CVEs published June 10, 2020
73 CVEs were published on June 10, 2020: 0 critical, 20 high.
- Published
- 73
- Critical
- 0
- High
- 20
- Medium
- 18
- Low
- 1
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 36
Most affected products
- Android
- 8
- GitLab
- 5
- McAfee VirusScan Enterprise
- 3
- Palo Alto Networks PAN-OS
- 3
- com.liferay.portal:release.portal.bom · com.liferay.portal:…
- 2
- Dell Client Consumer and Commercial platforms
- 2
- Palo Alto Networks GlobalProtect App
- 2
- SAP SE SAP NetWeaver AS ABAP
- 2
- SAP SE SAP Solution Manager
- 2
- Siemens SIMATIC PCS 7 V8.2 and earlier · Siemens SIMATIC… +3
- 2
High 20
- CVE-2020-5363Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's managDell Client Consumer and Commercial platforms
- CVE-2020-5362Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which Dell Client Consumer and Commercial platforms
- CVE-2020-4043Phar unserialization vulnerability in phpMusselphpMussel · phpmussel/phpmussel +1
- CVE-2020-2032GlobalProtect App: File race condition vulnerability leads to local privilege escalation during upgradePalo Alto Networks GlobalProtect App
- CVE-2020-2029PAN-OS: OS command injection vulnerability in management interface certificate generatorPalo Alto Networks PAN-OS
- CVE-2020-2028PAN-OS: OS command injection vulnerability in FIPS-CC mode certificate verificationPalo Alto Networks PAN-OS
- CVE-2020-2027PAN-OS: Buffer overflow in authd authentication responsePalo Alto Networks PAN-OS
- CVE-2020-2026Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host pathKata Containers · github.com/kata-containers/runtime
- CVE-2020-13270Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relatioGitLab
- CVE-2020-4436Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knIBM Aspera Faspex On Demand · IBM Aspera High-Speed Tran… +8
- CVE-2020-4435Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacIBM Aspera Transfer Cluster Manager · IBM Aspera High-Sp… +7
- CVE-2020-4434Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could aIBM Aspera Shares On Demand · IBM Aspera Application Pla… +7
- CVE-2020-4433Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking.IBM Aspera Faspex On Demand · IBM Aspera Server On Demand +8
- CVE-2020-4432Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate IBM Aspera Streaming · IBM Aspera High-Speed Transfer En… +8
- CVE-2020-6264SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise bSAP SE SAP Commerce
- CVE-2020-6275SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request ForgSAP SE SAP Netweaver AS ABAP
- CVE-2020-6271SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume SAP SE SAP Solution Manager
- CVE-2020-7280Symbolic Link vulnerability during DAT updateMcAfee VirusScan Enterprise
- CVE-2019-3585VSE Escalation of Privileges through Alert pop-up windowMcAfee VirusScan Enterprise
- CVE-2019-3617Privilege escalation in ToPS for MacMcAfee Total Protection (ToPS) for Mac OS
Medium, low and unrated 53
- CVE-2020-13901An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.
- CVE-2020-13900An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.
- CVE-2020-13899An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.
- CVE-2020-13898An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.
- CVE-2020-11622A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.2
- CVE-2020-13238Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted pac
- CVE-2020-10705A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may caUndertow · io.undertow:undertow-core
- CVE-2020-12757HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials github.com/hashicorp/vault-plugin-secrets-gcp
- CVE-2020-13223HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials.github.com/hashicorp/vault
- CVE-2020-13906IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000038eb7.
- CVE-2020-13905IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000038ed4.
- CVE-2020-13444Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitizecom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2020-13445In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API dcom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2020-14012scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description.
- CVE-2020-2023Kata Containers - Containers have access to the guest root filesystem deviceKata Containers · github.com/kata-containers/agent +1
- CVE-2020-2033GlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookiePalo Alto Networks GlobalProtect App
- CVE-2020-14010The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.
- CVE-2020-0116In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass.Android
- CVE-2020-0117In aes_cmac of aes_cmac.cc, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2020-0113In sendCaptureResult of Camera3OutputUtils.cpp, there is a possible out of bounds read due to a use after free.Android
- CVE-2020-0118In addListener of RegionSamplingThread.cpp, there is a possible out of bounds write due to improper input validation.Android
- CVE-2020-0119In addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a possible man in the middle attack due to improper Android
- CVE-2020-0115In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default handAndroid
- CVE-2020-0121In updateUidProcState of AppOpsService.java, there is a possible permission bypass due to a logic error.Android
- CVE-2020-0114In onCreateSliceProvider of KeyguardSliceProvider.java, there is a possible confused deputy due to a PendingIntent error.Android
- CVE-2020-7589A vulnerability has been identified in LOGO! 8 BM (incl.Siemens LOGO! 8 BM
- CVE-2020-7586A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC Siemens SIMATIC PCS 7 V8.2 and earlier · Siemens SIMATIC… +3
- CVE-2020-7585A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC Siemens SIMATIC PCS 7 V8.2 and earlier · Siemens SIMATIC… +3
- CVE-2020-10755An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versionsRed Hat openstack-cinder · os-brick +1
- CVE-2020-7670agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable.agoo
- CVE-2020-7671goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable.goliath
- CVE-2020-7672mosc through 1.0.0 is vulnerable to Arbitrary Code Execution.mosc
- CVE-2020-7673node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution.node-extend
- CVE-2020-7674access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution.access-policy
- CVE-2020-7675cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution.cd-messenger
- CVE-2020-13269A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE GitLab
- CVE-2020-13268A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contGitLab
- CVE-2020-13267A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and lGitLab
- CVE-2020-13271A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EEGitLab
- CVE-2019-4576IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Patch 1 and 7.4.0 GA does not require that users should have strong passwords by default, whIBM QRadar Network Packet Capture Software
- CVE-2020-6266SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL vSAP SE SAP Fiori for SAP S/4HANA
- CVE-2020-6263Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7SAP SE SAP NetWeaver AS JAVA
- CVE-2020-6260SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, SAP SE SAP Solution Manager
- CVE-2020-6269Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which woSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6270SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authoSAP SE SAP NetWeaver AS ABAP
- CVE-2020-6268Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versionSAP SE SAP ERP
- CVE-2020-6246SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, SAP SE SAP NetWeaver AS ABAP
- CVE-2020-6239Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM useSAP SE SAP Business One
- CVE-2019-3588Using VSE to bypass Windows Credentials on Lock screenMcAfee VirusScan Enterprise
- CVE-2020-7279DLL search order hijacking in Host IPSMcAfee Host Intrusion Prevention System (Host IPS) for Wind…
- CVE-2019-3613DLL search order hijacking in MAMcAfee Agent
- CVE-2020-11798A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an
- CVE-2020-7580A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Siemens SIMATIC Automation Tool · Siemens SIMATIC NET P… +15