# CVEs published 2020-06-07

8 CVEs were published on June 7, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-13912](https://cve.now/CVE-2020-13912.md): SolarWinds Advanced Monitoring Agent before 10.8.9 allows local users to gain privileges via a Trojan horse .exe file, because everyone can (no CVSS)
- [CVE-2020-13910](https://cve.now/CVE-2020-13910.md): Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs\_read\_reply in net/nfs.c because a field of an incoming network packe (no CVSS)
- [CVE-2020-13909](https://cve.now/CVE-2020-13909.md): The Ignition component before 2.0.5 for Laravel mishandles globals, \_get, \_post, \_cookie, and \_env. (no CVSS, facade/ignition)
- [CVE-2020-13904](https://cve.now/CVE-2020-13904.md): FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse\_playlist in libavformat/hls.c frees a (no CVSS)
- [CVE-2020-13902](https://cve.now/CVE-2020-13902.md): ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decodi (no CVSS)
- [CVE-2020-13897](https://cve.now/CVE-2020-13897.md): HESK before 3.1.10 allows reflected XSS. (no CVSS)
- [CVE-2020-13895](https://cve.now/CVE-2020-13895.md): Crypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s (no CVSS)
- [CVE-2020-13894](https://cve.now/CVE-2020-13894.md): handler/upload\_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.