CVEs published June 5, 2020
31 CVEs were published on June 5, 2020: 5 critical, 4 high. 1 is now in CISA KEV.
- Published
- 31
- Critical
- 5
- High
- 4
- Medium
- 3
- Low
- 0
- Unrated
- 19
- Now in CISA KEV
- 1
- Fix available
- 6
Most affected products
- zephyrproject-rtos zephyr
- 6
- IBM WebSphere Application Server
- 3
- verbb/comments
- 3
- Apache Unomi · org.apache.unomi:unomi
- 1
- Apple iOS · Apple macOS +2
- 1
- Bitdefender Antivirus Free
- 1
- HONOR 20 PRO · Honor View +1
- 1
- IBM MobileFirst Platform Foundation
- 1
- NIP6800 · Secospace USG6600 +1
- 1
- XACK DNS
- 1
Critical 5
- CVE-2020-10071Insufficient publish message length validation in MQTTzephyrproject-rtos zephyr
- CVE-2020-10070MQTT buffer overflow on receive bufferzephyrproject-rtos zephyr
- CVE-2020-10062Packet length decoding error in MQTTzephyrproject-rtos zephyr
- CVE-2020-4450IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a speciaIBM WebSphere Application Server
- CVE-2020-4448IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the syIBM WebSphere Application Server
High 4
- CVE-2020-10061Error handling invalid packet sequencezephyrproject-rtos zephyr
- CVE-2020-9859A memory consumption issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2020-4449IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a speIBM WebSphere Application Server
- CVE-2020-8103Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8604)Bitdefender Antivirus Free
Medium, low and unrated 22
- CVE-2020-13865The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities.
- CVE-2020-13864The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability.
- CVE-2020-11696In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload.
- CVE-2020-11697In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload.
- CVE-2020-13646In Cheetah free WiFi 5.1, the driver file (liebaonat.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie
- CVE-2020-13868An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS.verbb/comments
- CVE-2020-13869An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS.verbb/comments
- CVE-2020-13870An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS.verbb/comments
- CVE-2020-10068Zephyr Bluetooth DLE duplicate requests vulnerabilityzephyrproject-rtos zephyr
- CVE-2020-10063Remote Denial of Service in CoAP Option Parsing Due To Integer Overflowzephyrproject-rtos zephyr
- CVE-2020-13867Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup files).
- CVE-2020-12723regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
- CVE-2020-1883Huawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability.NIP6800 · Secospace USG6600 +1
- CVE-2020-9074Huawei Smartphones HONOR 20 PRO;Honor View 20;HONOR 20 have an improper handling of exceptional condition Vulnerability.HONOR 20 PRO · Honor View +1
- CVE-2020-11975Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could executApache Unomi · org.apache.unomi:unomi
- CVE-2020-10878Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation.
- CVE-2020-10543Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer ove
- CVE-2020-11492An issue was discovered in Docker Desktop through 2.2.0.5 on Windows.
- CVE-2020-12848In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is cr
- CVE-2020-4229IBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user logs out of a session, which could allow anoIBM MobileFirst Platform Foundation
- CVE-2020-12849Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles.
- CVE-2020-5591XACK DNS 1.11.0 to 1.11.4, 1.10.0 to 1.10.8, 1.8.0 to 1.8.23, 1.7.0 to 1.7.18, and versions before 1.7.0 allow remote attackers to cause a dXACK DNS