CVEs published June 26, 2020
104 CVEs were published on June 26, 2020: 0 critical, 14 high.
- Published
- 104
- Critical
- 0
- High
- 14
- Medium
- 5
- Low
- 1
- Unrated
- 84
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Adobe Bridge
- 17
- Adobe Magento · magento/community-edition +2
- 14
- Adobe DNG Software Development Kit
- 12
- Adobe Illustrator
- 5
- Adobe ColdFusion
- 3
- Adobe Magento · magento/community-edition +1
- 2
- ControlEdge PLC · ControlEdge RTU
- 2
- IBM Maximo Asset Management
- 2
- Adobe After Effects
- 1
- Adobe Character Animator
- 1
High 14
- CVE-2020-9563Adobe Bridge versions 10.0.1 and earlier version have a heap overflow vulnerability.Adobe Bridge
- CVE-2020-9564Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability.Adobe Bridge
- CVE-2020-9556Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability.Adobe Bridge
- CVE-2020-9560Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability.Adobe Bridge
- CVE-2020-9561Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability.Adobe Bridge
- CVE-2020-9555Adobe Bridge versions 10.0.1 and earlier version have a stack-based buffer overflow vulnerability.Adobe Bridge
- CVE-2020-9562Adobe Bridge versions 10.0.1 and earlier version have a heap overflow vulnerability.Adobe Bridge
- CVE-2020-9559Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability.Adobe Bridge
- CVE-2020-9554Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability.Adobe Bridge
- CVE-2020-9565Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability.Adobe Bridge
- CVE-2020-9566Adobe Bridge versions 10.0.1 and earlier version have an use after free vulnerability.Adobe Bridge
- CVE-2020-9569Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability.Adobe Bridge
- CVE-2020-9568Adobe Bridge versions 10.0.1 and earlier version have a memory corruption vulnerability.Adobe Bridge
- CVE-2020-9567Adobe Bridge versions 10.0.1 and earlier version have an use after free vulnerability.Adobe Bridge
Medium, low and unrated 90
- CVE-2020-4089HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol.HCL Notes
- CVE-2020-9577Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scAdobe Magento · magento/community-edition +2
- CVE-2020-9576Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vuAdobe Magento · magento/community-edition +2
- CVE-2020-3809Adobe After Effects versions 17.0.1 and earlier have an out-of-bounds read vulnerability.Adobe After Effects
- CVE-2020-3796ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an improper access control vulnerability.Adobe ColdFusion
- CVE-2020-9588Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing dAdobe Magento · magento/community-edition +2
- CVE-2020-9578Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vuAdobe Magento · magento/community-edition +2
- CVE-2020-9631Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation Adobe Magento · magento/community-edition +2
- CVE-2020-9630Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic errorAdobe Magento · magento/community-edition +2
- CVE-2020-9591Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth secAdobe Magento · magento/community-edition +1
- CVE-2020-9632Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation Adobe Magento · magento/community-edition +2
- CVE-2020-9580Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation Adobe Magento · magento/community-edition +2
- CVE-2020-3768ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerability.Adobe ColdFusion
- CVE-2020-9581Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scAdobe Magento · magento/community-edition +2
- CVE-2020-9582Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vuAdobe Magento · magento/community-edition +2
- CVE-2020-9583Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vuAdobe Magento · magento/community-edition +2
- CVE-2020-9587Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypasAdobe Magento · magento/community-edition +2
- CVE-2020-9584Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scAdobe Magento · magento/community-edition +2
- CVE-2020-9579Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation Adobe Magento · magento/community-edition +1
- CVE-2020-9585Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth secAdobe Magento · magento/community-edition +2
- CVE-2020-3767ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulnerability.Adobe ColdFusion
- CVE-2020-9574Adobe Illustrator versions 24.0.2 and earlier have a memory corruption vulnerability.Adobe Illustrator
- CVE-2020-9572Adobe Illustrator versions 24.0.2 and earlier have a memory corruption vulnerability.Adobe Illustrator
- CVE-2020-9570Adobe Illustrator versions 24.0.2 and earlier have a memory corruption vulnerability.Adobe Illustrator
- CVE-2020-9573Adobe Illustrator versions 24.0.2 and earlier have a memory corruption vulnerability.Adobe Illustrator
- CVE-2020-9571Adobe Illustrator versions 24.0.2 and earlier have a memory corruption vulnerability.Adobe Illustrator
- CVE-2020-9557Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds read vulnerability.Adobe Bridge
- CVE-2020-9553Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds read vulnerability.Adobe Bridge
- CVE-2020-3798Adobe Digital Editions versions 4.5.11.187212 and below have a file enumeration (host or local network) vulnerability.Adobe Digital Editions
- CVE-2020-9558Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds read vulnerability.Adobe Bridge
- CVE-2020-9627Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability.Adobe DNG Software Development Kit
- CVE-2020-9628Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability.Adobe DNG Software Development Kit
- CVE-2020-9625Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability.Adobe DNG Software Development Kit
