# CVEs published 2020-06-15

90 CVEs were published on June 15, 2020: 0 critical, 4 high. Days are UTC.

- [CVE-2020-5358](https://cve.now/CVE-2020-5358.md): Dell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7 contain a privilege escalation vulnerability d (CVSS 6.7, Dell Encryption Enterprise)
- [CVE-2020-14163](https://cve.now/CVE-2020-14163.md): An issue was discovered in ecma/operations/ecma-container-object.c in JerryScript 2.2.0. (no CVSS)
- [CVE-2020-5755](https://cve.now/CVE-2020-5755.md): Webroot endpoint agents prior to version v9.0.28.48 did not protect the "%PROGRAMDATA%\\WrData\\PKG" directory against renaming. (no CVSS, Webroot SecureAnywhere)
- [CVE-2020-5754](https://cve.now/CVE-2020-5754.md): Webroot endpoint agents prior to version v9.0.28.48 allows remote attackers to trigger a type confusion vulnerability over its listening TCP (no CVSS, Webroot SecureAnywhere)
- [CVE-2020-5742](https://cve.now/CVE-2020-5742.md): Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests. (no CVSS, Plex Media Server)
- [CVE-2020-12005](https://cve.now/CVE-2020-12005.md): FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont (no CVSS, FactoryTalk Linx, RSLinx Classic, Connected Components Work…)
- [CVE-2020-12003](https://cve.now/CVE-2020-12003.md): FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont (no CVSS, FactoryTalk Linx, RSLinx Classic, Connected Components Work…)
- [CVE-2020-12001](https://cve.now/CVE-2020-12001.md): FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont (no CVSS, FactoryTalk Linx, RSLinx Classic, Connected Components Work…)
- [CVE-2020-11999](https://cve.now/CVE-2020-11999.md): FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont (no CVSS, FactoryTalk Linx, RSLinx Classic, Connected Components Work…)
- [CVE-2020-12019](https://cve.now/CVE-2020-12019.md): WebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbit (no CVSS, WebAccess Node)
- [CVE-2020-11969](https://cve.now/CVE-2020-11969.md): If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is open (no CVSS, Apache TomEE · org.apache.tomee:tomee)
- [CVE-2020-14159](https://cve.now/CVE-2020-14159.md): By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications (no CVSS)
- [CVE-2020-13650](https://cve.now/CVE-2020-13650.md): An issue was discovered in DigDash 2018R2 before p20200210 and 2019R1 before p20200210. (no CVSS)
- [CVE-2020-13651](https://cve.now/CVE-2020-13651.md): An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200421, and 2019R2 before p20200430. (no CVSS)
- [CVE-2020-13652](https://cve.now/CVE-2020-13652.md): An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200528, 2019R2 before p20200430, and 2020R1 before p20200507. (no CVSS)
- [CVE-2020-14156](https://cve.now/CVE-2020-14156.md): user\_channel/passwd\_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions (no CVSS)
- [CVE-2020-14147](https://cve.now/CVE-2020-14147.md): An integer overflow in the getnum function in lua\_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run L (no CVSS)
- [CVE-2020-14148](https://cve.now/CVE-2020-14148.md): The Server-Server protocol implementation in ngIRCd before 26~rc2 allows an out-of-bounds access, as demonstrated by the IRC\_NJOIN() functio (no CVSS)
- [CVE-2020-14149](https://cve.now/CVE-2020-14149.md): In uftpd before 2.12, handle\_CWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of serv (no CVSS)
- [CVE-2020-14150](https://cve.now/CVE-2020-14150.md): GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). (no CVSS)
- [CVE-2020-14152](https://cve.now/CVE-2020-14152.md): In IJG JPEG (aka libjpeg) before 9d, jpeg\_mem\_available() in jmemnobs.c in djpeg does not honor the max\_memory\_to\_use setting, possibly caus (no CVSS)
