CVEs published June 2, 2020
56 CVEs were published on June 2, 2020: 0 critical, 2 high. 1 is now in CISA KEV.
- Published
- 56
- Critical
- 0
- High
- 2
- Medium
- 6
- Low
- 0
- Unrated
- 48
- Now in CISA KEV
- 1
- Fix available
- 14
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 16
- IBM Planning Analytics Local
- 5
- github.com/grafana/grafana
- 3
- websocket-extensions
- 2
- Atlassian Navigator Links · Atlassian Crucible +1
- 1
- fastecdsa
- 1
- GE Grid Solutions Reason RT Clocks
- 1
- github.com/docker/docker-ce
- 1
- IETF RFC2003 - IP Encapsulation within IP
- 1
- istio.io istio/envoy
- 1
High 2
Medium, low and unrated 54
- CVE-2020-4026The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from vAtlassian Navigator Links · Atlassian Crucible +1
- CVE-2019-20810go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, whic
- CVE-2020-13775ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) if echo-message is no
- CVE-2020-12607An issue was discovered in fastecdsa before 2.1.2.fastecdsa
- CVE-2020-13764common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special cawp-premium/gravityforms
- CVE-2020-13760In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.
- CVE-2020-13761In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modul
- CVE-2020-13762In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.
- CVE-2020-13763In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.
- CVE-2020-12017GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05.GE Grid Solutions Reason RT Clocks
- CVE-2020-7662websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking.websocket-extensions
- CVE-2020-7663websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking.websocket-extensions
- CVE-2020-13759rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obvm-memory
- CVE-2019-11843The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the
- CVE-2018-18625Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen.github.com/grafana/grafana
- CVE-2018-18624Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen.github.com/grafana/grafana
- CVE-2018-18623Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen.github.com/grafana/grafana
- CVE-2020-3645Firmware will hit assert in WLAN firmware If encrypted data length in FILS IE of reassoc response is more than 528 bytes in Snapdragon CompuQualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- CVE-2020-3680A race condition can occur when using the fastrpc memory mapping API.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-3630Possibility of out of bound access while processing the responses from video firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon ConQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-3633Array out of bound may occur while playing mp3 file as no check is there on offset if it is greater than the buffer allocated or not in SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-3641Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto, SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-3623kernel failure due to load failures while running v1 path directly via kernel in Snapdragon Mobile in SM8250, SXR2130Qualcomm Snapdragon Mobile
- CVE-2020-3625When making query to DSP capabilities, Stack out of bounds occurs due to wrong buffer length configured for DSP attributes in Snapdragon AutQualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2020-3616Buffer overflow in display function due to memory copy without checking length of size using strcpy function in Snapdragon Auto, Snapdragon Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-3618NULL exception due to accessing bad pointer while posting events on RT FIFO in Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired InfraQualcomm Snapdragon Compute, Snapdragon Mobile, Snapdragon…
- CVE-2020-3610Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-3615Valid deauth/disassoc frames is dropped in case if RMF is enabled and some rouge peer keep on sending rogue deauth/disassoc frames due to imQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14078Out of bound memory access while processing qpay due to not validating length of the response buffer provided by User.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14087Failure in buffer management while accessing handle for HDR blit when color modes not supported by display in Snapdragon Consumer IOT, SnapdQualcomm Snapdragon Consumer IOT, Snapdragon Mobile, Snapdr…
- CVE-2019-14066Integer overflow in calculating estimated output buffer size when getting a list of installed Feature IDs, Serial Numbers or checking FeaturQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14067Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing side channel issue.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14077Out of bound memory access while processing ese transmit command due to passing Response buffer received from user in Snapdragon Auto, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14053When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where the mode is set to Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14054Improper permissions in XBL_SEC region enable user to update XBL_SEC code and data and divert the RAM dump path to normal cold boot path in Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…
- CVE-2019-14042Out of bound read in in fingerprint application due to requested data assigned to a local buffer without length check in Snapdragon Auto, SnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14043Out of bound read in Fingerprint application due to requested data is being used without length check in Snapdragon Auto, Snapdragon ComputeQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14038Buffer over-read in ADSP parse function due to lack of check for availability of sufficient data payload received in command response in SnaQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14039Out of bound read in adm call back function due to incorrect boundary check for payload in command response in Snapdragon Auto, Snapdragon CQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-17603Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, which allows loc
- CVE-2020-13227An issue was discovered in Sysax Multi Server 6.90.
- CVE-2020-10959resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via mediawiki/core
- CVE-2020-13228An issue was discovered in Sysax Multi Server 6.90.
- CVE-2020-4503IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting.IBM Planning Analytics Local
- CVE-2020-4431IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting.IBM Planning Analytics Local
- CVE-2020-4367IBM Planning Analytics Local 2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiveIBM Planning Analytics Local
- CVE-2020-4366IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting.IBM Planning Analytics Local
- CVE-2020-4360IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting.IBM Planning Analytics Local
- CVE-2020-13229An issue was discovered in Sysax Multi Server 6.90.
- CVE-2020-13401An issue was discovered in Docker Engine before 19.03.11.github.com/docker/docker-ce
- CVE-2020-13754hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
- CVE-2020-13659address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
- CVE-2020-10136IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network trafficIETF RFC2003 - IP Encapsulation within IP
- CVE-2020-10703A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for flibvirt