CVEs published June 29, 2020
72 CVEs were published on June 29, 2020: 2 critical, 5 high. 2 are now in CISA KEV.
- Published
- 72
- Critical
- 2
- High
- 5
- Medium
- 7
- Low
- 0
- Unrated
- 58
- Now in CISA KEV
- 2
- Fix available
- 13
Most affected products
- Baxter ExactaMix EM 2400 & EM
- 6
- Baxter Sigma Spectrum Infusion Pumps
- 6
- Atlassian Jira Server
- 5
- BIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S…
- 5
- Baxter PrismaFlex and PrisMax
- 3
- Baxter Phoenix Hemodialysis Delivery System
- 1
- Brocade Network Advisor
- 1
- Cabsoftware Reportexpress ProPlus
- 1
- coturn
- 1
- IBM API Connect
- 1
Critical 2
High 5
- CVE-2020-4067Improper Initialization in coturncoturn
- CVE-2020-8014kopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackageopenSUSE Leap · openSUSE Tumbleweed
- CVE-2019-3681osc: stores downloaded (supposed) RPM in network-controlled filesystem pathsSUSE Linux Enterprise Module for Development Tools · SUS… +3
- CVE-2020-8019syslog-ng: Local privilege escalation from new to root in %postSUSE Linux Enterprise Debuginfo 11-SP3 · SUSE Linux Ente… +6
- CVE-2020-8022User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviligesSUSE Enterprise Storage · SUSE Linux Enterprise Server… +10
Medium, low and unrated 65
- CVE-2020-15393In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770.
- CVE-2020-15389jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a
- CVE-2020-4037Open Redirect in OAuth2 ProxyOAuth2 Proxy · github.com/oauth2-proxy/oauth2-proxy
- CVE-2020-13657An elevation of privilege vulnerability exists in Avast Free Antivirus and AVG AntiVirus Free before 20.4 due to improperly handling hard li
- CVE-2020-15043iBall WRB303N devices allow CSRF attacks, as demonstrated by enabling remote management, enabling DHCP, or modifying the subnet range for IP
- CVE-2018-6446A vulnerability in Brocade Network Advisor Version Before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss AdmiBrocade Network Advisor
- CVE-2020-14145The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation.
- CVE-2020-13896The web interface of Maipu MP1800X-50 7.5.3.14(R) devices allows remote attackers to obtain sensitive information via the form/formDeviceVer
- CVE-2020-14414NeDi 1.9C is vulnerable to Remote Command Execution.
- CVE-2020-14413NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php.
- CVE-2020-14412NeDi 1.9C is vulnerable to Remote Command Execution.
- CVE-2020-14072An issue was discovered in MK-AUTH 19.01.
- CVE-2020-14071An issue was discovered in MK-AUTH 19.01.
- CVE-2020-14070An issue was discovered in MK-AUTH 19.01.
- CVE-2020-14069An issue was discovered in MK-AUTH 19.01.
- CVE-2020-14068An issue was discovered in MK-AUTH 19.01.
- CVE-2020-15362wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executablewifiscanner
- CVE-2020-15324Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a world-readable axess/opt/axXMPPHandler/config/xmpp_config.py file that stores hardcoded cre
- CVE-2020-15323Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the cloud1234 password for the a1@chopin account default credentials.
- CVE-2020-15322Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the wbboEZ4BN3ssxAfM hardcoded password for the debian-sys-maint account.
- CVE-2020-15321Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axzyxel password for the livedbuser account.
- CVE-2020-15320Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axiros password for the root account.
- CVE-2020-15319Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/mysql chroot directory tree.
- CVE-2020-15318Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/mysql chroot directory tree.
- CVE-2020-15317Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree.
- CVE-2020-15316Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account within the /opt/axess chroot directory tree.
- CVE-2020-15315Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/axess chroot directory tree.
- CVE-2020-15314Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account.
- CVE-2020-15313Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account.
- CVE-2020-15312Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account.
- CVE-2020-8573The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password thatNetApp HCI Baseboard Management Controller (BMC) HCI H610C,…
- CVE-2020-4557IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting.IBM Business Process Manager · IBM Business Automation Work…
- CVE-2019-18252BIOTRONIK CardioMessenger II, The affected products allow credential reuse for multiple authentication purposes.BIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S…
- CVE-2019-18248BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypted communication chanBIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S…
- CVE-2019-18246BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIOTRONIK Remote Communication inBIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S…
- CVE-2019-18256BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format.BIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S…
- CVE-2019-18254BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest.BIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S…
- CVE-2020-12012Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5,Baxter ExactaMix EM 2400 & EM
- CVE-2020-12016Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5,Baxter ExactaMix EM 2400 & EM
- CVE-2020-12008Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order infoBaxter ExactaMix EM 2400 & EM
- CVE-2020-12032Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in Baxter ExactaMix EM 2400 & EM
- CVE-2020-12020Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative Baxter ExactaMix EM 2400 & EM
- CVE-2020-12024Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to theBaxter ExactaMix EM 2400 & EM
- CVE-2020-12036Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TBaxter PrismaFlex and PrisMax
- CVE-2020-12035Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The PrismaFlex device contains a hard-coded service password that provideBaxter PrismaFlex and PrisMax
- CVE-2020-12037Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TBaxter PrismaFlex and PrisMax
- CVE-2020-12048Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLBaxter Phoenix Hemodialysis Delivery System
- CVE-2020-12040Sigma Spectrum Infusion System v's6.x (model 35700BAX) and Baxter Spectrum Infusion System Version(s) 8.x (model 35700BAX2) at the applicatiBaxter Sigma Spectrum Infusion Pumps
- CVE-2020-12039Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 357Baxter Sigma Spectrum Infusion Pumps
- CVE-2020-12041The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) telnet Command-Line Interface, grants access to sensitive data stored on tBaxter Sigma Spectrum Infusion Pumps
- CVE-2020-12045The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), opBaxter Sigma Spectrum Infusion Pumps
- CVE-2020-12043The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the WBaxter Sigma Spectrum Infusion Pumps
- CVE-2020-12047The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-defaBaxter Sigma Spectrum Infusion Pumps
- CVE-2019-19160Reportexpress ProPlus contains a vulnerability that could allow an arbitrary code execution by inserted VBscript into the configure file(rxpCabsoftware Reportexpress ProPlus
- CVE-2020-4452IBM API Connect V2018.4.1.0 through 2018.4.1.11 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hIBM API Connect
- CVE-2020-13423Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Current_url or email f
- CVE-2020-12635XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field.
- CVE-2020-8024Problematic permissions in hylafax+ packaging allow escalation from uucp to other usersopenSUSE Leap · openSUSE Factory
- CVE-2019-20414Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scAtlassian Jira Server
- CVE-2019-20413Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of SAtlassian Jira Server
- CVE-2019-20412The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the folAtlassian Jira Server
- CVE-2019-20411Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgAtlassian Jira Server
- CVE-2019-20410Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information DisclosurAtlassian Jira Server
- CVE-2020-14002PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation.
- CVE-2020-15368AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a