# CVEs published 2020-06-29

72 CVEs were published on June 29, 2020: 2 critical, 5 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-15393](https://cve.now/CVE-2020-15393.md): In the Linux kernel 4.4 through 5.7.6, usbtest\_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770. (no CVSS)
- [CVE-2020-15389](https://cve.now/CVE-2020-15389.md): jp2/opj\_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a (no CVSS)
- [CVE-2020-4067](https://cve.now/CVE-2020-4067.md): Improper Initialization in coturn (CVSS 7.0, coturn)
- [CVE-2020-4037](https://cve.now/CVE-2020-4037.md): Open Redirect in OAuth2 Proxy (CVSS 4.3, OAuth2 Proxy · github.com/oauth2-proxy/oauth2-proxy)
- [CVE-2020-13657](https://cve.now/CVE-2020-13657.md): An elevation of privilege vulnerability exists in Avast Free Antivirus and AVG AntiVirus Free before 20.4 due to improperly handling hard li (no CVSS)
- [CVE-2020-15043](https://cve.now/CVE-2020-15043.md): iBall WRB303N devices allow CSRF attacks, as demonstrated by enabling remote management, enabling DHCP, or modifying the subnet range for IP (no CVSS)
- [CVE-2018-6446](https://cve.now/CVE-2018-6446.md): A vulnerability in Brocade Network Advisor Version Before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Admi (no CVSS, Brocade Network Advisor)
- [CVE-2020-14145](https://cve.now/CVE-2020-14145.md): The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. (CVSS 5.9)
- [CVE-2020-15069](https://cve.now/CVE-2020-15069.md): Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientles (CVSS 9.8, KEV)
- [CVE-2020-13896](https://cve.now/CVE-2020-13896.md): The web interface of Maipu MP1800X-50 7.5.3.14(R) devices allows remote attackers to obtain sensitive information via the form/formDeviceVer (no CVSS)
- [CVE-2020-14414](https://cve.now/CVE-2020-14414.md): NeDi 1.9C is vulnerable to Remote Command Execution. (no CVSS)
- [CVE-2020-14413](https://cve.now/CVE-2020-14413.md): NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. (no CVSS)
- [CVE-2020-14412](https://cve.now/CVE-2020-14412.md): NeDi 1.9C is vulnerable to Remote Command Execution. (no CVSS)
- [CVE-2020-14072](https://cve.now/CVE-2020-14072.md): An issue was discovered in MK-AUTH 19.01. (no CVSS)
- [CVE-2020-14071](https://cve.now/CVE-2020-14071.md): An issue was discovered in MK-AUTH 19.01. (no CVSS)
- [CVE-2020-14070](https://cve.now/CVE-2020-14070.md): An issue was discovered in MK-AUTH 19.01. (no CVSS)
- [CVE-2020-14069](https://cve.now/CVE-2020-14069.md): An issue was discovered in MK-AUTH 19.01. (no CVSS)
- [CVE-2020-14068](https://cve.now/CVE-2020-14068.md): An issue was discovered in MK-AUTH 19.01. (no CVSS)
- [CVE-2020-15362](https://cve.now/CVE-2020-15362.md): wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executable (no CVSS, wifiscanner)
- [CVE-2020-15324](https://cve.now/CVE-2020-15324.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a world-readable axess/opt/axXMPPHandler/config/xmpp\_config.py file that stores hardcoded cre (no CVSS)
- [CVE-2020-15323](https://cve.now/CVE-2020-15323.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the cloud1234 password for the a1@chopin account default credentials. (no CVSS)
- [CVE-2020-15322](https://cve.now/CVE-2020-15322.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the wbboEZ4BN3ssxAfM hardcoded password for the debian-sys-maint account. (no CVSS)
- [CVE-2020-15321](https://cve.now/CVE-2020-15321.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axzyxel password for the livedbuser account. (no CVSS)
- [CVE-2020-15320](https://cve.now/CVE-2020-15320.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axiros password for the root account. (no CVSS)
- [CVE-2020-15319](https://cve.now/CVE-2020-15319.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/mysql chroot directory tree. (no CVSS)