- [CVE-2020-14153](https://cve.now/CVE-2020-14153.md): In IJG JPEG (aka libjpeg) from version 8 through 9c, jdhuff.c has an out-of-bounds array read for certain table pointers. (no CVSS)
- [CVE-2020-14154](https://cve.now/CVE-2020-14154.md): Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate (no CVSS)
- [CVE-2019-20838](https://cve.now/CVE-2019-20838.md): libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, (no CVSS)
- [CVE-2018-21245](https://cve.now/CVE-2018-21245.md): Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711. (no CVSS)
- [CVE-2018-21246](https://cve.now/CVE-2018-21246.md): Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostM (no CVSS, github.com/mholt/caddy · github.com/caddyserver/caddy)
- [CVE-2020-14033](https://cve.now/CVE-2020-14033.md): An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. (no CVSS)
- [CVE-2020-14034](https://cve.now/CVE-2020-14034.md): An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. (no CVSS)
- [CVE-2020-13999](https://cve.now/CVE-2020-13999.md): ScaleViewPortExtEx in libemf.cpp in libEMF (aka ECMA-234 Metafile Library) 1.0.12 allows an integer overflow and denial of service via a cra (no CVSS)
- [CVE-2020-13150](https://cve.now/CVE-2020-13150.md): D-link DSL-2750U ISL2750UEME3.V1E devices allow approximately 90 seconds of access to the control panel, after a restart, before MAC address (no CVSS)
- [CVE-2020-14054](https://cve.now/CVE-2020-14054.md): SOKKIA GNR5 Vanguard WEB version 1.2 (build: 91f2b2c3a04d203d79862f87e2440cb7cefc3cd3) and hardware version 212 allows remote attackers to b (no CVSS)
- [CVE-2020-3961](https://cve.now/CVE-2020-3961.md): VMware Horizon Client for Windows (prior to 5.4.3) contains a privilege escalation vulnerability due to folder permission configuration and (no CVSS, VMware Horizon Client for Windows)
- [CVE-2020-9076](https://cve.now/CVE-2020-9076.md): HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B smartphones with versions earlier than 10.1.0.135(C00E135R2P11); versions earlier than 10.1.0.135(C00E1 (no CVSS, HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B)
- [CVE-2020-1825](https://cve.now/CVE-2020-1825.md): FusionAccess with versions earlier than 6.5.1.SPC002 have a Denial of Service (DoS) vulnerability. (no CVSS, FusionAccess)
- [CVE-2020-9075](https://cve.now/CVE-2020-9075.md): Huawei products Secospace USG6300;USG6300E with versions of V500R001C30,V500R001C50,V500R001C60,V500R001C80,V500R005C00,V500R005C10;V600R006 (no CVSS, Secospace USG6300;USG6300E)
- [CVE-2020-9426](https://cve.now/CVE-2020-9426.md): OX Guard 2.10.3 and earlier allows XSS. (no CVSS)
- [CVE-2020-9427](https://cve.now/CVE-2020-9427.md): OX Guard 2.10.3 and earlier allows SSRF. (no CVSS)
- [CVE-2020-14011](https://cve.now/CVE-2020-14011.md): Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in (no CVSS)
- [CVE-2017-18869](https://cve.now/CVE-2017-18869.md): A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended (no CVSS, chownr)
- [CVE-2020-1813](https://cve.now/CVE-2020-1813.md): HUAWEI P30 smart phone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. (no CVSS, HUAWEI P30)
- [CVE-2018-16848](https://cve.now/CVE-2018-16848.md): A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. (no CVSS, openstack-mistral · mistral)
- [CVE-2020-0539](https://cve.now/CVE-2020-0539.md): Path traversal in subsystem for Intel(R) DAL software for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0. (no CVSS, Intel(R) AMT and Intel(R) CSME)
- [CVE-2020-8674](https://cve.now/CVE-2020-8674.md): Out-of-bounds read in DHCPv6 subsystem in Intel(R) AMT and Intel(R)ISM versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64 and 14.0.33 may (no CVSS, Intel(R) AMT and Intel(R) ISM)
- [CVE-2020-0545](https://cve.now/CVE-2020-0545.md): Integer overflow in subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77 and Intel(R) TXE versions before 3.1.75, 4.0.25 (no CVSS, Intel(R) CSME, Intel(R) TXE, and Intel(R) SPS)
