# CVEs published 2020-06-16

53 CVEs were published on June 16, 2020: 0 critical, 2 high. Days are UTC.

- [CVE-2020-14214](https://cve.now/CVE-2020-14214.md): Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. (no CVSS)
- [CVE-2020-14213](https://cve.now/CVE-2020-14213.md): In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge). (no CVSS)
- [CVE-2020-4054](https://cve.now/CVE-2020-4054.md): Cross-site Scripting in Sanitize (CVSS 7.3, rgrove Sanitize · sanitize)
- [CVE-2020-4053](https://cve.now/CVE-2020-4053.md): Path Traversal in Helm Plugin Archive (CVSS 3.7, The Helm Project Helm · helm.sh/helm/v3)
- [CVE-2020-14212](https://cve.now/CVE-2020-14212.md): FFmpeg through 4.3 has a heap-based buffer overflow in avio\_get\_str in libavformat/aviobuf.c because dnn\_backend\_native.c calls ff\_dnn\_load\_ (no CVSS)
- [CVE-2020-4052](https://cve.now/CVE-2020-4052.md): Stored XSS through template injection in Wiki.js (CVSS 6.3, Requarks.io Wiki.js)
- [CVE-2020-14210](https://cve.now/CVE-2020-14210.md): Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL informat (no CVSS)
- [CVE-2019-17655](https://cve.now/CVE-2019-17655.md): A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2. (CVSS 5.3, Fortinet FortiOS and FortiProxy)
- [CVE-2020-9289](https://cve.now/CVE-2020-9289.md): Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and (no CVSS, Fortinet FortiManager)
- [CVE-2020-7513](https://cve.now/CVE-2020-7513.md): A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could al (no CVSS, Easergy T300)
- [CVE-2020-7512](https://cve.now/CVE-2020-7512.md): A CWE-1103: Use of Platform-Dependent Third Party Components with vulnerabilities vulnerability exists in Easergy T300 (Firmware version 1.5 (no CVSS, Easergy T300)
- [CVE-2020-7511](https://cve.now/CVE-2020-7511.md): A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which co (no CVSS, Easergy T300)
- [CVE-2020-7510](https://cve.now/CVE-2020-7510.md): A CWE-200: Information Exposure vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow attacker to obtain (no CVSS, Easergy T300)
- [CVE-2020-7509](https://cve.now/CVE-2020-7509.md): A CWE-269: Improper privilege management (write) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow a (no CVSS, Easergy T300)
- [CVE-2020-7508](https://cve.now/CVE-2020-7508.md): A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) (no CVSS, Easergy T300)
- [CVE-2020-7507](https://cve.now/CVE-2020-7507.md): A CWE-400: Uncontrolled Resource Consumption vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an at (no CVSS, Easergy T300)
- [CVE-2020-7506](https://cve.now/CVE-2020-7506.md): A CWE-200: Information Exposure vulnerability exists in Easergy T300, Firmware V1.5.2 and prior, which could allow an attacker to pack or un (no CVSS, Easergy T300 Firmware V1.5.2 and prior)
- [CVE-2020-7505](https://cve.now/CVE-2020-7505.md): A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow (no CVSS, Easergy T300)
- [CVE-2020-7504](https://cve.now/CVE-2020-7504.md): A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to (no CVSS, Easergy T300)
- [CVE-2020-7503](https://cve.now/CVE-2020-7503.md): A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an at (no CVSS, Easergy T300)
- [CVE-2020-13162](https://cve.now/CVE-2020-13162.md): A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windo (CVSS 7.0)
- [CVE-2020-7502](https://cve.now/CVE-2020-7502.md): A CWE-787: Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (Firmware version 4.3 and prior), which may cause a Den (no CVSS, Modicon M218 Logic Controller)
- [CVE-2020-7501](https://cve.now/CVE-2020-7501.md): A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP (no CVSS, Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo D…)
- [CVE-2020-7500](https://cve.now/CVE-2020-7500.md): A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and T (no CVSS, U.motion Servers and Touch Panels)
- [CVE-2020-7499](https://cve.now/CVE-2020-7499.md): A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notif (no CVSS, U.motion Servers and Touch Panels)
- [CVE-2020-7498](https://cve.now/CVE-2020-7498.md): A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). (no CVSS, Unity Loader and OS Loader Software)
