# CVEs published 2020-06-01

38 CVEs were published on June 1, 2020: 1 critical, 0 high. Days are UTC.

- [CVE-2020-9291](https://cve.now/CVE-2020-9291.md): An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via e (CVSS 6.3, Fortinet FortiClient for Windows)
- [CVE-2019-15709](https://cve.now/CVE-2019-15709.md): An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthor (no CVSS, Fortinet FortiAP-S/W2, FortiAP-U)
- [CVE-2020-13758](https://cve.now/CVE-2020-13758.md): modules/security/classes/general.post\_filter.php/post\_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by (no CVSS)
- [CVE-2020-13757](https://cve.now/CVE-2020-13757.md): Python-RSA before 4.1 ignores leading '\\0' bytes during decryption of ciphertext. (no CVSS, rsa)
- [CVE-2020-13695](https://cve.now/CVE-2020-13695.md): In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as ro (no CVSS)
- [CVE-2014-9702](https://cve.now/CVE-2014-9702.md): system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive (no CVSS)
- [CVE-2014-7173](https://cve.now/CVE-2014-7173.md): FarLinX X25 Gateway through 2014-09-25 allows command injection via shell metacharacters to sysSaveMonitorData.php, fsx25MonProxy.php, sysed (no CVSS)
- [CVE-2014-7175](https://cve.now/CVE-2014-7175.md): FarLinX X25 Gateway through 2014-09-25 allows attackers to write arbitrary data to fsUI.xyz via fsSaveUIPersistence.php. (no CVSS)
- [CVE-2014-7174](https://cve.now/CVE-2014-7174.md): FarLinX X25 Gateway through 2014-09-25 allows directory traversal via the log-handling feature. (no CVSS)
- [CVE-2014-8941](https://cve.now/CVE-2014-8941.md): Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from\_id= or admin.php?page=history&limit= URI. (no CVSS)
- [CVE-2014-8942](https://cve.now/CVE-2014-8942.md): Lexiglot through 2014-11-20 allows CSRF. (no CVSS)
- [CVE-2014-8943](https://cve.now/CVE-2014-8943.md): Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn\_url parameter. (no CVSS)
- [CVE-2014-8944](https://cve.now/CVE-2014-8944.md): Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install\_name, intro\_messa (no CVSS)
- [CVE-2014-8937](https://cve.now/CVE-2014-8937.md): Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resource (no CVSS)
- [CVE-2014-8938](https://cve.now/CVE-2014-8938.md): Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on (no CVSS)
- [CVE-2014-8939](https://cve.now/CVE-2014-8939.md): Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date\_ (no CVSS)
- [CVE-2014-8940](https://cve.now/CVE-2014-8940.md): Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update. (no CVSS)
- [CVE-2014-8945](https://cve.now/CVE-2014-8945.md): admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields. (no CVSS)
- [CVE-2020-12062](https://cve.now/CVE-2020-12062.md): The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a maliciou (no CVSS)
- [CVE-2020-13694](https://cve.now/CVE-2020-13694.md): In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password (no CVSS)
- [CVE-2020-13448](https://cve.now/CVE-2020-13448.md): QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server (no CVSS)
- [CVE-2020-7660](https://cve.now/CVE-2020-7660.md): serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js". (no CVSS, serialize-javascript)
- [CVE-2020-9071](https://cve.now/CVE-2020-9071.md): There is a few bytes out-of-bounds read vulnerability in some Huawei products. (no CVSS, AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;A…)
- [CVE-2020-12867](https://cve.now/CVE-2020-12867.md): A NULL pointer dereference in sanei\_epson\_net\_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local netw (no CVSS)
- [CVE-2019-20805](https://cve.now/CVE-2019-20805.md): p\_lx\_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT\_DYNAMIC segment. (no CVSS)
- [CVE-2020-8967](https://cve.now/CVE-2020-8967.md): GESIO SQL injection vulnerability (CVSS 10.0, Gesio (GESTIÓN INTEGRAL ONLINE, SL) GESIO ERP)
- [CVE-2020-7659](https://cve.now/CVE-2020-7659.md): reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. (no CVSS, reel)
- [CVE-2020-6868](https://cve.now/CVE-2020-6868.md): There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB mana (no CVSS, ZTE F680)
- [CVE-2020-4023](https://cve.now/CVE-2020-4023.md): The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Java (no CVSS, Atlassian Crucible · Atlassian Fisheye)
- [CVE-2020-4021](https://cve.now/CVE-2020-4021.md): Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject a (no CVSS, Atlassian Jira Server and Data Center)
- [CVE-2020-4020](https://cve.now/CVE-2020-4020.md): The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who control a Confluence Ser (no CVSS, Atlassian Companion App)
- [CVE-2020-4019](https://cve.now/CVE-2020-4019.md): The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different ex (no CVSS, Atlassian Companion App)
- [CVE-2020-4018](https://cve.now/CVE-2020-4018.md): The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross (no CVSS, Atlassian Crucible · Atlassian Fisheye)
- [CVE-2020-4017](https://cve.now/CVE-2020-4017.md): The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 al (no CVSS, Atlassian Crucible · Atlassian Fisheye)
- [CVE-2020-4016](https://cve.now/CVE-2020-4016.md): The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows r (no CVSS, Atlassian Crucible · Atlassian Fisheye)
- [CVE-2020-4015](https://cve.now/CVE-2020-4015.md): The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user e (no CVSS, Atlassian Crucible · Atlassian Fisheye)
- [CVE-2020-4014](https://cve.now/CVE-2020-4014.md): The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's (no CVSS, Atlassian Crucible · Atlassian Fisheye)
- [CVE-2020-4013](https://cve.now/CVE-2020-4013.md): The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript vi (no CVSS, Atlassian Crucible · Atlassian Fisheye)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.