CVEs published June 15, 2020
90 CVEs were published on June 15, 2020: 0 critical, 4 high.
- Published
- 90
- Critical
- 0
- High
- 4
- Medium
- 4
- Low
- 1
- Unrated
- 81
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Intel(R) AMT
- 6
- IBM Spectrum Protect Plus
- 5
- Intel(R) AMT and Intel(R) ISM
- 5
- Intel(R) CSME
- 5
- FactoryTalk Linx, RSLinx Classic, Connected Components Work…
- 4
- BIOS
- 2
- Webroot SecureAnywhere
- 2
- Apache TomEE · org.apache.tomee:tomee
- 1
- chownr
- 1
- Dell Encryption Enterprise
- 1
High 4
- CVE-2020-4494IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space ManIBM Spectrum Protect for Space Management · IBM Spectrum Pr…
- CVE-2020-4470IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files whichIBM Spectrum Protect Plus
- CVE-2020-4469IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system.IBM Spectrum Protect Plus
- CVE-2020-4216IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for IBM Spectrum Protect Plus
Medium, low and unrated 86
- CVE-2020-5358Dell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7 contain a privilege escalation vulnerability dDell Encryption Enterprise
- CVE-2020-14163An issue was discovered in ecma/operations/ecma-container-object.c in JerryScript 2.2.0.
- CVE-2020-5755Webroot endpoint agents prior to version v9.0.28.48 did not protect the "%PROGRAMDATA%\WrData\PKG" directory against renaming.Webroot SecureAnywhere
- CVE-2020-5754Webroot endpoint agents prior to version v9.0.28.48 allows remote attackers to trigger a type confusion vulnerability over its listening TCPWebroot SecureAnywhere
- CVE-2020-5742Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests.Plex Media Server
- CVE-2020-12005FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContFactoryTalk Linx, RSLinx Classic, Connected Components Work…
- CVE-2020-12003FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContFactoryTalk Linx, RSLinx Classic, Connected Components Work…
- CVE-2020-12001FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContFactoryTalk Linx, RSLinx Classic, Connected Components Work…
- CVE-2020-11999FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ContFactoryTalk Linx, RSLinx Classic, Connected Components Work…
- CVE-2020-12019WebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitWebAccess Node
- CVE-2020-11969If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is openApache TomEE · org.apache.tomee:tomee
- CVE-2020-14159By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications
- CVE-2020-13650An issue was discovered in DigDash 2018R2 before p20200210 and 2019R1 before p20200210.
- CVE-2020-13651An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200421, and 2019R2 before p20200430.
- CVE-2020-13652An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200528, 2019R2 before p20200430, and 2020R1 before p20200507.
- CVE-2020-14156user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions
- CVE-2020-14147An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run L
- CVE-2020-14148The Server-Server protocol implementation in ngIRCd before 26~rc2 allows an out-of-bounds access, as demonstrated by the IRC_NJOIN() functio
- CVE-2020-14149In uftpd before 2.12, handle_CWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of serv
- CVE-2020-14150GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash).
- CVE-2020-14152In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly caus
- CVE-2020-14153In IJG JPEG (aka libjpeg) from version 8 through 9c, jdhuff.c has an out-of-bounds array read for certain table pointers.
- CVE-2020-14154Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate
- CVE-2019-20838libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier,
- CVE-2018-21245Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.
- CVE-2018-21246Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMgithub.com/mholt/caddy · github.com/caddyserver/caddy
- CVE-2020-14033An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.
- CVE-2020-14034An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0.
- CVE-2020-13999ScaleViewPortExtEx in libemf.cpp in libEMF (aka ECMA-234 Metafile Library) 1.0.12 allows an integer overflow and denial of service via a cra
- CVE-2020-13150D-link DSL-2750U ISL2750UEME3.V1E devices allow approximately 90 seconds of access to the control panel, after a restart, before MAC address
- CVE-2020-14054SOKKIA GNR5 Vanguard WEB version 1.2 (build: 91f2b2c3a04d203d79862f87e2440cb7cefc3cd3) and hardware version 212 allows remote attackers to b
- CVE-2020-3961VMware Horizon Client for Windows (prior to 5.4.3) contains a privilege escalation vulnerability due to folder permission configuration and VMware Horizon Client for Windows
- CVE-2020-9076HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B smartphones with versions earlier than 10.1.0.135(C00E135R2P11); versions earlier than 10.1.0.135(C00E1HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B
- CVE-2020-1825FusionAccess with versions earlier than 6.5.1.SPC002 have a Denial of Service (DoS) vulnerability.FusionAccess
- CVE-2020-9075Huawei products Secospace USG6300;USG6300E with versions of V500R001C30,V500R001C50,V500R001C60,V500R001C80,V500R005C00,V500R005C10;V600R006Secospace USG6300;USG6300E
- CVE-2020-9426OX Guard 2.10.3 and earlier allows XSS.
