# CVEs published 2020-06-04

100 CVEs were published on June 4, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-13843](https://cve.now/CVE-2020-13843.md): An issue was discovered on LG mobile devices with Android OS software before 2020-06-01. (no CVSS)
- [CVE-2020-13842](https://cve.now/CVE-2020-13842.md): An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). (no CVSS)
- [CVE-2020-13841](https://cve.now/CVE-2020-13841.md): An issue was discovered on LG mobile devices with Android OS 9 and 10 (MTK chipsets). (no CVSS)
- [CVE-2020-13840](https://cve.now/CVE-2020-13840.md): An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). (no CVSS)
- [CVE-2020-13839](https://cve.now/CVE-2020-13839.md): An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). (no CVSS)
- [CVE-2020-8555](https://cve.now/CVE-2020-8555.md): Kubernetes kube-controller-manager SSRF (CVSS 6.3, Kubernetes · k8s.io/kubernetes)
- [CVE-2020-13768](https://cve.now/CVE-2020-13768.md): In MiniShare before 1.4.2, there is a stack-based buffer overflow via an HTTP PUT request, which allows an attacker to achieve arbitrary cod (no CVSS)
- [CVE-2020-13849](https://cve.now/CVE-2020-13849.md): The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remot (no CVSS)
- [CVE-2020-13848](https://cve.now/CVE-2020-13848.md): Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message d (no CVSS)
- [CVE-2020-12847](https://cve.now/CVE-2020-12847.md): Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator ro (no CVSS)
- [CVE-2020-12851](https://cve.now/CVE-2020-12851.md): Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders (repositori (no CVSS)
- [CVE-2020-12852](https://cve.now/CVE-2020-12852.md): The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the (no CVSS)
- [CVE-2020-11682](https://cve.now/CVE-2020-11682.md): Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. (no CVSS)
- [CVE-2020-12853](https://cve.now/CVE-2020-12853.md): Pydio Cells 2.0.4 allows XSS. (no CVSS)
- [CVE-2020-11681](https://cve.now/CVE-2020-11681.md): Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. (no CVSS)
- [CVE-2020-11680](https://cve.now/CVE-2020-11680.md): Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. (no CVSS)
- [CVE-2020-11679](https://cve.now/CVE-2020-11679.md): Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. (no CVSS)
- [CVE-2020-10702](https://cve.now/CVE-2020-10702.md): A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in (CVSS 5.5, The QEMU Project qemu)
- [CVE-2020-7661](https://cve.now/CVE-2020-7661.md): all versions of url-regex are vulnerable to Regular Expression Denial of Service. (no CVSS, url-regex)
- [CVE-2020-13829](https://cve.now/CVE-2020-13829.md): An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. (no CVSS)
- [CVE-2020-13830](https://cve.now/CVE-2020-13830.md): An issue was discovered on Samsung mobile devices with P(9.0) software. (no CVSS)
- [CVE-2020-13831](https://cve.now/CVE-2020-13831.md): An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 7570 chipsets) software. (no CVSS)
- [CVE-2020-13832](https://cve.now/CVE-2020-13832.md): An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software. (no CVSS)
- [CVE-2020-13833](https://cve.now/CVE-2020-13833.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. (no CVSS)
- [CVE-2020-13834](https://cve.now/CVE-2020-13834.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (with TEEGRIS) software. (no CVSS)
- [CVE-2020-13835](https://cve.now/CVE-2020-13835.md): An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. (no CVSS)
- [CVE-2020-13836](https://cve.now/CVE-2020-13836.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. (no CVSS)
- [CVE-2020-13837](https://cve.now/CVE-2020-13837.md): An issue was discovered on Samsung mobile devices with Q(10.0) software. (no CVSS)
- [CVE-2020-13838](https://cve.now/CVE-2020-13838.md): An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. (no CVSS)
- [CVE-2019-20823](https://cve.now/CVE-2019-20823.md): An issue was discovered in Foxit PhantomPDF before 8.3.11. (no CVSS)
- [CVE-2019-20824](https://cve.now/CVE-2019-20824.md): An issue was discovered in Foxit PhantomPDF before 8.3.11. (no CVSS)
- [CVE-2019-20825](https://cve.now/CVE-2019-20825.md): An issue was discovered in Foxit PhantomPDF before 8.3.11. (no CVSS)