- [CVE-2020-0537](https://cve.now/CVE-2020-0537.md): Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow a privileged user (no CVSS, Intel(R) AMT)
- [CVE-2020-0536](https://cve.now/CVE-2020-0536.md): Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and I (no CVSS, Intel(R) CSME)
- [CVE-2020-0540](https://cve.now/CVE-2020-0540.md): Insufficiently protected credentials in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated us (no CVSS, Intel(R) AMT)
- [CVE-2020-0535](https://cve.now/CVE-2020-0535.md): Improper input validation in Intel(R) AMT versions before 11.8.76, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to poten (no CVSS, Intel(R) AMT)
- [CVE-2020-0531](https://cve.now/CVE-2020-0531.md): Improper input validation in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an authenticated user to potenti (no CVSS, Intel(R) AMT)
- [CVE-2020-0597](https://cve.now/CVE-2020-0597.md): Out-of-bounds read in IPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 14.0.33 may allow an unauthenticated user to potential (no CVSS, Intel(R) AMT and Intel(R) ISM)
- [CVE-2020-0541](https://cve.now/CVE-2020-0541.md): Out-of-bounds write in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow a privileged user to pote (no CVSS, Intel(R) CSME)
- [CVE-2020-0532](https://cve.now/CVE-2020-0532.md): Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated (no CVSS, Intel(R) AMT)
- [CVE-2020-0566](https://cve.now/CVE-2020-0566.md): Improper Access Control in subsystem for Intel(R) TXE versions before 3.175 and 4.0.25 may allow an unauthenticated user to potentially enab (no CVSS, Intel(R) TXE)
- [CVE-2020-0533](https://cve.now/CVE-2020-0533.md): Reversible one-way hash in Intel(R) CSME versions before 11.8.76, 11.12.77 and 11.22.77 may allow a privileged user to potentially enable es (no CVSS, Intel(R) CSME)
- [CVE-2020-0534](https://cve.now/CVE-2020-0534.md): Improper input validation in the DAL subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an unauthen (no CVSS, Intel(R) CSME)
- [CVE-2020-0538](https://cve.now/CVE-2020-0538.md): Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated (no CVSS, Intel(R) AMT)
- [CVE-2020-0596](https://cve.now/CVE-2020-0596.md): Improper input validation in DHCPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may a (no CVSS, Intel(R) AMT and Intel(R) ISM)
- [CVE-2020-0542](https://cve.now/CVE-2020-0542.md): Improper buffer restrictions in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an authenticated (no CVSS, Intel(R) CSME)
- [CVE-2020-0586](https://cve.now/CVE-2020-0586.md): Improper initialization in subsystem for Intel(R) SPS versions before SPS\_E3\_04.01.04.109.0 and SPS\_E3\_04.08.04.070.0 may allow an authentic (no CVSS, Intel(R) SPS)
- [CVE-2020-0595](https://cve.now/CVE-2020-0595.md): Use after free in IPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unaut (no CVSS, Intel(R) AMT and Intel(R) ISM)
- [CVE-2020-0594](https://cve.now/CVE-2020-0594.md): Out-of-bounds read in IPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an u (no CVSS, Intel(R) AMT and Intel(R) ISM)
- [CVE-2020-0543](https://cve.now/CVE-2020-0543.md): Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially (no CVSS, Intel(R) Processors)
- [CVE-2020-0529](https://cve.now/CVE-2020-0529.md): Improper initialization in BIOS firmware for 8th, 9th and 10th Generation Intel(R) Core(TM) Processor families may allow an unauthenticated (no CVSS, BIOS)
- [CVE-2020-0528](https://cve.now/CVE-2020-0528.md): Improper buffer restrictions in BIOS firmware for 7th, 8th, 9th and 10th Generation Intel(R) Core(TM) Processor families may allow an authen (no CVSS, BIOS)
