-14169.md): The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or… (no CVSS, Atlassian Jira Server and Data Center)
- [CVE-2020-14168](https://cve.now/CVE-2020-14168.md): The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0… (no CVSS, Atlassian Jira Server and Data Center)
- [CVE-2020-14167](https://cve.now/CVE-2020-14167.md): The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2… (no CVSS, Atlassian Jira Server and Data Center)
- [CVE-2020-14166](https://cve.now/CVE-2020-14166.md): The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with… (no CVSS, Atlassian Jira Service Desk Server and Data Center)
- [CVE-2020-14165](https://cve.now/CVE-2020-14165.md): The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain… (no CVSS, Atlassian Jira Server and Data Center)
- [CVE-2020-14164](https://cve.now/CVE-2020-14164.md): The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or… (no CVSS, Atlassian Jira Server and Data Center)
- [CVE-2019-20408](https://cve.now/CVE-2019-20408.md): The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal… (no CVSS, Atlassian Jira Server)
- [CVE-2020-5902](https://cve.now/CVE-2020-5902.md): In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Inte (CVSS 9.8, KEV, BIG-IP)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-07-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.