- [CVE-2019-20826](https://cve.now/CVE-2019-20826.md): An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. (no CVSS)
- [CVE-2019-20827](https://cve.now/CVE-2019-20827.md): An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. (no CVSS)
- [CVE-2019-20828](https://cve.now/CVE-2019-20828.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.6. (no CVSS)
- [CVE-2019-20829](https://cve.now/CVE-2019-20829.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.6. (no CVSS)
- [CVE-2019-20830](https://cve.now/CVE-2019-20830.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.6. (no CVSS)
- [CVE-2019-20831](https://cve.now/CVE-2019-20831.md): An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.5.0.20733. (no CVSS)
- [CVE-2019-20832](https://cve.now/CVE-2019-20832.md): An issue was discovered in Foxit PhantomPDF before 8.3.10. (no CVSS)
- [CVE-2019-20833](https://cve.now/CVE-2019-20833.md): An issue was discovered in Foxit PhantomPDF before 8.3.10. (no CVSS)
- [CVE-2019-20834](https://cve.now/CVE-2019-20834.md): An issue was discovered in Foxit PhantomPDF before 8.3.10. (no CVSS)
- [CVE-2019-20835](https://cve.now/CVE-2019-20835.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.5. (no CVSS)
- [CVE-2019-20836](https://cve.now/CVE-2019-20836.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.5. (no CVSS)
- [CVE-2019-20837](https://cve.now/CVE-2019-20837.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.5. (no CVSS)
- [CVE-2018-21235](https://cve.now/CVE-2018-21235.md): An issue was discovered in Foxit E-mail advertising system before September 2018. (no CVSS)
- [CVE-2018-21236](https://cve.now/CVE-2018-21236.md): An issue was discovered in Foxit Reader before 2.4.4. (no CVSS)
- [CVE-2018-21237](https://cve.now/CVE-2018-21237.md): An issue was discovered in Foxit PhantomPDF before 8.3.7. (no CVSS)
- [CVE-2018-21238](https://cve.now/CVE-2018-21238.md): An issue was discovered in Foxit PhantomPDF before 8.3.7. (no CVSS)
- [CVE-2018-21239](https://cve.now/CVE-2018-21239.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.2. (no CVSS)
- [CVE-2018-21240](https://cve.now/CVE-2018-21240.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.2. (no CVSS)
- [CVE-2018-21241](https://cve.now/CVE-2018-21241.md): An issue was discovered in Foxit PhantomPDF before 8.3.6. (no CVSS)
- [CVE-2018-21242](https://cve.now/CVE-2018-21242.md): An issue was discovered in Foxit PhantomPDF before 8.3.6. (no CVSS)
- [CVE-2018-21243](https://cve.now/CVE-2018-21243.md): An issue was discovered in Foxit PhantomPDF before 8.3.6. (no CVSS)
- [CVE-2018-21244](https://cve.now/CVE-2018-21244.md): An issue was discovered in Foxit PhantomPDF before 8.3.6. (no CVSS)
- [CVE-2020-9462](https://cve.now/CVE-2020-9462.md): An issue was discovered in all Athom Homey and Homey Pro devices up to the current version 4.2.0. (no CVSS)
- [CVE-2019-20822](https://cve.now/CVE-2019-20822.md): An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.7.0.29430. (no CVSS)
- [CVE-2019-20821](https://cve.now/CVE-2019-20821.md): An issue was discovered in Foxit PhantomPDF Mac before 3.4. (no CVSS)
- [CVE-2019-20820](https://cve.now/CVE-2019-20820.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7. (no CVSS)
- [CVE-2019-20819](https://cve.now/CVE-2019-20819.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7. (no CVSS)
- [CVE-2019-20818](https://cve.now/CVE-2019-20818.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7. (no CVSS)
- [CVE-2019-20817](https://cve.now/CVE-2019-20817.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7. (no CVSS)
- [CVE-2019-20816](https://cve.now/CVE-2019-20816.md): An issue was discovered in Foxit PhantomPDF before 8.3.12. (no CVSS)
- [CVE-2019-20815](https://cve.now/CVE-2019-20815.md): An issue was discovered in Foxit PhantomPDF before 8.3.12. (no CVSS)
- [CVE-2019-20814](https://cve.now/CVE-2019-20814.md): An issue was discovered in Foxit PhantomPDF before 8.3.12. (no CVSS)
- [CVE-2019-20813](https://cve.now/CVE-2019-20813.md): An issue was discovered in Foxit PhantomPDF before 8.3.12. (no CVSS)
- [CVE-2020-13815](https://cve.now/CVE-2020-13815.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. (no CVSS)
- [CVE-2020-13814](https://cve.now/CVE-2020-13814.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. (no CVSS)
- [CVE-2020-13813](https://cve.now/CVE-2020-13813.md): An issue was discovered in Foxit Studio Photo before 3.6.6.922. (no CVSS)
