CVEs published June 30, 2020
51 CVEs were published on June 30, 2020: 2 critical, 7 high. 1 is now in CISA KEV.
- Published
- 51
- Critical
- 2
- High
- 7
- Medium
- 2
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- Cybozu Garoon
- 9
- NVIDIA vGPU Software
- 6
- Atlassian Jira Server
- 2
- Mitsubishi Electric Mitsubishi Electoric FA Engineering Sof…
- 2
- TIBCO Software TIBCO Managed File Transfer Command Center ·…
- 2
- Apache SkyWalking
- 1
- auth0 express-jwt · express-jwt
- 1
- cakephp/cakephp
- 1
- COMMAX Wallpad
- 1
- Delta Industrial Automation DOPSoft
- 1
Critical 2
High 7
- CVE-2020-9414TIBCO Managed File Transfer reflected XSS vulerabilityTIBCO Software TIBCO Managed File Transfer Command Center ·…
- CVE-2020-15087Privilege escalation in Prestoprestosql Presto · io.prestosql:presto-server
- CVE-2020-15084Authorization bypass in express-jwtauth0 express-jwt · express-jwt
- CVE-2020-4044Local users can perform a buffer overflow attack against the xrdp-sesman service and then impersonate itneutrinolabs xrdp
- CVE-2019-19161To be able to change Dll Files to preload with missing support for integrity check vulnerability MIPLATFORM ActiveX of TOBESOFT.CO.LTD,TOBESOFT.CO.LTD MIPLATFORM
- CVE-2019-19163Commax WallPad Remote Code Execution VulnerabilityCOMMAX Wallpad
- CVE-2020-7816A vulnerability in the JPEG image parsing module in DaView Indy, DaVa+, DaOffice softwares could allow an unauthenticated, remote attacker tHUMAN TALK DaView Indy, DaVA+, DaOffice
Medium, low and unrated 42
- CVE-2020-5973NVIDIA Virtual GPU Manager and the guest drivers contain a vulnerability in vGPU plugin, in which there is the potential to execute privilegNVIDIA vGPU Software
- CVE-2020-5970NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampNVIDIA vGPU Software
- CVE-2020-5971NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software reads from a buffer by using buffer access mecNVIDIA vGPU Software
- CVE-2020-5972NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which local pointer variables are not initialized and may be freeNVIDIA vGPU Software
- CVE-2020-5968NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software does not restrict or incorrectly restricts opeNVIDIA vGPU Software
- CVE-2020-5969NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which it validates a shared resource before using it, creating a NVIDIA vGPU Software
- CVE-2020-14947OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plu
- CVE-2020-9413TIBCO Managed File Transfer reflected XSS vulerabilityTIBCO Software TIBCO Managed File Transfer Command Center ·…
- CVE-2020-7049Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection.
- CVE-2020-14058An issue was discovered in Squid before 4.12 and 5.x before 5.0.3.
- CVE-2020-14059An issue was discovered in Squid 5.x before 5.0.3.
- CVE-2020-14474The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the de
- CVE-2020-15307Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom fie
- CVE-2020-14482Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior.Delta Industrial Automation DOPSoft
- CVE-2020-13095Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user.Little Snitch
- CVE-2020-15085Client caching login operation with plaintext password in Saleor Storefrontmirumee saleor-storefront
- CVE-2020-14957In Windows cleaning assistant 3.2, the driver file (AtpKrnl.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2020-14956In Windows cleaning assistant 3.2, the driver file (AtpKrnl.sys) allows local users to cause a denial of service (BSOD) or possibly have uns
- CVE-2020-9483**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnApache SkyWalking
- CVE-2020-15412An issue was discovered in MISP 2.4.128.
- CVE-2020-15411An issue was discovered in MISP 2.4.128.
- CVE-2020-15401IOBit Malware Fighter Pro 8.0.2.547 allows local users to gain privileges for file deletion by manipulating malicious flagged file locations
- CVE-2020-15400CakePHP before 4.0.6 mishandles CSRF token generation.cakephp/cakephp
- CVE-2019-20893An issue was discovered in Activision Infinity Ward Call of Duty Modern Warfare 2 through 2019-12-11.
- CVE-2020-15397HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., loca
- CVE-2020-15396In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories.
- CVE-2017-18922It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames.
- CVE-2020-15395In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp
- CVE-2020-5602Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver.Mitsubishi Electric Mitsubishi Electoric FA Engineering Sof…
- CVE-2020-5603Uncontrolled resource consumption vulnerability in Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver.Mitsubishi Electric Mitsubishi Electoric FA Engineering Sof…
- CVE-2020-5587Cybozu Garoon 4.0.0 to 5.0.1 allow remote authenticated attackers to obtain unintended information via unspecified vectors.Cybozu Garoon
- CVE-2020-5588Path traversal vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to obtain unintended information via Cybozu Garoon
- CVE-2020-5601Chrome Extension for e-Tax Reception System Ver1.0.0.0 allows remote attackers to execute an arbitrary command via unspecified vectors.National Tax Agency Chrome Extension for e-Tax Reception Sy…
- CVE-2020-5585Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to inject an arbitrary script vCybozu Garoon
- CVE-2020-5586Cross-site scripting vulnerability in Cybozu Garoon 4.10.3 to 5.0.1 allows attacker with administrator rights to inject an arbitrary script Cybozu Garoon
- CVE-2020-5583Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to obtain unauthorized Multi-Report's data vCybozu Garoon
- CVE-2020-5584Cybozu Garoon 4.0.0 to 5.0.1 allow remote attackers to obtain unintended information via unspecified vectors.Cybozu Garoon
- CVE-2020-5581Path traversal vulnerability in Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to obtain unintended information via unspCybozu Garoon
- CVE-2020-5582Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to alter the data for the file attached to RCybozu Garoon
- CVE-2020-5580Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to view and/or alter Single sign-on settingsCybozu Garoon
- CVE-2019-20416Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scAtlassian Jira Server
- CVE-2019-20415Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-siteAtlassian Jira Server