- CVE-2020-9623Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability.Adobe DNG Software Development Kit
- CVE-2020-9622Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability.Adobe DNG Software Development Kit
- CVE-2020-9629Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability.Adobe DNG Software Development Kit
- CVE-2020-9624Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability.Adobe DNG Software Development Kit
- CVE-2020-9621Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability.Adobe DNG Software Development Kit
- CVE-2020-9586Adobe Character Animator versions 3.2 and earlier have a buffer overflow vulnerability.Adobe Character Animator
- CVE-2020-9620Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability.Adobe DNG Software Development Kit
- CVE-2020-9590Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability.Adobe DNG Software Development Kit
- CVE-2020-9616Adobe Premiere Pro versions 14.1 and earlier have an out-of-bounds read vulnerability.Adobe Premiere Pro
- CVE-2020-9617Adobe Premiere Rush versions 1.5.8 and earlier have an out-of-bounds read vulnerability.Adobe Premiere Rush
- CVE-2020-9589Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability.Adobe DNG Software Development Kit
- CVE-2020-9626Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability.Adobe DNG Software Development Kit
- CVE-2013-7489The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution.beaker
- CVE-2020-15351IDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILES(X86)%\IDriveWindows with weak folder permissions granting any user mo
- CVE-2020-9047exacqVision Software - Improper Verification of Cryptographic SignatureJohnson Controls exacqVision Web Service versions 20.03.2.0…
- CVE-2020-14955In Jiangmin Antivirus 16.0.13.129, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspec
- CVE-2020-11996A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could tApache Tomcat · tomcat +2
- CVE-2020-10624ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network.ControlEdge PLC · ControlEdge RTU
- CVE-2020-14477Philips Ultrasound Systems Authentication Bypass Using an Alternate Path or ChannelPhilips Ultrasound ClearVue · Philips Ultrasound CX +3
- CVE-2020-13891An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS.
- CVE-2020-10628ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes unencrypted passwords on the network.ControlEdge PLC · ControlEdge RTU
- CVE-2020-10727A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plainRed Hat ActiveMQ Artemis · org.apache.activemq:artemis-comm…
- CVE-2020-10769A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec CryptograpKernel
- CVE-2020-15332Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions.
- CVE-2020-15333Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select * from Administrator_users" and "select *
- CVE-2020-15334Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows escape-sequence injection into the /var/log/axxmpp.log file.
- CVE-2020-15335Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests.
- CVE-2020-15336Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests.
- CVE-2020-15337Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests.
- CVE-2020-15338Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests.
- CVE-2020-15339Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows live/CPEManager/AXCampaignManager/handle_campaign_script_link?script_name= XSS.
- CVE-2020-15340Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa SSH
- CVE-2020-15341Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated update_all_realm_license API.
- CVE-2020-15342Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user API.
- CVE-2020-15343Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user_key API.
- CVE-2020-15344Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_user_id_and_key API.
- CVE-2020-15345Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_instances_for_update API.
- CVE-2020-15346Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key.
- CVE-2020-15347Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account.
- CVE-2020-15325Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication.
- CVE-2020-15326Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem.
- CVE-2020-15327Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication.
- CVE-2020-15328Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions.
- CVE-2020-15329Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions.
- CVE-2020-15330Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APP_KEY in /opt/axess/etc/default/axess.
- CVE-2020-15331Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTH_SECRET_KEY in /opt/axess/etc/default/axess.
- CVE-2020-15348Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/delete_cpes_by_ids?cpe_ids= for eval injection of
- CVE-2020-4565IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications beingIBM Spectrum Protect Plus
- CVE-2020-4223IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2019-4650IBM Maximo Asset Management 7.6.1.1 is vulnerable to SQL injection.IBM Maximo Asset Management
- CVE-2020-15016NeDi 1.9C is vulnerable to reflected cross-site scripting.
- CVE-2020-15017NeDi 1.9C is vulnerable to reflected cross-site scripting.
- CVE-2020-15308Support Incident Tracker (aka SiT! or SiTracker) 3.67 p2 allows post-authentication SQL injection via the site_edit.php typeid or site param
- CVE-2020-15304An issue was discovered in OpenEXR before 2.5.2.
- CVE-2020-15305An issue was discovered in OpenEXR before 2.5.2.
- CVE-2020-15306An issue was discovered in OpenEXR before v2.5.2.
- CVE-2020-10753A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway).Red Hat Ceph Storage