# CVEs published 2020-06-08 34 CVEs were published on June 8, 2020: 1 critical, 6 high. Days are UTC. - [CVE-2020-13962](https://cve.now/CVE-2020-13962.md): Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause (no CVSS) - [CVE-2020-13844](https://cve.now/CVE-2020-13844.md): Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosur (no CVSS) - [CVE-2020-4041](https://cve.now/CVE-2020-4041.md): The filename of uploaded files vulnerable to stored XSS in Bolt CMS (CVSS 7.4, bolt · bolt/bolt) - [CVE-2020-4040](https://cve.now/CVE-2020-4040.md): CSRF issue on preview pages in Bolt CMS (CVSS 8.6, bolt · bolt/bolt) - [CVE-2020-4038](https://cve.now/CVE-2020-4038.md): Reflected XSS in GraphQL Playground (CVSS 7.4, prisma-labs graphql-playground · graphql-playground-html) - [CVE-2020-13960](https://cve.now/CVE-2020-13960.md): D-Link DSL 2730-U IN\_1.10 and IN\_1.11 and DIR-600M 3.04 devices have the domain.name string in the DNS resolver search path by default, whic (no CVSS) - [CVE-2020-13884](https://cve.now/CVE-2020-13884.md): Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows local users to gain pri (no CVSS) - [CVE-2020-13885](https://cve.now/CVE-2020-13885.md): Citrix Workspace App before 1912 on Windows has Insecure Permissions which allows local users to gain privileges during the uninstallation o (no CVSS) - [CVE-2019-19412](https://cve.now/CVE-2019-19412.md): Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. (no CVSS, Huawei ALP-AL00B · Huawei ALP-L09 +26) - [CVE-2020-13428](https://cve.now/CVE-2020-13428.md): A heap-based buffer overflow in the hxxx\_AnnexB\_to\_xVC function in modules/packetizer/hxxx\_nal.c in VideoLAN VLC media player before 3.0.11 (no CVSS) - [CVE-2020-13432](https://cve.now/CVE-2020-13432.md): rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-p (no CVSS) - [CVE-2020-10754](https://cve.now/CVE-2020-10754.md): It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when c (CVSS 4.3, \[Red Hat\] NetworkManager) - [CVE-2020-12695](https://cve.now/CVE-2020-12695.md): The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delive (no CVSS) - [CVE-2020-13696](https://cve.now/CVE-2020-13696.md): An issue was discovered in LinuxTV xawtv before 3.107. (no CVSS) - [CVE-2020-8954](https://cve.now/CVE-2020-8954.md): OpenSearch Web browser 1.0.4.9 allows Intent Scheme Hijacking.\[a link that opens another app in the browser can be manipulated\] (no CVSS) - [CVE-2020-12800](https://cve.now/CVE-2020-12800.md): The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code ex (no CVSS) - [CVE-2020-5304](https://cve.now/CVE-2020-5304.md): The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in (no CVSS) - [CVE-2020-13625](https://cve.now/CVE-2020-13625.md): PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. (no CVSS, phpmailer/phpmailer) - [CVE-2020-13866](https://cve.now/CVE-2020-13866.md): WinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows local users to gain privileges by replacing an exe (no CVSS) - [CVE-2020-12803](https://cve.now/CVE-2020-12803.md): XForms submissions could overwrite local files (no CVSS, The Document Foundation LibreOffice) - [CVE-2020-1775](https://cve.now/CVE-2020-1775.md): Information disclosure in external interface (CVSS 3.5, OTRS AG OTRS) - [CVE-2020-12802](https://cve.now/CVE-2020-12802.md): remote graphics contained in docx format retrieved in 'stealth mode' (no CVSS, The Document Foundation LibreOffice) - [CVE-2020-9040](https://cve.now/CVE-2020-9040.md): Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. (no CVSS) - [CVE-2020-9041](https://cve.now/CVE-2020-9041.md): In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are (no CVSS) - [CVE-2020-9042](https://cve.now/CVE-2020-9042.md): In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to (no CVSS) - [CVE-2020-9099](https://cve.now/CVE-2020-9099.md): Huawei products IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500 with ve (no CVSS, IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospa…) - [CVE-2020-7676](https://cve.now/CVE-2020-7676.md): angular.js prior to 1.8.0 allows cross site scripting. (no CVSS, angular.js · angular) - [CVE-2020-6110](https://cve.now/CVE-2020-6110.md): An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code sn (CVSS 8.0, Zoom) - [CVE-2020-6109](https://cve.now/CVE-2020-6109.md): An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. (CVSS 8.5, Zoom) - [CVE-2020-8180](https://cve.now/CVE-2020-8180.md): A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by a (no CVSS, Nextcloud Talk) - [CVE-2020-8172](https://cve.now/CVE-2020-8172.md): TLS session reuse can lead to host certificate verification bypass in node version \< 12.18.0 and \< 14.4.0. (no CVSS, https://github.com/nodejs/node) - [CVE-2020-4529](https://cve.now/CVE-2020-4529.md): IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to server side request forgery (SSRF). (CVSS 7.3, IBM Maximo Asset Management) - [CVE-2020-12773](https://cve.now/CVE-2020-12773.md): Realtek ADSL/PON Modem SoC - Security Misconfiguration (CVSS 9.6, Realtek ADSL/PON Modem SoC) - [CVE-2020-12049](https://cve.now/CVE-2020-12049.md): An issue was discovered in dbus \>= 1.3.0 before 1.12.18. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-06-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.