- CVE-2020-9427OX Guard 2.10.3 and earlier allows SSRF.
- CVE-2020-14011Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in
- CVE-2017-18869A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintendedchownr
- CVE-2020-1813HUAWEI P30 smart phone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability.HUAWEI P30
- CVE-2018-16848A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3.openstack-mistral · mistral
- CVE-2020-0539Path traversal in subsystem for Intel(R) DAL software for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.Intel(R) AMT and Intel(R) CSME
- CVE-2020-8674Out-of-bounds read in DHCPv6 subsystem in Intel(R) AMT and Intel(R)ISM versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64 and 14.0.33 may Intel(R) AMT and Intel(R) ISM
- CVE-2020-0545Integer overflow in subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77 and Intel(R) TXE versions before 3.1.75, 4.0.25 Intel(R) CSME, Intel(R) TXE, and Intel(R) SPS
- CVE-2020-0537Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow a privileged user Intel(R) AMT
- CVE-2020-0536Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and IIntel(R) CSME
- CVE-2020-0540Insufficiently protected credentials in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated usIntel(R) AMT
- CVE-2020-0535Improper input validation in Intel(R) AMT versions before 11.8.76, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potenIntel(R) AMT
- CVE-2020-0531Improper input validation in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an authenticated user to potentiIntel(R) AMT
- CVE-2020-0597Out-of-bounds read in IPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 14.0.33 may allow an unauthenticated user to potentialIntel(R) AMT and Intel(R) ISM
- CVE-2020-0541Out-of-bounds write in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow a privileged user to poteIntel(R) CSME
- CVE-2020-0532Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticatedIntel(R) AMT
- CVE-2020-0566Improper Access Control in subsystem for Intel(R) TXE versions before 3.175 and 4.0.25 may allow an unauthenticated user to potentially enabIntel(R) TXE
- CVE-2020-0533Reversible one-way hash in Intel(R) CSME versions before 11.8.76, 11.12.77 and 11.22.77 may allow a privileged user to potentially enable esIntel(R) CSME
- CVE-2020-0534Improper input validation in the DAL subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an unauthenIntel(R) CSME
- CVE-2020-0538Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticatedIntel(R) AMT
- CVE-2020-0596Improper input validation in DHCPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may aIntel(R) AMT and Intel(R) ISM
- CVE-2020-0542Improper buffer restrictions in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an authenticatedIntel(R) CSME
- CVE-2020-0586Improper initialization in subsystem for Intel(R) SPS versions before SPS_E3_04.01.04.109.0 and SPS_E3_04.08.04.070.0 may allow an authenticIntel(R) SPS
- CVE-2020-0595Use after free in IPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unautIntel(R) AMT and Intel(R) ISM
- CVE-2020-0594Out-of-bounds read in IPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an uIntel(R) AMT and Intel(R) ISM
- CVE-2020-0543Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentiallyIntel(R) Processors
- CVE-2020-0529Improper initialization in BIOS firmware for 8th, 9th and 10th Generation Intel(R) Core(TM) Processor families may allow an unauthenticated BIOS
- CVE-2020-0528Improper buffer restrictions in BIOS firmware for 7th, 8th, 9th and 10th Generation Intel(R) Core(TM) Processor families may allow an authenBIOS
- CVE-2020-8675Insufficient control flow management in firmware build and signing tool for Intel(R) Innovation Engine before version 1.0.859 may allow an uIntel(R)Innovation Engine Advisory
- CVE-2020-0527Insufficient control flow management in firmware for some Intel(R) Data Center SSDs may allow a privileged user to potentially enable informIntel(R) SSD
- CVE-2020-14146KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATH_INFO.kumbiaphp/kumbiapp
- CVE-2020-4477IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be usIBM Spectrum Protect Plus
- CVE-2020-4471IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions IBM Spectrum Protect Plus
- CVE-2020-4406IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space ManIBM Spectrum Protect Client · IBM Spectrum Protect for Spac…
- CVE-2019-19111The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.
- CVE-2019-19110The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.
- CVE-2019-19109The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.
- CVE-2019-19112The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.
- CVE-2020-14076TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary.
- CVE-2020-14093Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.
- CVE-2020-14074TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary.
- CVE-2020-14075TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action pppoe_connect, ru_pppoe_connect,
- CVE-2020-14077TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary.
- CVE-2020-14078TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary.
- CVE-2020-14079TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary.
- CVE-2020-14080TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary.
- CVE-2020-14081TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action send_log_email with the key auth
- CVE-2020-14067The install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining files within a ZIP archive tha
- CVE-2020-14155libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.gitlab
- CVE-2020-4051XSS in Dijit Editor's LinkDialog pluginDojo dijit · dijit