- [CVE-2020-15318](https://cve.now/CVE-2020-15318.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/mysql chroot directory tree. (no CVSS)
- [CVE-2020-15317](https://cve.now/CVE-2020-15317.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree. (no CVSS)
- [CVE-2020-2021](https://cve.now/CVE-2020-2021.md): PAN-OS: Authentication Bypass in SAML Authentication (CVSS 10.0, KEV, Palo Alto Networks PAN-OS)
- [CVE-2020-15316](https://cve.now/CVE-2020-15316.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account within the /opt/axess chroot directory tree. (no CVSS)
- [CVE-2020-15315](https://cve.now/CVE-2020-15315.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/axess chroot directory tree. (no CVSS)
- [CVE-2020-15314](https://cve.now/CVE-2020-15314.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account. (no CVSS)
- [CVE-2020-15313](https://cve.now/CVE-2020-15313.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account. (no CVSS)
- [CVE-2020-15312](https://cve.now/CVE-2020-15312.md): Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account. (no CVSS)
- [CVE-2020-8573](https://cve.now/CVE-2020-8573.md): The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that (no CVSS, NetApp HCI Baseboard Management Controller (BMC) HCI H610C,…)
- [CVE-2020-4557](https://cve.now/CVE-2020-4557.md): IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Business Process Manager · IBM Business Automation Work…)
- [CVE-2019-18252](https://cve.now/CVE-2019-18252.md): BIOTRONIK CardioMessenger II, The affected products allow credential reuse for multiple authentication purposes. (no CVSS, BIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S…)
- [CVE-2019-18248](https://cve.now/CVE-2019-18248.md): BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypted communication chan (no CVSS, BIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S…)
- [CVE-2019-18246](https://cve.now/CVE-2019-18246.md): BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIOTRONIK Remote Communication in (no CVSS, BIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S…)
- [CVE-2019-18256](https://cve.now/CVE-2019-18256.md): BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format. (no CVSS, BIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S…)
- [CVE-2019-18254](https://cve.now/CVE-2019-18254.md): BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. (no CVSS, BIOTRONIK CardioMessenger II-S T-Line, CardioMessenger II-S…)
- [CVE-2020-12012](https://cve.now/CVE-2020-12012.md): Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, (no CVSS, Baxter ExactaMix EM 2400 & EM)
- [CVE-2020-12016](https://cve.now/CVE-2020-12016.md): Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, (no CVSS, Baxter ExactaMix EM 2400 & EM)
- [CVE-2020-12008](https://cve.now/CVE-2020-12008.md): Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order info (no CVSS, Baxter ExactaMix EM 2400 & EM)
- [CVE-2020-12032](https://cve.now/CVE-2020-12032.md): Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in (no CVSS, Baxter ExactaMix EM 2400 & EM)
- [CVE-2020-12020](https://cve.now/CVE-2020-12020.md): Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative (no CVSS, Baxter ExactaMix EM 2400 & EM)
- [CVE-2020-12024](https://cve.now/CVE-2020-12024.md): Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the (no CVSS, Baxter ExactaMix EM 2400 & EM)
- [CVE-2020-12036](https://cve.now/CVE-2020-12036.md): Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., T (no CVSS, Baxter PrismaFlex and PrisMax)
- [CVE-2020-12035](https://cve.now/CVE-2020-12035.md): Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The PrismaFlex device contains a hard-coded service password that provide (no CVSS, Baxter PrismaFlex and PrisMax)
- [CVE-2020-12037](https://cve.now/CVE-2020-12037.md): Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., T (no CVSS, Baxter PrismaFlex and PrisMax)