- [CVE-2020-7497](https://cve.now/CVE-2020-7497.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Termin (no CVSS, EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…)
- [CVE-2020-7496](https://cve.now/CVE-2020-7496.md): A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (form (no CVSS, EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…)
- [CVE-2020-7495](https://cve.now/CVE-2020-7495.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file extraction exists in (no CVSS, EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…)
- [CVE-2020-7494](https://cve.now/CVE-2020-7494.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Termin (no CVSS, EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…)
- [CVE-2020-7493](https://cve.now/CVE-2020-7493.md): A CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in EcoStruxure Operator (no CVSS, EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and…)
- [CVE-2020-7492](https://cve.now/CVE-2020-7492.md): A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the passwo (no CVSS, GP-Pro EX V1.00 to)
- [CVE-2020-10268](https://cve.now/CVE-2020-10268.md): RVD#2550: Terminate Critical Services in KUKA controller KR C4 (no CVSS, KUKA Roboter KR3R540, KRC4, KSS8.5.7HF1, Win7\_Embedded)
- [CVE-2020-14199](https://cve.now/CVE-2020-14199.md): BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into ma (no CVSS)
- [CVE-2020-14195](https://cve.now/CVE-2020-14195.md): FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-8544](https://cve.now/CVE-2020-8544.md): OX App Suite through 7.10.3 allows SSRF. (no CVSS)
- [CVE-2020-8541](https://cve.now/CVE-2020-8541.md): OX App Suite through 7.10.3 allows XXE attacks. (no CVSS)
- [CVE-2020-8542](https://cve.now/CVE-2020-8542.md): OX App Suite through 7.10.3 allows XSS. (no CVSS)
- [CVE-2020-8543](https://cve.now/CVE-2020-8543.md): OX App Suite through 7.10.3 has Improper Input Validation. (no CVSS)
- [CVE-2020-4320](https://cve.now/CVE-2020-4320.md): IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate (CVSS 5.3, IBM MQ)
- [CVE-2020-4310](https://cve.now/CVE-2020-4310.md): IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the D (CVSS 5.9, IBM WebSphere MQ · IBM MQ)
- [CVE-2019-18614](https://cve.now/CVE-2019-18614.md): On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. (no CVSS)
- [CVE-2020-0223](https://cve.now/CVE-2020-0223.md): This is an unbounded write into kernel global memory, via a user-controlled buffer size.Product: AndroidVersions: Android kernelAndroid ID: (no CVSS, Android)
- [CVE-2020-0235](https://cve.now/CVE-2020-0235.md): In crus\_sp\_shared\_ioctl we first copy 4 bytes from userdata into "size" variable, and then use that variable as the size parameter for "copy (no CVSS, Android)
- [CVE-2020-0232](https://cve.now/CVE-2020-0232.md): Function abc\_pcie\_issue\_dma\_xfer\_sync creates a transfer object, adds it to the session object then continues to work with it. (no CVSS, Android)
- [CVE-2020-0234](https://cve.now/CVE-2020-0234.md): In crus\_afe\_get\_param of msm-cirrus-playback.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-12494](https://cve.now/CVE-2020-12494.md): Beckhoff: Etherleak in TwinCAT RT network driver (CVSS 5.3, Beckhoff TwinCat Driver for Intel)
- [CVE-2020-9296](https://cve.now/CVE-2020-9296.md): Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. (no CVSS, Netflix Titus · com.netflix.conductor:conductor-core)
- [CVE-2020-11841](https://cve.now/CVE-2020-11841.md): Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, (no CVSS, ArcSight Management Center.)
- [CVE-2020-11838](https://cve.now/CVE-2020-11838.md): Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x pr (no CVSS, ArcSight Management Center.)
- [CVE-2020-11840](https://cve.now/CVE-2020-11840.md): Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, (no CVSS, ArcSight Management Center.)
- [CVE-2020-9522](https://cve.now/CVE-2020-9522.md): Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, Affecting versions 7.0.x, 7.2 an (no CVSS, ArcSight Enterprise Security Manager (ESM).)
- [CVE-2020-13431](https://cve.now/CVE-2020-13431.md): I2P before 0.9.46 allows local users to gain privileges via a Trojan horse I2PSvc.exe file because of weak permissions on a certain %PROGRAM (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.