CVEs published June 3, 2020
127 CVEs were published on June 3, 2020: 3 critical, 20 high.
- Published
- 127
- Critical
- 3
- High
- 20
- Medium
- 41
- Low
- 5
- Unrated
- 58
- Now in CISA KEV
- 0
- Fix available
- 45
Most affected products
- Cisco IOS XE Software
- 17
- Google Chrome
- 16
- Cisco IOS 12.2(60)EZ16
- 8
- IBM Security Guardium
- 6
- Cisco IOx
- 3
- Cisco Webex Network Recording Player · Cisco Webex Player f…
- 3
- ClearPass Policy Manager
- 3
- Elastic Kibana
- 3
- octobercms october · october/cms
- 3
- Cisco Application Policy Infrastructure Controller
- 2
Critical 3
- CVE-2020-3258Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution VulnerabilitiesCisco IOS 12.2(60)EZ16
- CVE-2020-3198Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution VulnerabilitiesCisco IOS 12.2(60)EZ16
- CVE-2020-3227Cisco IOx for IOS XE Software Privilege Escalation VulnerabilityCisco IOS XE Software
High 20
- CVE-2020-3257Cisco IOx Application Environment for IOS Software for Cisco Industrial Routers VulnerabilitiesCisco IOS 12.2(60)EZ16
- CVE-2020-3238Cisco IOx Application Framework Arbitrary File Creation VulnerabilityCisco IOx
- CVE-2020-3235Cisco IOS and IOS XE Software Simple Network Management Protocol Denial of Service VulnerabilityCisco IOS 12.2(53)SG1
- CVE-2020-3234Cisco IOS Software for Cisco Industrial Routers Virtual Device Server Static Credentials VulnerabilityCisco IOS 12.2(60)EZ16
- CVE-2020-3200Cisco IOS and IOS XE Software Secure Shell Denial of Service VulnerabilityCisco IOS 12.2(58)SE
- CVE-2020-3199Cisco IOx Application Environment for IOS Software for Cisco Industrial Routers VulnerabilitiesCisco IOS 12.2(60)EZ16
- CVE-2020-3230Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service VulnerabilityCisco IOS 15.1(2)T
- CVE-2020-3229Cisco IOS XE Software Web UI Privilege Escalation VulnerabilityCisco IOS XE Software
- CVE-2020-3226Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service VulnerabilityCisco IOS 15.0(2)SG11a
- CVE-2020-3225Cisco IOS and IOS XE Software Common Industrial Protocol Denial of Service VulnerabilitiesCisco IOS 12.2(55)SE
- CVE-2020-3224Cisco IOS XE Software Web UI Command Injection VulnerabilityCisco IOS XE Software
- CVE-2020-3221Cisco IOS XE Software Flexible NetFlow Version 9 Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3219Cisco IOS XE Software Web UI Command Injection VulnerabilityCisco IOS XE Software
- CVE-2020-3218Cisco IOS XE Software Web UI Remote Code Execution VulnerabilityCisco IOS XE Software
- CVE-2020-3217Cisco IOS, IOS XE, IOS XR, and NX-OS Software One Platform Kit Remote Code Execution VulnerabilityCisco IOS XR Software
- CVE-2020-3212Cisco IOS XE Software Web UI Command Injection VulnerabilityCisco IOS XE Software
- CVE-2020-3211Cisco IOS XE Software Web UI Command Injection VulnerabilityCisco IOS XE Software
- CVE-2020-3205Cisco IOS Software for Cisco Industrial Routers Virtual Device Server Inter-VM Channel Command Injection VulnerabilityCisco IOS 12.2(60)EZ16
- CVE-2020-3203Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-4180IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system.IBM Security Guardium
Medium, low and unrated 104
- CVE-2020-7030IPO Information DisclosureAvaya IP Office
- CVE-2020-11094Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbarrainlab debugbar-plugin · rainlab/debugbar-plugin
- CVE-2020-11091Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisementsweaveworks Weave · github.com/weaveworks/weave
- CVE-2020-6504Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass notification reGoogle Chrome
- CVE-2020-6502Incorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted Google Chrome
- CVE-2020-6503Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitGoogle Chrome
- CVE-2020-6500Inappropriate implementation in interstitials in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Google Chrome
- CVE-2020-6501Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy viGoogle Chrome
- CVE-2020-6497Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofinGoogle Chrome
- CVE-2020-6498Incorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofinGoogle Chrome
- CVE-2020-6499Inappropriate implementation in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass AppCache security restriGoogle Chrome
- CVE-2020-6495Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to instalGoogle Chrome
- CVE-2020-6496Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escapeGoogle Chrome
- CVE-2020-6493Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2020-6494Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof the contents of the OGoogle Chrome
- CVE-2020-6419Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2020-6453Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2011-1805Bad cast in CSS in Google Chrome prior to 11.0.0.0 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google Chrome
- CVE-2011-2863Insufficient policy enforcement in V8 in Google Chrome prior to 14.0.0.0 allowed a remote attacker to obtain potentially sensitive informatiGoogle Chrome
- CVE-2020-5299Potential CSV Injection vector in OctoberCMSoctobercms october · october/backend
- CVE-2020-5296Arbitrary File Deletion vulnerability in OctoberCMSoctobercms october · october/cms
- CVE-2020-5297Upload whitelisted files to any directory in OctoberCMSoctobercms october · october/cms
- CVE-2020-5298Reflected XSS when importing CSV in OctoberCMSoctobercms october · october/backend
- CVE-2020-5295Local File read vulnerability in OctoberCMSoctobercms october · october/cms
- CVE-2020-13795An issue was discovered in Navigate CMS through 2.8.7.
