CVEs published June 8, 2020
34 CVEs were published on June 8, 2020: 1 critical, 6 high.
- Published
- 34
- Critical
- 1
- High
- 6
- Medium
- 1
- Low
- 1
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- bolt · bolt/bolt
- 2
- The Document Foundation LibreOffice
- 2
- Zoom
- 2
- [Red Hat] NetworkManager
- 1
- angular.js · angular
- 1
- https://github.com/nodejs/node
- 1
- Huawei ALP-AL00B · Huawei ALP-L09 +26
- 1
- IBM Maximo Asset Management
- 1
- IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospa…
- 1
- Nextcloud Talk
- 1
Critical 1
High 6
- CVE-2020-4041The filename of uploaded files vulnerable to stored XSS in Bolt CMSbolt · bolt/bolt
- CVE-2020-4040CSRF issue on preview pages in Bolt CMSbolt · bolt/bolt
- CVE-2020-4038Reflected XSS in GraphQL Playgroundprisma-labs graphql-playground · graphql-playground-html
- CVE-2020-6110An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snZoom
- CVE-2020-6109An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs.Zoom
- CVE-2020-4529IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to server side request forgery (SSRF).IBM Maximo Asset Management
Medium, low and unrated 27
- CVE-2020-13962Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause
- CVE-2020-13844Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosur
- CVE-2020-13960D-Link DSL 2730-U IN_1.10 and IN_1.11 and DIR-600M 3.04 devices have the domain.name string in the DNS resolver search path by default, whic
- CVE-2020-13884Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows local users to gain pri
- CVE-2020-13885Citrix Workspace App before 1912 on Windows has Insecure Permissions which allows local users to gain privileges during the uninstallation o
- CVE-2019-19412Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability.Huawei ALP-AL00B · Huawei ALP-L09 +26
- CVE-2020-13428A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11
- CVE-2020-13432rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-p
- CVE-2020-10754It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when c[Red Hat] NetworkManager
- CVE-2020-12695The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delive
- CVE-2020-13696An issue was discovered in LinuxTV xawtv before 3.107.
- CVE-2020-8954OpenSearch Web browser 1.0.4.9 allows Intent Scheme Hijacking.[a link that opens another app in the browser can be manipulated]
- CVE-2020-12800The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code ex
- CVE-2020-5304The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in
- CVE-2020-13625PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character.phpmailer/phpmailer
- CVE-2020-13866WinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows local users to gain privileges by replacing an exe
- CVE-2020-12803XForms submissions could overwrite local filesThe Document Foundation LibreOffice
- CVE-2020-1775Information disclosure in external interfaceOTRS AG OTRS
- CVE-2020-12802remote graphics contained in docx format retrieved in 'stealth mode'The Document Foundation LibreOffice
- CVE-2020-9040Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer.
- CVE-2020-9041In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are
- CVE-2020-9042In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to
- CVE-2020-9099Huawei products IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500 with veIPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospa…
- CVE-2020-7676angular.js prior to 1.8.0 allows cross site scripting.angular.js · angular
- CVE-2020-8180A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by aNextcloud Talk
- CVE-2020-8172TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.https://github.com/nodejs/node
- CVE-2020-12049An issue was discovered in dbus >= 1.3.0 before 1.12.18.