# CVEs published 2020-07-24

28 CVEs were published on July 24, 2020: 0 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-10614](https://cve.now/CVE-2020-10614.md): In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could… (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-10604](https://cve.now/CVE-2020-10604.md): In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through… (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-10600](https://cve.now/CVE-2020-10600.md): OSIsoft PI System (CVSS 5.9, OSIsoft PI Data Archive)
- [CVE-2020-10602](https://cve.now/CVE-2020-10602.md): In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager due to a race… (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-10606](https://cve.now/CVE-2020-10606.md): In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-10608](https://cve.now/CVE-2020-10608.md): In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI… (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-10610](https://cve.now/CVE-2020-10610.md): In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected… (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-12812](https://cve.now/CVE-2020-12812.md): An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log (CVSS 7.5, KEV, Fortinet FortiOS)
- [CVE-2020-8174](https://cve.now/CVE-2020-8174.md): napi\_get\_value\_string\_\*() allows various kinds of memory corruption in node \< 10.21.0, 12.18.0, and \< 14.4.0. (no CVSS, https://github.com/nodejs/node)
- [CVE-2020-8175](https://cve.now/CVE-2020-8175.md): Uncontrolled resource consumption in \`jpeg-js\` before 0.4.0 may allow attacker to launch denial of service attacks using specially a… (no CVSS, jpeg-js)
- [CVE-2020-8207](https://cve.now/CVE-2020-8207.md): Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the… (no CVSS, Citrix Workspace App for Windows)
- [CVE-2020-15945](https://cve.now/CVE-2020-15945.md): Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG\_traceexec) because it… (no CVSS)
- [CVE-2020-14725](https://cve.now/CVE-2020-14725.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2020-15932](https://cve.now/CVE-2020-15932.md): Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges. (no CVSS)
- [CVE-2020-8326](https://cve.now/CVE-2020-8326.md): An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an… (CVSS 7.3, Lenovo Drivers Management)
- [CVE-2020-8317](https://cve.now/CVE-2020-8317.md): A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated… (CVSS 7.3, Lenovo Drivers Management)
- [CVE-2020-15860](https://cve.now/CVE-2020-15860.md): Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. (no CVSS)
- [CVE-2020-14297](https://cve.now/CVE-2020-14297.md): A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get… (CVSS 6.5, Red Hat wildfly · org.jboss:jboss-ejb-client)
- [CVE-2020-14175](https://cve.now/CVE-2020-14175.md): Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a… (no CVSS, Atlassian Confluence Server)
- [CVE-2020-15918](https://cve.now/CVE-2020-15918.md): Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0. (no CVSS)
- [CVE-2020-15919](https://cve.now/CVE-2020-15919.md): A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0. (no CVSS)
- [CVE-2020-15920](https://cve.now/CVE-2020-15920.md): There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with… (no CVSS)
- [CVE-2020-15921](https://cve.now/CVE-2020-15921.md): Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted… (no CVSS)
- [CVE-2020-15922](https://cve.now/CVE-2020-15922.md): There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with… (no CVSS)
- [CVE-2020-15923](https://cve.now/CVE-2020-15923.md): Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal. (no CVSS)
- [CVE-2020-15924](https://cve.now/CVE-2020-15924.md): There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. (no CVSS)
- [CVE-2020-14307](https://cve.now/CVE-2020-14307.md): A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations… (CVSS 6.5, Red Hat wildfly)
- [CVE-2020-15778](https://cve.now/CVE-2020-15778.md): scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destinat (CVSS 7.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-07-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.