- [CVE-2019-16384](https://cve.now/CVE-2019-16384.md): Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration. (no CVSS)
- [CVE-2019-16385](https://cve.now/CVE-2019-16385.md): Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated (no CVSS)
- [CVE-2020-13812](https://cve.now/CVE-2020-13812.md): An issue was discovered in Foxit Studio Photo before 3.6.6.922. (no CVSS)
- [CVE-2020-13765](https://cve.now/CVE-2020-13765.md): rom\_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to tri (no CVSS)
- [CVE-2020-13811](https://cve.now/CVE-2020-13811.md): An issue was discovered in Foxit Studio Photo before 3.6.6.922. (no CVSS)
- [CVE-2020-13791](https://cve.now/CVE-2020-13791.md): hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configur (no CVSS)
- [CVE-2020-13800](https://cve.now/CVE-2020-13800.md): ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm\_index value during an ati\_mm\_ (no CVSS)
- [CVE-2020-13692](https://cve.now/CVE-2020-13692.md): PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. (no CVSS, org.postgresql:postgresql)
- [CVE-2020-13810](https://cve.now/CVE-2020-13810.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. (no CVSS)
- [CVE-2020-13808](https://cve.now/CVE-2020-13808.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. (no CVSS)
- [CVE-2020-13809](https://cve.now/CVE-2020-13809.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. (no CVSS)
- [CVE-2020-13807](https://cve.now/CVE-2020-13807.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. (no CVSS)
- [CVE-2020-13827](https://cve.now/CVE-2020-13827.md): phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php. (no CVSS)
- [CVE-2020-13806](https://cve.now/CVE-2020-13806.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. (no CVSS)
- [CVE-2020-13805](https://cve.now/CVE-2020-13805.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. (no CVSS)
- [CVE-2020-13804](https://cve.now/CVE-2020-13804.md): An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. (no CVSS)
- [CVE-2020-13803](https://cve.now/CVE-2020-13803.md): An issue was discovered in Foxit PhantomPDF Mac and Foxit Reader for Mac before 4.0. (no CVSS)
- [CVE-2020-13822](https://cve.now/CVE-2020-13822.md): The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\\0' bytes, or integer overfl (no CVSS, elliptic)
- [CVE-2020-4509](https://cve.now/CVE-2020-4509.md): IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.6, IBM QRadar SIEM)
- [CVE-2020-4193](https://cve.now/CVE-2020-4193.md): IBM Security Guardium 11.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. (CVSS 4.4, IBM Security Guardium)
- [CVE-2020-4191](https://cve.now/CVE-2020-4191.md): IBM Security Guardium 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infor (CVSS 4.1, IBM Security Guardium)
- [CVE-2020-4183](https://cve.now/CVE-2020-4183.md): IBM Security Guardium 11.1 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Guardium)
- [CVE-2020-13818](https://cve.now/CVE-2020-13818.md): In Zoho ManageEngine OpManager before 125144, when \<cachestart\> is used, directory traversal validation can be bypassed. (no CVSS)
- [CVE-2020-6640](https://cve.now/CVE-2020-6640.md): An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform (no CVSS, Fortinet FortiAnalyzer)
- [CVE-2020-9292](https://cve.now/CVE-2020-9292.md): An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the Ao (no CVSS, Fortinet FortiSIEMWindowsAgent)
- [CVE-2020-13817](https://cve.now/CVE-2020-13817.md): ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change (CVSS 5.9)
- [CVE-2019-16150](https://cve.now/CVE-2019-16150.md): Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior (no CVSS, Fortinet FortiClient for Windows)
- [CVE-2020-13777](https://cve.now/CVE-2020-13777.md): GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authent (no CVSS)
- [CVE-2020-10546](https://cve.now/CVE-2020-10546.md): rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. (no CVSS)
- [CVE-2020-10547](https://cve.now/CVE-2020-10547.md): rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. (no CVSS)
- [CVE-2020-10548](https://cve.now/CVE-2020-10548.md): rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. (no CVSS)
- [CVE-2020-10549](https://cve.now/CVE-2020-10549.md): rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.