- [CVE-2020-12048](https://cve.now/CVE-2020-12048.md): Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TL (no CVSS, Baxter Phoenix Hemodialysis Delivery System)
- [CVE-2020-12040](https://cve.now/CVE-2020-12040.md): Sigma Spectrum Infusion System v's6.x (model 35700BAX) and Baxter Spectrum Infusion System Version(s) 8.x (model 35700BAX2) at the applicati (no CVSS, Baxter Sigma Spectrum Infusion Pumps)
- [CVE-2020-12039](https://cve.now/CVE-2020-12039.md): Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 357 (no CVSS, Baxter Sigma Spectrum Infusion Pumps)
- [CVE-2020-12041](https://cve.now/CVE-2020-12041.md): The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) telnet Command-Line Interface, grants access to sensitive data stored on t (no CVSS, Baxter Sigma Spectrum Infusion Pumps)
- [CVE-2020-12045](https://cve.now/CVE-2020-12045.md): The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), op (no CVSS, Baxter Sigma Spectrum Infusion Pumps)
- [CVE-2020-12043](https://cve.now/CVE-2020-12043.md): The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the W (no CVSS, Baxter Sigma Spectrum Infusion Pumps)
- [CVE-2020-12047](https://cve.now/CVE-2020-12047.md): The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-defa (no CVSS, Baxter Sigma Spectrum Infusion Pumps)
- [CVE-2019-19160](https://cve.now/CVE-2019-19160.md): Reportexpress ProPlus contains a vulnerability that could allow an arbitrary code execution by inserted VBscript into the configure file(rxp (CVSS 5.7, Cabsoftware Reportexpress ProPlus)
- [CVE-2020-4452](https://cve.now/CVE-2020-4452.md): IBM API Connect V2018.4.1.0 through 2018.4.1.11 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h (CVSS 5.9, IBM API Connect)
- [CVE-2020-13423](https://cve.now/CVE-2020-13423.md): Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Current\_url or email f (no CVSS)
- [CVE-2020-12635](https://cve.now/CVE-2020-12635.md): XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field. (no CVSS)
- [CVE-2020-8014](https://cve.now/CVE-2020-8014.md): kopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackage (CVSS 7.7, openSUSE Leap · openSUSE Tumbleweed)
- [CVE-2019-3681](https://cve.now/CVE-2019-3681.md): osc: stores downloaded (supposed) RPM in network-controlled filesystem paths (CVSS 7.5, SUSE Linux Enterprise Module for Development Tools · SUS… +3)
- [CVE-2020-8019](https://cve.now/CVE-2020-8019.md): syslog-ng: Local privilege escalation from new to root in %post (CVSS 7.7, SUSE Linux Enterprise Debuginfo 11-SP3 · SUSE Linux Ente… +6)
- [CVE-2020-8022](https://cve.now/CVE-2020-8022.md): User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges (CVSS 7.7, SUSE Enterprise Storage · SUSE Linux Enterprise Server… +10)
- [CVE-2020-8024](https://cve.now/CVE-2020-8024.md): Problematic permissions in hylafax+ packaging allow escalation from uucp to other users (CVSS 5.3, openSUSE Leap · openSUSE Factory)
- [CVE-2019-20414](https://cve.now/CVE-2019-20414.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site sc (no CVSS, Atlassian Jira Server)
- [CVE-2019-20413](https://cve.now/CVE-2019-20413.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of S (no CVSS, Atlassian Jira Server)
- [CVE-2019-20412](https://cve.now/CVE-2019-20412.md): The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the fol (no CVSS, Atlassian Jira Server)
- [CVE-2019-20411](https://cve.now/CVE-2019-20411.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forg (no CVSS, Atlassian Jira Server)
- [CVE-2019-20410](https://cve.now/CVE-2019-20410.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosur (no CVSS, Atlassian Jira Server)
- [CVE-2020-14002](https://cve.now/CVE-2020-14002.md): PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. (no CVSS)
- [CVE-2020-15368](https://cve.now/CVE-2020-15368.md): AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.