# CVEs published 2020-06-10

73 CVEs were published on June 10, 2020: 0 critical, 20 high. Days are UTC.

- [CVE-2020-13901](https://cve.now/CVE-2020-13901.md): An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. (no CVSS)
- [CVE-2020-13900](https://cve.now/CVE-2020-13900.md): An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. (no CVSS)
- [CVE-2020-13899](https://cve.now/CVE-2020-13899.md): An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. (no CVSS)
- [CVE-2020-13898](https://cve.now/CVE-2020-13898.md): An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. (no CVSS)
- [CVE-2020-5363](https://cve.now/CVE-2020-5363.md): Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manag (CVSS 8.6, Dell Client Consumer and Commercial platforms)
- [CVE-2020-5362](https://cve.now/CVE-2020-5362.md): Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which (CVSS 7.1, Dell Client Consumer and Commercial platforms)
- [CVE-2020-11622](https://cve.now/CVE-2020-11622.md): A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.2 (no CVSS)
- [CVE-2020-13238](https://cve.now/CVE-2020-13238.md): Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted pac (no CVSS)
- [CVE-2020-4043](https://cve.now/CVE-2020-4043.md): Phar unserialization vulnerability in phpMussel (CVSS 7.7, phpMussel · phpmussel/phpmussel +1)
- [CVE-2020-10705](https://cve.now/CVE-2020-10705.md): A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may ca (no CVSS, Undertow · io.undertow:undertow-core)
- [CVE-2020-12757](https://cve.now/CVE-2020-12757.md): HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials (no CVSS, github.com/hashicorp/vault-plugin-secrets-gcp)
- [CVE-2020-13223](https://cve.now/CVE-2020-13223.md): HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. (no CVSS, github.com/hashicorp/vault)
- [CVE-2020-13906](https://cve.now/CVE-2020-13906.md): IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000038eb7. (no CVSS)
- [CVE-2020-13905](https://cve.now/CVE-2020-13905.md): IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000038ed4. (no CVSS)
- [CVE-2020-13444](https://cve.now/CVE-2020-13444.md): Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2020-13445](https://cve.now/CVE-2020-13445.md): In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API d (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2020-14012](https://cve.now/CVE-2020-14012.md): scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description. (no CVSS)
- [CVE-2020-2023](https://cve.now/CVE-2020-2023.md): Kata Containers - Containers have access to the guest root filesystem device (CVSS 3.8, Kata Containers · github.com/kata-containers/agent +1)
- [CVE-2020-2033](https://cve.now/CVE-2020-2033.md): GlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookie (CVSS 5.3, Palo Alto Networks GlobalProtect App)
- [CVE-2020-2032](https://cve.now/CVE-2020-2032.md): GlobalProtect App: File race condition vulnerability leads to local privilege escalation during upgrade (CVSS 7.0, Palo Alto Networks GlobalProtect App)
- [CVE-2020-2029](https://cve.now/CVE-2020-2029.md): PAN-OS: OS command injection vulnerability in management interface certificate generator (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2020-2028](https://cve.now/CVE-2020-2028.md): PAN-OS: OS command injection vulnerability in FIPS-CC mode certificate verification (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2020-2027](https://cve.now/CVE-2020-2027.md): PAN-OS: Buffer overflow in authd authentication response (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2020-2026](https://cve.now/CVE-2020-2026.md): Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path (CVSS 7.8, Kata Containers · github.com/kata-containers/runtime)
- [CVE-2020-14010](https://cve.now/CVE-2020-14010.md): The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter. (no CVSS)
- [CVE-2020-0116](https://cve.now/CVE-2020-0116.md): In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. (no CVSS, Android)
- [CVE-2020-0117](https://cve.now/CVE-2020-0117.md): In aes\_cmac of aes\_cmac.cc, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2020-0113](https://cve.now/CVE-2020-0113.md): In sendCaptureResult of Camera3OutputUtils.cpp, there is a possible out of bounds read due to a use after free. (no CVSS, Android)
- [CVE-2020-0118](https://cve.now/CVE-2020-0118.md): In addListener of RegionSamplingThread.cpp, there is a possible out of bounds write due to improper input validation. (no CVSS, Android)
- [CVE-2020-0119](https://cve.now/CVE-2020-0119.md): In addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a possible man in the middle attack due to improper (no CVSS, Android)
- [CVE-2020-0115](https://cve.now/CVE-2020-0115.md): In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default hand (no CVSS, Android)
- [CVE-2020-0121](https://cve.now/CVE-2020-0121.md): In updateUidProcState of AppOpsService.java, there is a possible permission bypass due to a logic error. (no CVSS, Android)
- [CVE-2020-0114](https://cve.now/CVE-2020-0114.md): In onCreateSliceProvider of KeyguardSliceProvider.java, there is a possible confused deputy due to a PendingIntent error. (no CVSS, Android)
- [CVE-2020-7589](https://cve.now/CVE-2020-7589.md): A vulnerability has been identified in LOGO! 8 BM (incl. (no CVSS, Siemens LOGO! 8 BM)
- [CVE-2020-7586](https://cve.now/CVE-2020-7586.md): A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions \< V9.0 SP3), SIMATIC (no CVSS, Siemens SIMATIC PCS 7 V8.2 and earlier · Siemens SIMATIC… +3)
- [CVE-2020-7585](https://cve.now/CVE-2020-7585.md): A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions \< V9.0 SP3), SIMATIC (no CVSS, Siemens SIMATIC PCS 7 V8.2 and earlier · Siemens SIMATIC… +3)
