# CVEs published 2020-06-05 31 CVEs were published on June 5, 2020: 5 critical, 4 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2020-13865](https://cve.now/CVE-2020-13865.md): The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. (no CVSS) - [CVE-2020-13864](https://cve.now/CVE-2020-13864.md): The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. (no CVSS) - [CVE-2020-11696](https://cve.now/CVE-2020-11696.md): In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. (no CVSS) - [CVE-2020-11697](https://cve.now/CVE-2020-11697.md): In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. (no CVSS) - [CVE-2020-13646](https://cve.now/CVE-2020-13646.md): In Cheetah free WiFi 5.1, the driver file (liebaonat.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifie (no CVSS) - [CVE-2020-13868](https://cve.now/CVE-2020-13868.md): An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. (no CVSS, verbb/comments) - [CVE-2020-13869](https://cve.now/CVE-2020-13869.md): An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. (no CVSS, verbb/comments) - [CVE-2020-13870](https://cve.now/CVE-2020-13870.md): An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. (no CVSS, verbb/comments) - [CVE-2020-10071](https://cve.now/CVE-2020-10071.md): Insufficient publish message length validation in MQTT (CVSS 9.0, zephyrproject-rtos zephyr) - [CVE-2020-10070](https://cve.now/CVE-2020-10070.md): MQTT buffer overflow on receive buffer (CVSS 9.0, zephyrproject-rtos zephyr) - [CVE-2020-10068](https://cve.now/CVE-2020-10068.md): Zephyr Bluetooth DLE duplicate requests vulnerability (CVSS 5.1, zephyrproject-rtos zephyr) - [CVE-2020-10063](https://cve.now/CVE-2020-10063.md): Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow (CVSS 6.8, zephyrproject-rtos zephyr) - [CVE-2020-10062](https://cve.now/CVE-2020-10062.md): Packet length decoding error in MQTT (CVSS 9.0, zephyrproject-rtos zephyr) - [CVE-2020-10061](https://cve.now/CVE-2020-10061.md): Error handling invalid packet sequence (CVSS 8.1, zephyrproject-rtos zephyr) - [CVE-2020-13867](https://cve.now/CVE-2020-13867.md): Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup files). (no CVSS) - [CVE-2020-9859](https://cve.now/CVE-2020-9859.md): A memory consumption issue was addressed with improved memory handling. (CVSS 7.8, KEV, Apple iOS · Apple macOS +2) - [CVE-2020-12723](https://cve.now/CVE-2020-12723.md): regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S\_study\_chunk calls. (no CVSS) - [CVE-2020-1883](https://cve.now/CVE-2020-1883.md): Huawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability. (no CVSS, NIP6800 · Secospace USG6600 +1) - [CVE-2020-9074](https://cve.now/CVE-2020-9074.md): Huawei Smartphones HONOR 20 PRO;Honor View 20;HONOR 20 have an improper handling of exceptional condition Vulnerability. (no CVSS, HONOR 20 PRO · Honor View +1) - [CVE-2020-11975](https://cve.now/CVE-2020-11975.md): Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execut (no CVSS, Apache Unomi · org.apache.unomi:unomi) - [CVE-2020-10878](https://cve.now/CVE-2020-10878.md): Perl before 5.30.3 has an integer overflow related to mishandling of a "PL\_regkind\[OP(n)\] == NOTHING" situation. (no CVSS) - [CVE-2020-10543](https://cve.now/CVE-2020-10543.md): Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer ove (no CVSS) - [CVE-2020-11492](https://cve.now/CVE-2020-11492.md): An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. (no CVSS) - [CVE-2020-12848](https://cve.now/CVE-2020-12848.md): In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is cr (no CVSS) - [CVE-2020-4450](https://cve.now/CVE-2020-4450.md): IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specia (CVSS 9.8, IBM WebSphere Application Server) - [CVE-2020-4449](https://cve.now/CVE-2020-4449.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a spe (CVSS 7.5, IBM WebSphere Application Server) - [CVE-2020-4448](https://cve.now/CVE-2020-4448.md): IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the sy (CVSS 9.8, IBM WebSphere Application Server) - [CVE-2020-4229](https://cve.now/CVE-2020-4229.md): IBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user logs out of a session, which could allow ano (CVSS 5.6, IBM MobileFirst Platform Foundation) - [CVE-2020-12849](https://cve.now/CVE-2020-12849.md): Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. (no CVSS) - [CVE-2020-8103](https://cve.now/CVE-2020-8103.md): Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8604) (CVSS 7.2, Bitdefender Antivirus Free) - [CVE-2020-5591](https://cve.now/CVE-2020-5591.md): XACK DNS 1.11.0 to 1.11.4, 1.10.0 to 1.10.8, 1.8.0 to 1.8.23, 1.7.0 to 1.7.18, and versions before 1.7.0 allow remote attackers to cause a d (no CVSS, XACK DNS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-06-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.