# CVEs published 2020-06-17 51 CVEs were published on June 17, 2020: 2 critical, 2 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2020-8619](https://cve.now/CVE-2020-8619.md): A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer (CVSS 4.9, ISC BIND9) - [CVE-2020-8618](https://cve.now/CVE-2020-8618.md): A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer (CVSS 4.9, ISC BIND9) - [CVE-2020-14157](https://cve.now/CVE-2020-14157.md): The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used pro (no CVSS) - [CVE-2020-14040](https://cve.now/CVE-2020-14040.md): The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite lo (no CVSS, golang.org/x/text) - [CVE-2020-14408](https://cve.now/CVE-2020-14408.md): An issue was discovered in Agentejo Cockpit 0.10.2. (no CVSS) - [CVE-2020-4532](https://cve.now/CVE-2020-4532.md): IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could (CVSS 5.3, IBM Business Process Manager Express) - [CVE-2020-6869](https://cve.now/CVE-2020-6869.md): All versions up to 10.06 of ZTEMarket APK are impacted by an information leak vulnerability. (no CVSS, \) - [CVE-2020-9332](https://cve.now/CVE-2020-9332.md): ftusbbus2.sys in FabulaTech USB for Remote Desktop through 2020-02-19 allows privilege escalation via crafted IoCtl code related to a USB HI (no CVSS) - [CVE-2020-13637](https://cve.now/CVE-2020-13637.md): An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. (no CVSS) - [CVE-2020-6752](https://cve.now/CVE-2020-6752.md): In OMERO before 5.6.1, group owners can access members' data in other groups. (no CVSS) - [CVE-2019-16245](https://cve.now/CVE-2019-16245.md): OMERO before 5.6.1 makes the details of each user available to all users. (no CVSS) - [CVE-2020-7932](https://cve.now/CVE-2020-7932.md): OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. (no CVSS, omero-web) - [CVE-2019-9943](https://cve.now/CVE-2019-9943.md): In ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy Environment OMERO.server 5.1.0 through 5.6.0, permissions on OMER (no CVSS) - [CVE-2019-9944](https://cve.now/CVE-2019-9944.md): In Open Microscopy Environment OMERO.server 5.0.0 through 5.6.0, the reading of files from imported image filesets may circumvent OMERO perm (no CVSS) - [CVE-2020-7668](https://cve.now/CVE-2020-7668.md): Arbitrary File Write via Archive Extraction (Zip Slip) (CVSS 7.5, github.com/unknwon/cae/tz · github.com/unknwon/cae) - [CVE-2020-7664](https://cve.now/CVE-2020-7664.md): Arbitrary File Write via Archive Extraction (Zip Slip) (CVSS 7.5, github.com/unknwon/cae/zip · github.com/unknwon/cae) - [CVE-2020-14396](https://cve.now/CVE-2020-14396.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2020-14397](https://cve.now/CVE-2020-14397.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2020-14398](https://cve.now/CVE-2020-14398.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2020-14399](https://cve.now/CVE-2020-14399.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2020-14400](https://cve.now/CVE-2020-14400.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2020-14401](https://cve.now/CVE-2020-14401.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2020-14402](https://cve.now/CVE-2020-14402.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2020-14403](https://cve.now/CVE-2020-14403.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2020-14404](https://cve.now/CVE-2020-14404.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2020-14405](https://cve.now/CVE-2020-14405.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2019-20839](https://cve.now/CVE-2019-20839.md): libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename. (no CVSS) - [CVE-2019-20840](https://cve.now/CVE-2019-20840.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2018-21247](https://cve.now/CVE-2018-21247.md): An issue was discovered in LibVNCServer before 0.9.13. (no CVSS) - [CVE-2020-14295](https://cve.now/CVE-2020-14295.md): A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. (no CVSS) - [CVE-2020-12827](https://cve.now/CVE-2020-12827.md): MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document. (no CVSS, mjml) - [CVE-2020-13224](https://cve.now/CVE-2020-13224.md): TP-LINK NC200 devices through 2.1.10 build 200401, NC210 devices through 1.0.10 build 200401, NC220 devices through 1.3.1 build 200401, NC23 (no CVSS) - [CVE-2020-11914](https://cve.now/CVE-2020-11914.md): The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read. (no CVSS) - [CVE-2020-11913](https://cve.now/CVE-2020-11913.md): The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read. (no CVSS) - [CVE-2020-11912](https://cve.now/CVE-2020-11912.md): The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read. (no CVSS) - [CVE-2020-11911](https://cve.now/CVE-2020-11911.md): The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control. (no CVSS) - [CVE-2020-11910](https://cve.now/CVE-2020-11910.md): The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read. (CVSS 9.8) - [CVE-2020-11909](https://cve.now/CVE-2020-11909.md): The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow. (CVSS 9.1) - [CVE-2020-11908](https://cve.now/CVE-2020-11908.md): The Treck TCP/IP stack before 4.7.1.27 mishandles '\\0' termination in DHCP. (no CVSS) - [CVE-2020-11907](https://cve.now/CVE-2020-11907.md): The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP. (no CVSS) - [CVE-2020-11906](https://cve.now/CVE-2020-11906.md): The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow. (no CVSS) - [CVE-2020-11905](https://cve.now/CVE-2020-11905.md): The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read. (no CVSS) - [CVE-2020-11904](https://cve.now/CVE-2020-11904.md): The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write. (no CVSS) - [CVE-2020-11903](https://cve.now/CVE-2020-11903.md): The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read. (no CVSS) - [CVE-2020-11902](https://cve.now/CVE-2020-11902.md): The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read. (no CVSS) - [CVE-2020-11901](https://cve.now/CVE-2020-11901.md): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response. (no CVSS) - [CVE-2020-11900](https://cve.now/CVE-2020-11900.md): The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free. (no CVSS) - [CVE-2020-11899](https://cve.now/CVE-2020-11899.md): The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read. (CVSS 5.4, KEV) - [CVE-2020-11898](https://cve.now/CVE-2020-11898.md): The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers (no CVSS) - [CVE-2020-11897](https://cve.now/CVE-2020-11897.md): The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets. (no CVSS) - [CVE-2020-11896](https://cve.now/CVE-2020-11896.md): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-06-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.