- [CVE-2020-10755](https://cve.now/CVE-2020-10755.md): An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions (CVSS 6.5, Red Hat openstack-cinder · os-brick +1)
- [CVE-2020-7670](https://cve.now/CVE-2020-7670.md): agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. (no CVSS, agoo)
- [CVE-2020-7671](https://cve.now/CVE-2020-7671.md): goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. (no CVSS, goliath)
- [CVE-2020-7672](https://cve.now/CVE-2020-7672.md): mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. (no CVSS, mosc)
- [CVE-2020-7673](https://cve.now/CVE-2020-7673.md): node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. (no CVSS, node-extend)
- [CVE-2020-7674](https://cve.now/CVE-2020-7674.md): access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. (no CVSS, access-policy)
- [CVE-2020-7675](https://cve.now/CVE-2020-7675.md): cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. (no CVSS, cd-messenger)
- [CVE-2020-13269](https://cve.now/CVE-2020-13269.md): A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE (CVSS 6.1, GitLab)
- [CVE-2020-13270](https://cve.now/CVE-2020-13270.md): Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relatio (CVSS 7.5, GitLab)
- [CVE-2020-13268](https://cve.now/CVE-2020-13268.md): A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their cont (CVSS 5.3, GitLab)
- [CVE-2020-13267](https://cve.now/CVE-2020-13267.md): A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and l (CVSS 6.1, GitLab)
- [CVE-2020-13271](https://cve.now/CVE-2020-13271.md): A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE (CVSS 6.1, GitLab)
- [CVE-2020-4436](https://cve.now/CVE-2020-4436.md): Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate kn (CVSS 8.8, IBM Aspera Faspex On Demand · IBM Aspera High-Speed Tran… +8)
- [CVE-2020-4435](https://cve.now/CVE-2020-4435.md): Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attac (CVSS 7.5, IBM Aspera Transfer Cluster Manager · IBM Aspera High-Sp… +7)
- [CVE-2020-4434](https://cve.now/CVE-2020-4434.md): Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could a (CVSS 7.5, IBM Aspera Shares On Demand · IBM Aspera Application Pla… +7)
- [CVE-2020-4433](https://cve.now/CVE-2020-4433.md): Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. (CVSS 7.5, IBM Aspera Faspex On Demand · IBM Aspera Server On Demand +8)
- [CVE-2020-4432](https://cve.now/CVE-2020-4432.md): Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate (CVSS 7.5, IBM Aspera Streaming · IBM Aspera High-Speed Transfer En… +8)
- [CVE-2019-4576](https://cve.now/CVE-2019-4576.md): IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Patch 1 and 7.4.0 GA does not require that users should have strong passwords by default, wh (CVSS 5.9, IBM QRadar Network Packet Capture Software)
- [CVE-2020-6266](https://cve.now/CVE-2020-6266.md): SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL v (CVSS 5.4, SAP SE SAP Fiori for SAP S/4HANA)
- [CVE-2020-6264](https://cve.now/CVE-2020-6264.md): SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise b (CVSS 8.6, SAP SE SAP Commerce)
- [CVE-2020-6263](https://cve.now/CVE-2020-6263.md): Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7 (CVSS 6.9, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2020-6260](https://cve.now/CVE-2020-6260.md): SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, (CVSS 6.5, SAP SE SAP Solution Manager)
- [CVE-2020-6275](https://cve.now/CVE-2020-6275.md): SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forg (CVSS 7.6, SAP SE SAP Netweaver AS ABAP)
- [CVE-2020-6271](https://cve.now/CVE-2020-6271.md): SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume (CVSS 8.2, SAP SE SAP Solution Manager)
- [CVE-2020-6269](https://cve.now/CVE-2020-6269.md): Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which wo (CVSS 4.3, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6270](https://cve.now/CVE-2020-6270.md): SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary autho (CVSS 6.5, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2020-6268](https://cve.now/CVE-2020-6268.md): Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE version (CVSS 5.4, SAP SE SAP ERP)
- [CVE-2020-6246](https://cve.now/CVE-2020-6246.md): SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT\_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, (CVSS 6.1, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2020-6239](https://cve.now/CVE-2020-6239.md): Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM use (CVSS 4.4, SAP SE SAP Business One)
- [CVE-2020-7280](https://cve.now/CVE-2020-7280.md): Symbolic Link vulnerability during DAT update (CVSS 7.8, McAfee VirusScan Enterprise)
- [CVE-2019-3588](https://cve.now/CVE-2019-3588.md): Using VSE to bypass Windows Credentials on Lock screen (CVSS 6.3, McAfee VirusScan Enterprise)
- [CVE-2019-3585](https://cve.now/CVE-2019-3585.md): VSE Escalation of Privileges through Alert pop-up window (CVSS 7.0, McAfee VirusScan Enterprise)
- [CVE-2020-7279](https://cve.now/CVE-2020-7279.md): DLL search order hijacking in Host IPS (CVSS 4.6, McAfee Host Intrusion Prevention System (Host IPS) for Wind…)
- [CVE-2019-3613](https://cve.now/CVE-2019-3613.md): DLL search order hijacking in MA (CVSS 5.9, McAfee Agent)
- [CVE-2019-3617](https://cve.now/CVE-2019-3617.md): Privilege escalation in ToPS for Mac (CVSS 7.5, McAfee Total Protection (ToPS) for Mac OS)
- [CVE-2020-11798](https://cve.now/CVE-2020-11798.md): A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an (no CVSS)
- [CVE-2020-7580](https://cve.now/CVE-2020-7580.md): A vulnerability has been identified in SIMATIC Automation Tool (All versions \< V4 SP2), SIMATIC NET PC Software V14 (All versions \< V14 SP1 (no CVSS, Siemens SIMATIC Automation Tool · Siemens SIMATIC NET P… +15)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.