# CVEs published 2020-06-30

51 CVEs were published on June 30, 2020: 2 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-5973](https://cve.now/CVE-2020-5973.md): NVIDIA Virtual GPU Manager and the guest drivers contain a vulnerability in vGPU plugin, in which there is the potential to execute privileg (no CVSS, NVIDIA vGPU Software)
- [CVE-2020-5970](https://cve.now/CVE-2020-5970.md): NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tamp (no CVSS, NVIDIA vGPU Software)
- [CVE-2020-5971](https://cve.now/CVE-2020-5971.md): NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software reads from a buffer by using buffer access mec (no CVSS, NVIDIA vGPU Software)
- [CVE-2020-5972](https://cve.now/CVE-2020-5972.md): NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which local pointer variables are not initialized and may be free (no CVSS, NVIDIA vGPU Software)
- [CVE-2020-5968](https://cve.now/CVE-2020-5968.md): NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software does not restrict or incorrectly restricts ope (no CVSS, NVIDIA vGPU Software)
- [CVE-2020-5969](https://cve.now/CVE-2020-5969.md): NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which it validates a shared resource before using it, creating a (no CVSS, NVIDIA vGPU Software)
- [CVE-2020-14947](https://cve.now/CVE-2020-14947.md): OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib\_file in plu (no CVSS)
- [CVE-2020-9414](https://cve.now/CVE-2020-9414.md): TIBCO Managed File Transfer reflected XSS vulerability (CVSS 8.8, TIBCO Software TIBCO Managed File Transfer Command Center ·…)
- [CVE-2020-9413](https://cve.now/CVE-2020-9413.md): TIBCO Managed File Transfer reflected XSS vulerability (CVSS 6.3, TIBCO Software TIBCO Managed File Transfer Command Center ·…)
- [CVE-2020-7049](https://cve.now/CVE-2020-7049.md): Nozomi Networks OS before 19.0.4 allows /#/network?tab=network\_node\_list.html CSV Injection. (no CVSS)
- [CVE-2020-14058](https://cve.now/CVE-2020-14058.md): An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. (no CVSS)
- [CVE-2020-14059](https://cve.now/CVE-2020-14059.md): An issue was discovered in Squid 5.x before 5.0.3. (no CVSS)
- [CVE-2020-14474](https://cve.now/CVE-2020-14474.md): The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the de (no CVSS)
- [CVE-2020-15049](https://cve.now/CVE-2020-15049.md): An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. (CVSS 9.9)
- [CVE-2020-15307](https://cve.now/CVE-2020-15307.md): Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom fie (no CVSS)
- [CVE-2020-14482](https://cve.now/CVE-2020-14482.md): Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. (no CVSS, Delta Industrial Automation DOPSoft)
- [CVE-2020-15087](https://cve.now/CVE-2020-15087.md): Privilege escalation in Presto (CVSS 7.4, prestosql Presto · io.prestosql:presto-server)
- [CVE-2020-13095](https://cve.now/CVE-2020-13095.md): Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user. (no CVSS, Little Snitch)
- [CVE-2020-15085](https://cve.now/CVE-2020-15085.md): Client caching login operation with plaintext password in Saleor Storefront (CVSS 6.9, mirumee saleor-storefront)
- [CVE-2020-15084](https://cve.now/CVE-2020-15084.md): Authorization bypass in express-jwt (CVSS 7.7, auth0 express-jwt · express-jwt)
- [CVE-2020-4044](https://cve.now/CVE-2020-4044.md): Local users can perform a buffer overflow attack against the xrdp-sesman service and then impersonate it (CVSS 7.5, neutrinolabs xrdp)
- [CVE-2020-14957](https://cve.now/CVE-2020-14957.md): In Windows cleaning assistant 3.2, the driver file (AtpKrnl.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2020-14956](https://cve.now/CVE-2020-14956.md): In Windows cleaning assistant 3.2, the driver file (AtpKrnl.sys) allows local users to cause a denial of service (BSOD) or possibly have uns (no CVSS)
- [CVE-2020-9483](https://cve.now/CVE-2020-9483.md): \*\*Resolved\*\* When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vuln (no CVSS, Apache SkyWalking)
- [CVE-2020-15415](https://cve.now/CVE-2020-15415.md): On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution v (CVSS 9.8, KEV)
- [CVE-2019-19161](https://cve.now/CVE-2019-19161.md): To be able to change Dll Files to preload with missing support for integrity check vulnerability MIPLATFORM ActiveX of TOBESOFT.CO.LTD, (CVSS 7.2, TOBESOFT.CO.LTD MIPLATFORM)
