CVEs published July 1, 2020
71 CVEs were published on July 1, 2020: 2 critical, 6 high. 1 is now in CISA KEV.
- Published
- 71
- Critical
- 2
- High
- 6
- Medium
- 9
- Low
- 3
- Unrated
- 51
- Now in CISA KEV
- 1
- Fix available
- 18
Most affected products
- Atlassian Jira Server and Data Center
- 9
- BIG-IP
- 6
- IBM DB2 for Linux- UNIX and Windows
- 6
- IBM Security Identity Manager Virtual Appliance
- 4
- NGINX Controller
- 3
- Phoenix Contact Automation Worx
- 2
- "HCL Domino"
- 1
- "HCL iNotes"
- 1
- Atlassian Confluence Server · Atlassian Confluence Data Cen…
- 1
- Atlassian Jira Server
- 1
Critical 2
- CVE-2020-2500This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service.QNAP Systems Helpdesk
- CVE-2020-5902In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User InteBIG-IP
High 6
- CVE-2020-7688Command Injectionmversion
- CVE-2020-12497Phoenix Contact Automation Worx <= 1.87: stack-based overflowPhoenix Contact Automation Worx
- CVE-2020-12498Phoenix Contact Automation Worx <= 1.87: out-of-bounds read remote code executionPhoenix Contact Automation Worx
- CVE-2020-6089An exploitable code execution vulnerability exists in the ANI file format parser of Leadtools 20.Leadtools
- CVE-2020-4420IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker toIBM DB2 for Linux- UNIX and Windows
- CVE-2020-4363IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, causedIBM DB2 for Linux- UNIX and Windows
Medium, low and unrated 63
- CVE-2020-5238Denial of service in table parsing in cmark-gfmgithub cmark-gfm
- CVE-2020-15500An issue was discovered in server.js in TileServer GL through 3.0.0.tileserver-gl
- CVE-2020-15489An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices.
- CVE-2020-15490An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices.
- CVE-2019-15312An issue was discovered on Zolo Halo devices via the Linkplay firmware.
- CVE-2019-15311An issue was discovered on Zolo Halo devices via the Linkplay firmware.
- CVE-2019-15310An issue was discovered on various devices via the Linkplay firmware.
- CVE-2020-14196In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not prop
- CVE-2020-13619php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.locutus
- CVE-2020-14057Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations.
- CVE-2020-14055Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encodi
- CVE-2020-14056Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch function
- CVE-2020-5907In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided withBIG-IP
- CVE-2020-5903In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vulnerability exists in BIG-IP
- CVE-2020-5905In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided daBIG-IP
- CVE-2020-5904In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in BIG-IP
- CVE-2020-5908In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files.Edge Client for Linux
- CVE-2020-12605Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field nam
- CVE-2020-5906In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the sBIG-IP
- CVE-2020-4414IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local attacker to perform unIBM DB2 for Linux- UNIX and Windows
- CVE-2020-4387IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitiIBM DB2 for Linux- UNIX and Windows
- CVE-2020-4386IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitiIBM DB2 for Linux- UNIX and Windows
- CVE-2020-4376IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow an attacker to cause a denial of service caused by an error witIBM MQ for HPE NonStop
- CVE-2020-4355IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service, causIBM DB2 for Linux- UNIX and Windows
- CVE-2019-4706IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable gIBM Security Identity Manager Virtual Appliance
- CVE-2019-4705IBM Security Identity Manager Virtual Appliance 7.0.2 discloses sensitive information to unauthorized users.IBM Security Identity Manager Virtual Appliance
- CVE-2019-4704IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies.IBM Security Identity Manager Virtual Appliance
- CVE-2019-4676IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user.IBM Security Identity Manager Virtual Appliance
- CVE-2020-12604Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large
- CVE-2020-13383openSIS through 7.4 allows Directory Traversal.
- CVE-2020-13382openSIS through 7.4 has Incorrect Access Control.
- CVE-2020-8663Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections.
- CVE-2020-13381openSIS through 7.4 allows SQL Injection.
- CVE-2020-13380openSIS before 7.4 allows SQL Injection.
- CVE-2020-5901In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack.NGINX Controller
- CVE-2020-5899In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text,NGINX Controller
- CVE-2020-5900In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX ControlleNGINX Controller
- CVE-2020-7689Insecure Encryptionbcrypt
- CVE-2020-12603Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many
- CVE-2017-1712"A vulnerability in the TLS protocol implementation of the Domino server could allow an unauthenticated, remote attacker to access sensitive"HCL Domino"
- CVE-2017-1659"HCL iNotes is susceptible to a Cross-Site Scripting (XSS) Vulnerability."HCL iNotes"
- CVE-2020-6261SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XMSAP SE SAP Solution Manager
- CVE-2020-15478The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.
- CVE-2020-15471In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.
- CVE-2020-15472In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demo
- CVE-2020-15473In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c.
- CVE-2020-15474In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c.
- CVE-2020-15475In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free.
- CVE-2020-15476In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
- CVE-2020-15470ffjpeg through 2020-02-24 has a heap-based buffer overflow in jfif_decode in jfif.c.
- CVE-2020-15468Persian VIP Download Script 1.0 allows SQL Injection via the cart_edit.php active parameter.
- CVE-2020-4029The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2Atlassian Jira Server and Data Center
- CVE-2020-4027Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass vAtlassian Confluence Server · Atlassian Confluence Data Cen…
- CVE-2020-4025The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and DataAtlassian Jira Server and Data Center
- CVE-2020-4024The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8Atlassian Jira Server and Data Center
- CVE-2020-4022The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8Atlassian Jira Server and Data Center
- CVE-2020-14169The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScrAtlassian Jira Server and Data Center
- CVE-2020-14168The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 befAtlassian Jira Server and Data Center
- CVE-2020-14167The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, aAtlassian Jira Server and Data Center
- CVE-2020-14166The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with prAtlassian Jira Service Desk Server and Data Center
- CVE-2020-14165The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain informAtlassian Jira Server and Data Center
- CVE-2020-14164The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScriAtlassian Jira Server and Data Center
- CVE-2019-20408The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal netAtlassian Jira Server