- [CVE-2020-8675](https://cve.now/CVE-2020-8675.md): Insufficient control flow management in firmware build and signing tool for Intel(R) Innovation Engine before version 1.0.859 may allow an u (no CVSS, Intel(R)Innovation Engine Advisory)
- [CVE-2020-0527](https://cve.now/CVE-2020-0527.md): Insufficient control flow management in firmware for some Intel(R) Data Center SSDs may allow a privileged user to potentially enable inform (no CVSS, Intel(R) SSD)
- [CVE-2020-14146](https://cve.now/CVE-2020-14146.md): KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATH\_INFO. (no CVSS, kumbiaphp/kumbiapp)
- [CVE-2020-4494](https://cve.now/CVE-2020-4494.md): IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Man (CVSS 7.5, IBM Spectrum Protect for Space Management · IBM Spectrum Pr…)
- [CVE-2020-4477](https://cve.now/CVE-2020-4477.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be us (CVSS 5.3, IBM Spectrum Protect Plus)
- [CVE-2020-4471](https://cve.now/CVE-2020-4471.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions (CVSS 4.8, IBM Spectrum Protect Plus)
- [CVE-2020-4470](https://cve.now/CVE-2020-4470.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which (CVSS 7.1, IBM Spectrum Protect Plus)
- [CVE-2020-4469](https://cve.now/CVE-2020-4469.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. (CVSS 8.1, IBM Spectrum Protect Plus)
- [CVE-2020-4406](https://cve.now/CVE-2020-4406.md): IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Man (CVSS 5.4, IBM Spectrum Protect Client · IBM Spectrum Protect for Spac…)
- [CVE-2020-4216](https://cve.now/CVE-2020-4216.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for (CVSS 7.5, IBM Spectrum Protect Plus)
- [CVE-2019-19111](https://cve.now/CVE-2019-19111.md): The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter. (no CVSS)
- [CVE-2019-19110](https://cve.now/CVE-2019-19110.md): The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter. (no CVSS)
- [CVE-2019-19109](https://cve.now/CVE-2019-19109.md): The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. (no CVSS)
- [CVE-2019-19112](https://cve.now/CVE-2019-19112.md): The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php. (no CVSS)
- [CVE-2020-14076](https://cve.now/CVE-2020-14076.md): TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. (no CVSS)
- [CVE-2020-14093](https://cve.now/CVE-2020-14093.md): Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. (no CVSS)
- [CVE-2020-14074](https://cve.now/CVE-2020-14074.md): TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. (no CVSS)
- [CVE-2020-14075](https://cve.now/CVE-2020-14075.md): TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action pppoe\_connect, ru\_pppoe\_connect, (no CVSS)
- [CVE-2020-14077](https://cve.now/CVE-2020-14077.md): TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. (no CVSS)
- [CVE-2020-14078](https://cve.now/CVE-2020-14078.md): TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. (no CVSS)
- [CVE-2020-14079](https://cve.now/CVE-2020-14079.md): TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. (no CVSS)
- [CVE-2020-14080](https://cve.now/CVE-2020-14080.md): TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. (no CVSS)
- [CVE-2020-14081](https://cve.now/CVE-2020-14081.md): TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action send\_log\_email with the key auth (no CVSS)
- [CVE-2020-14067](https://cve.now/CVE-2020-14067.md): The install\_from\_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining files within a ZIP archive tha (no CVSS)
- [CVE-2020-14155](https://cve.now/CVE-2020-14155.md): libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. (no CVSS, gitlab)
- [CVE-2020-4051](https://cve.now/CVE-2020-4051.md): XSS in Dijit Editor's LinkDialog plugin (CVSS 3.7, Dojo dijit · dijit)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.