- [CVE-2019-19163](https://cve.now/CVE-2019-19163.md): Commax WallPad Remote Code Execution Vulnerability (CVSS 7.5, COMMAX Wallpad)
- [CVE-2020-15412](https://cve.now/CVE-2020-15412.md): An issue was discovered in MISP 2.4.128. (no CVSS)
- [CVE-2020-15411](https://cve.now/CVE-2020-15411.md): An issue was discovered in MISP 2.4.128. (no CVSS)
- [CVE-2020-7816](https://cve.now/CVE-2020-7816.md): A vulnerability in the JPEG image parsing module in DaView Indy, DaVa+, DaOffice softwares could allow an unauthenticated, remote attacker t (CVSS 7.0, HUMAN TALK DaView Indy, DaVA+, DaOffice)
- [CVE-2020-15401](https://cve.now/CVE-2020-15401.md): IOBit Malware Fighter Pro 8.0.2.547 allows local users to gain privileges for file deletion by manipulating malicious flagged file locations (no CVSS)
- [CVE-2020-15400](https://cve.now/CVE-2020-15400.md): CakePHP before 4.0.6 mishandles CSRF token generation. (no CVSS, cakephp/cakephp)
- [CVE-2019-20893](https://cve.now/CVE-2019-20893.md): An issue was discovered in Activision Infinity Ward Call of Duty Modern Warfare 2 through 2019-12-11. (no CVSS)
- [CVE-2020-15397](https://cve.now/CVE-2020-15397.md): HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., loca (no CVSS)
- [CVE-2020-15396](https://cve.now/CVE-2020-15396.md): In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. (no CVSS)
- [CVE-2017-18922](https://cve.now/CVE-2017-18922.md): It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. (no CVSS)
- [CVE-2020-15395](https://cve.now/CVE-2020-15395.md): In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams\_Fill\_PerStream in Multiple/File\_MpegPs.cpp (no CVSS)
- [CVE-2020-5602](https://cve.now/CVE-2020-5602.md): Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. (no CVSS, Mitsubishi Electric Mitsubishi Electoric FA Engineering Sof…)
- [CVE-2020-5603](https://cve.now/CVE-2020-5603.md): Uncontrolled resource consumption vulnerability in Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. (no CVSS, Mitsubishi Electric Mitsubishi Electoric FA Engineering Sof…)
- [CVE-2020-5587](https://cve.now/CVE-2020-5587.md): Cybozu Garoon 4.0.0 to 5.0.1 allow remote authenticated attackers to obtain unintended information via unspecified vectors. (no CVSS, Cybozu Garoon)
- [CVE-2020-5588](https://cve.now/CVE-2020-5588.md): Path traversal vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to obtain unintended information via (no CVSS, Cybozu Garoon)
- [CVE-2020-5601](https://cve.now/CVE-2020-5601.md): Chrome Extension for e-Tax Reception System Ver1.0.0.0 allows remote attackers to execute an arbitrary command via unspecified vectors. (no CVSS, National Tax Agency Chrome Extension for e-Tax Reception Sy…)
- [CVE-2020-5585](https://cve.now/CVE-2020-5585.md): Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.0.1 allows attacker with administrator rights to inject an arbitrary script v (no CVSS, Cybozu Garoon)
- [CVE-2020-5586](https://cve.now/CVE-2020-5586.md): Cross-site scripting vulnerability in Cybozu Garoon 4.10.3 to 5.0.1 allows attacker with administrator rights to inject an arbitrary script (no CVSS, Cybozu Garoon)
- [CVE-2020-5583](https://cve.now/CVE-2020-5583.md): Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to obtain unauthorized Multi-Report's data v (no CVSS, Cybozu Garoon)
- [CVE-2020-5584](https://cve.now/CVE-2020-5584.md): Cybozu Garoon 4.0.0 to 5.0.1 allow remote attackers to obtain unintended information via unspecified vectors. (no CVSS, Cybozu Garoon)
- [CVE-2020-5581](https://cve.now/CVE-2020-5581.md): Path traversal vulnerability in Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to obtain unintended information via unsp (no CVSS, Cybozu Garoon)
- [CVE-2020-5582](https://cve.now/CVE-2020-5582.md): Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to alter the data for the file attached to R (no CVSS, Cybozu Garoon)
- [CVE-2020-5580](https://cve.now/CVE-2020-5580.md): Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to view and/or alter Single sign-on settings (no CVSS, Cybozu Garoon)
- [CVE-2019-20416](https://cve.now/CVE-2019-20416.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site sc (no CVSS, Atlassian Jira Server)
- [CVE-2019-20415](https://cve.now/CVE-2019-20415.md): Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site (no CVSS, Atlassian Jira Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.