CVEs published June 1, 2020
38 CVEs were published on June 1, 2020: 1 critical, 0 high.
- Published
- 38
- Critical
- 1
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- Atlassian Crucible · Atlassian Fisheye
- 7
- Atlassian Companion App
- 2
- AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;A…
- 1
- Atlassian Jira Server and Data Center
- 1
- Fortinet FortiAP-S/W2, FortiAP-U
- 1
- Fortinet FortiClient for Windows
- 1
- Gesio (GESTIÓN INTEGRAL ONLINE, SL) GESIO ERP
- 1
- reel
- 1
- rsa
- 1
- serialize-javascript
- 1
Critical 1
Medium, low and unrated 37
- CVE-2020-9291An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via eFortinet FortiClient for Windows
- CVE-2019-15709An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorFortinet FortiAP-S/W2, FortiAP-U
- CVE-2020-13758modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by
- CVE-2020-13757Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext.rsa
- CVE-2020-13695In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as ro
- CVE-2014-9702system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive
- CVE-2014-7173FarLinX X25 Gateway through 2014-09-25 allows command injection via shell metacharacters to sysSaveMonitorData.php, fsx25MonProxy.php, sysed
- CVE-2014-7175FarLinX X25 Gateway through 2014-09-25 allows attackers to write arbitrary data to fsUI.xyz via fsSaveUIPersistence.php.
- CVE-2014-7174FarLinX X25 Gateway through 2014-09-25 allows directory traversal via the log-handling feature.
- CVE-2014-8941Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI.
- CVE-2014-8942Lexiglot through 2014-11-20 allows CSRF.
- CVE-2014-8943Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.
- CVE-2014-8944Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_messa
- CVE-2014-8937Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resource
- CVE-2014-8938Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on
- CVE-2014-8939Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_
- CVE-2014-8940Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.
- CVE-2014-8945admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.
- CVE-2020-12062The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a maliciou
- CVE-2020-13694In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password
- CVE-2020-13448QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server
- CVE-2020-7660serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".serialize-javascript
- CVE-2020-9071There is a few bytes out-of-bounds read vulnerability in some Huawei products.AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;A…
- CVE-2020-12867A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local netw
- CVE-2019-20805p_lx_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT_DYNAMIC segment.
- CVE-2020-7659reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing.reel
- CVE-2020-6868There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB manaZTE F680
- CVE-2020-4023The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or JavaAtlassian Crucible · Atlassian Fisheye
- CVE-2020-4021Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject aAtlassian Jira Server and Data Center
- CVE-2020-4020The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who control a Confluence SerAtlassian Companion App
- CVE-2020-4019The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different exAtlassian Companion App
- CVE-2020-4018The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a crossAtlassian Crucible · Atlassian Fisheye
- CVE-2020-4017The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 alAtlassian Crucible · Atlassian Fisheye
- CVE-2020-4016The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows rAtlassian Crucible · Atlassian Fisheye
- CVE-2020-4015The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user eAtlassian Crucible · Atlassian Fisheye
- CVE-2020-4014The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user'sAtlassian Crucible · Atlassian Fisheye
- CVE-2020-4013The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript viAtlassian Crucible · Atlassian Fisheye