CVEs published June 16, 2020
53 CVEs were published on June 16, 2020: 0 critical, 2 high.
- Published
- 53
- Critical
- 0
- High
- 2
- Medium
- 5
- Low
- 1
- Unrated
- 45
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Easergy T300
- 10
- EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…
- 5
- Android
- 4
- ArcSight Management Center.
- 3
- U.motion Servers and Touch Panels
- 2
- ArcSight Enterprise Security Manager (ESM).
- 1
- Beckhoff TwinCat Driver for Intel
- 1
- com.fasterxml.jackson.core:jackson-databind
- 1
- Easergy T300 Firmware V1.5.2 and prior
- 1
- Fortinet FortiManager
- 1
High 2
Medium, low and unrated 51
- CVE-2020-14214Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions.
- CVE-2020-14213In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge).
- CVE-2020-4053Path Traversal in Helm Plugin ArchiveThe Helm Project Helm · helm.sh/helm/v3
- CVE-2020-14212FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_
- CVE-2020-4052Stored XSS through template injection in Wiki.jsRequarks.io Wiki.js
- CVE-2020-14210Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL informat
- CVE-2019-17655A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.Fortinet FortiOS and FortiProxy
- CVE-2020-9289Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 andFortinet FortiManager
- CVE-2020-7513A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could alEasergy T300
- CVE-2020-7512A CWE-1103: Use of Platform-Dependent Third Party Components with vulnerabilities vulnerability exists in Easergy T300 (Firmware version 1.5Easergy T300
- CVE-2020-7511A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which coEasergy T300
- CVE-2020-7510A CWE-200: Information Exposure vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow attacker to obtainEasergy T300
- CVE-2020-7509A CWE-269: Improper privilege management (write) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow aEasergy T300
- CVE-2020-7508A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) Easergy T300
- CVE-2020-7507A CWE-400: Uncontrolled Resource Consumption vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an atEasergy T300
- CVE-2020-7506A CWE-200: Information Exposure vulnerability exists in Easergy T300, Firmware V1.5.2 and prior, which could allow an attacker to pack or unEasergy T300 Firmware V1.5.2 and prior
- CVE-2020-7505A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allowEasergy T300
- CVE-2020-7504A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker toEasergy T300
- CVE-2020-7503A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an atEasergy T300
- CVE-2020-7502A CWE-787: Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (Firmware version 4.3 and prior), which may cause a DenModicon M218 Logic Controller
- CVE-2020-7501A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SPVijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo D…
- CVE-2020-7500A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and TU.motion Servers and Touch Panels
- CVE-2020-7499A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notifU.motion Servers and Touch Panels
- CVE-2020-7498A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions).Unity Loader and OS Loader Software
- CVE-2020-7497A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator TerminEcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…
- CVE-2020-7496A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formEcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…
- CVE-2020-7495A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…
- CVE-2020-7494A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator TerminEcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…
- CVE-2020-7493A CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in EcoStruxure Operator EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…
- CVE-2020-7492A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the passwoGP-Pro EX V1.00 to
- CVE-2020-10268RVD#2550: Terminate Critical Services in KUKA controller KR C4KUKA Roboter KR3R540, KRC4, KSS8.5.7HF1, Win7_Embedded
- CVE-2020-14199BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into ma
- CVE-2020-14195FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecuritycom.fasterxml.jackson.core:jackson-databind
- CVE-2020-8544OX App Suite through 7.10.3 allows SSRF.
- CVE-2020-8541OX App Suite through 7.10.3 allows XXE attacks.
- CVE-2020-8542OX App Suite through 7.10.3 allows XSS.
- CVE-2020-8543OX App Suite through 7.10.3 has Improper Input Validation.
- CVE-2020-4320IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificateIBM MQ
- CVE-2020-4310IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the DIBM WebSphere MQ · IBM MQ
- CVE-2019-18614On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow.
- CVE-2020-0223This is an unbounded write into kernel global memory, via a user-controlled buffer size.Product: AndroidVersions: Android kernelAndroid ID: Android
- CVE-2020-0235In crus_sp_shared_ioctl we first copy 4 bytes from userdata into "size" variable, and then use that variable as the size parameter for "copyAndroid
- CVE-2020-0232Function abc_pcie_issue_dma_xfer_sync creates a transfer object, adds it to the session object then continues to work with it.Android
- CVE-2020-0234In crus_afe_get_param of msm-cirrus-playback.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-12494Beckhoff: Etherleak in TwinCAT RT network driverBeckhoff TwinCat Driver for Intel
- CVE-2020-9296Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators.Netflix Titus · com.netflix.conductor:conductor-core
- CVE-2020-11841Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x,ArcSight Management Center.
- CVE-2020-11838Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prArcSight Management Center.
- CVE-2020-11840Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x,ArcSight Management Center.
- CVE-2020-9522Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, Affecting versions 7.0.x, 7.2 anArcSight Enterprise Security Manager (ESM).
- CVE-2020-13431I2P before 0.9.46 allows local users to gain privileges via a Trojan horse I2PSvc.exe file because of weak permissions on a certain %PROGRAM