- CVE-2020-13796An issue was discovered in Navigate CMS through 2.8.7.
- CVE-2020-13797An issue was discovered in Navigate CMS through 2.8.7.
- CVE-2020-13798An issue was discovered in Navigate CMS through 2.8.7.
- CVE-2020-13792PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local fi
- CVE-2020-13790libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.
- CVE-2020-13379The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue.github.com/grafana/grafana
- CVE-2020-3353Cisco Identity Services Engine Denial of Service VulnerabilityCisco Identity Services Engine Software
- CVE-2020-3339Cisco Prime Infrastructure SQL Injection VulnerabilityCisco Prime Infrastructure
- CVE-2020-3335Cisco Application Services Engine Software Authorization VulnerabilityCisco Application Policy Infrastructure Controller
- CVE-2020-3333Cisco Application Services Engine Software Unauthenticated Event Policies Update VulnerabilityCisco Application Policy Infrastructure Controller
- CVE-2020-3281Cisco Digital Network Architecture Center Information Disclosure VulnerabilityCisco Digital Network Architecture Center
- CVE-2020-3267Cisco Unified Contact Center Express Improper API Authorization VulnerabilityCisco Unified Contact Center Express
- CVE-2020-3237Cisco IOx Application Framework Arbitrary File Overwrite VulnerabilityCisco IOx
- CVE-2020-7013Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB.Elastic Kibana
- CVE-2020-7014The fix for CVE-2020-7009 was found to be incomplete.Elasticsearch · org.elasticsearch:elasticsearch
- CVE-2020-7015Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization.Elastic Kibana
- CVE-2020-7011Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI.Elastic App Search
- CVE-2020-7012Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant.Elastic Kibana
- CVE-2020-7010Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator.Elastic Cloud on Kubernetes · github.com/elastic/cloud-on-k…
- CVE-2020-3233Cisco IOx Application Framework Local Manager Stored Cross-Site Scripting VulnerabilityCisco IOx
- CVE-2020-3232Cisco ASR 920 Series Aggregation Services Router Model 12SZ-IM SNMP Denial of Service VulnerabilityCisco ASR 920 Series Aggregation Services Router
- CVE-2020-3228Cisco IOS, IOS XE, and NX-OS Software Security Group Tag Exchange Protocol Denial of Service VulnerabilityCisco IOS 15.3(2)T
- CVE-2020-3231Cisco IOS Software for Catalyst 2960-L Series Switches and Catalyst CDB-8P Switches 802.1X Authentication Bypass VulnerabilityCisco IOS 15.2(5a)E
- CVE-2020-3223Cisco IOS XE Software Web UI Arbitrary File Read VulnerabilityCisco IOS XE Software
- CVE-2020-3222Cisco IOS XE Software Web UI Unauthenticated Proxy Service VulnerabilityCisco IOS XE Software
- CVE-2020-3220Cisco IOS XE Software IPsec VPN Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3216Cisco IOS XE SD-WAN Software Authentication Bypass VulnerabilityCisco IOS XE SD-WAN Software
- CVE-2020-3215Cisco IOS XE Software Privilege Escalation VulnerabilityCisco IOS XE Software
- CVE-2020-3214Cisco IOS XE Software Privilege Escalation VulnerabilityCisco IOS XE Software
- CVE-2020-3213Cisco IOS XE Software Privilege Escalation VulnerabilityCisco IOS XE Software
- CVE-2020-3210Cisco IOS Software for Cisco Industrial Routers Virtual Device Server CLI Command Injection VulnerabilityCisco IOS 12.2(60)EZ16
- CVE-2020-3209Cisco IOS XE Software Digital Signature Verification Bypass VulnerabilityCisco IOS XE Software 3.2.0SG
- CVE-2020-3208Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Image Verification Bypass VulnerabilityCisco IOS 12.2(60)EZ16
- CVE-2020-3207Cisco IOS XE Software Command Injection VulnerabilityCisco IOS XE Software
- CVE-2020-3206Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2020-3204Cisco IOS and IOS XE Software Tcl Arbitrary Code Execution VulnerabilityCisco IOS 12.2(53)SE1
- CVE-2020-3201Cisco IOS and IOS XE Software Tcl Denial of Service VulnerabilityCisco IOS 12.2(25)S
- CVE-2020-3322Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service VulnerabilityCisco Webex Network Recording Player · Cisco Webex Player f…
- CVE-2020-3321Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service VulnerabilityCisco Webex Network Recording Player · Cisco Webex Player f…
- CVE-2020-3319Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service VulnerabilityCisco Webex Network Recording Player · Cisco Webex Player f…
- CVE-2019-20809The price oracle in PriceOracle.sol in Compound Finance Compound Price Oracle 1.0 through 2.0 allows a price poster to set an invalid asset
- CVE-2020-4035DoS or local data modification via malicious record IDs in WatermelonDBNozbe WatermelonDB · @nozbe/watermelondb
- CVE-2020-13597Calico nodes IPv6 traffic redirection from route advertismentTigera Calico · github.com/projectcalico/calico
- CVE-2020-13782D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection.
- CVE-2020-13783D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information.
- CVE-2020-13784D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.
- CVE-2020-13785D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength.
- CVE-2020-13786D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF.
- CVE-2020-13787D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information.
- CVE-2020-12846Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file.
- CVE-2020-4307IBM Security Guardium 11.1 could allow an attacker on the same network to gain access to the Solr dashboard and cause a denial of service atIBM Security Guardium
- CVE-2020-4190IBM Security Guardium 10.6, 11.0, and 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its oIBM Security Guardium
- CVE-2020-4187IBM Security Guardium 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system.IBM Security Guardium
- CVE-2020-4182IBM Security Guardium 11.1 is vulnerable to cross-site scripting.IBM Security Guardium
- CVE-2020-4177IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound autheIBM Security Guardium
- CVE-2020-13756Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectosabberworm/php-css-parser
- CVE-2020-10749A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in KuberneteRed Hat containernetworking/plugins · github.com/containern…
- CVE-2020-10516Improper access control in GitHub Enterprise Server leading to privilege escalation of organization memberGitHub Enterprise Server
- CVE-2020-13596An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7.django
- CVE-2020-13254An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7.django
- CVE-2020-1963Apache Ignite uses H2 database to build SQL distributed execution engine.Apache Ignite · org.apache.ignite:ignite-core
- CVE-2020-7116The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution.ClearPass Policy Manager
- CVE-2020-7117The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution.ClearPass Policy Manager
- CVE-2020-7115The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass.ClearPass Policy Manager
- CVE-2020-2200Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validatioJenkins project Jenkins Play Framework Plugin · org.jenkins…
- CVE-2020-2197Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance ProJenkins Project Inheritance Plugin · hudson.plugins:project…
- CVE-2020-2198Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting Jenkins Project Inheritance Plugin · hudson.plugins:project…
- CVE-2020-2199Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form valiJenkins project Jenkins Subversion Partial Release Manager…
- CVE-2020-2195Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripJenkins project Jenkins Compact Columns Plugin · org.jenkin…
- CVE-2020-2196Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrativeJenkins project Jenkins Selenium Plugin · org.jenkins-ci.pl…
- CVE-2020-2193Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-siteJenkins project Jenkins ECharts API Plugin · io.jenkins.plu…
- CVE-2020-2194Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored crosJenkins project Jenkins ECharts API Plugin · io.jenkins.plu…
- CVE-2020-2190Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script AppJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2020-2191Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and remoJenkins project Jenkins Self-Organizing Swarm Plug-in Modul…
- CVE-2020-2192A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add Jenkins project Jenkins Self-Organizing Swarm Plug-in Modul…
- CVE-2019-20811An issue was discovered in the Linux kernel before 5.0.6.
- CVE-2019-20812An issue was discovered in the Linux kernel before 5.4.7.
- CVE-2020-13776systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by
- CVE-2020-11080Denial of service in nghttp2nghttp2