CVEs published July 2, 2020
54 CVEs were published on July 2, 2020: 0 critical, 5 high.
- Published
- 54
- Critical
- 0
- High
- 5
- Medium
- 11
- Low
- 1
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- PrestaShop
- 7
- Jenkins project Jenkins Fortify on Demand Plugin · org.jenk…
- 3
- NGINX Controller
- 3
- Apache Guacamole
- 2
- https://github.com/rails/rails · actionpack
- 2
- Jenkins project Jenkins VncRecorder Plugin · org.jenkins-ci…
- 2
- Jenkins project Jenkins Zephyr for JIRA Test Management Plu…
- 2
- Tobesoft NEXACRO14/17 ExCommonApiV13
- 2
- Cisco Digital Network Architecture Center
- 1
- Cisco Identity Services Engine Software
- 1
High 5
- CVE-2020-4074Improper AuthenticationPrestaShop
- CVE-2020-15082External control of configuration setting in the dashboard in PrestaShopPrestaShop
- CVE-2020-7820Tobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution VulnerabilityTobesoft NEXACRO14/17 ExCommonApiV13
- CVE-2020-7821Tobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution VulnerabilityTobesoft NEXACRO14/17 ExCommonApiV13
- CVE-2020-3297Cisco Small Business Smart and Managed Switches Session Management VulnerabilityCisco Small Business 200 Series Smart Switches
Medium, low and unrated 49
- CVE-2020-15469In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
- CVE-2020-8176A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shopkoa-shopify-auth · @shopify/koa-shopify-auth
- CVE-2020-8179Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks.Nextcloud Deck
- CVE-2020-8166A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token suchttps://github.com/rails/rails · actionpack
- CVE-2020-8188We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine PProtect for UniFi Cloud Key Gen2 Plus, UniFi Dream Machine…
- CVE-2020-8163The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument ohttps://github.com/rails/rails · actionview
- CVE-2020-8185A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app runnihttps://github.com/rails/rails · actionpack
- CVE-2020-15091Denial of Service in TenderMinttendermint · github.com/tendermint/tendermint
- CVE-2020-4061Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websitesOctober CMS October · october/backend
- CVE-2020-15083Reflected XSS when uploading an image in the Product page in PrestaShopPrestaShop
- CVE-2020-11074Stored XSS in PrestaShopPrestaShop
- CVE-2020-15079Improper access control in PrestaShopPrestaShop
- CVE-2020-15080Information disclosure in release archive in PrestaShopPrestaShop
- CVE-2020-15081Information exposure in the upload directory in PrestaShopPrestaShop
- CVE-2019-20894Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLgithub.com/traefik/traefik/v2 · github.com/containous/tr… +1
- CVE-2020-14092The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.
- CVE-2020-13653An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11.
- CVE-2020-2219Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stoJenkins project Jenkins Link Column Plugin · org.jenkins-ci…
- CVE-2020-2216A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission tJenkins project Jenkins Zephyr for JIRA Test Management Plu…
- CVE-2020-2217Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form vJenkins project Jenkins Compatibility Action Storage Plugin…
- CVE-2020-2218Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master whJenkins project Jenkins HP ALM Quality Center Plugin · org.…
- CVE-2020-2214Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worksJenkins project Jenkins ZAP Pipeline Plugin · com.vrondakis…
- CVE-2020-2215A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to Jenkins project Jenkins Zephyr for JIRA Test Management Plu…
- CVE-2020-2211Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrJenkins project Jenkins ElasticBox Jenkins Kubernetes CI/CD…
- CVE-2020-2212Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master whJenkins project Jenkins GitHub Coverage Reporter Plugin · i…
- CVE-2020-2213Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files oJenkins project Jenkins White Source Plugin · org.jenkins-c…
- CVE-2020-2209Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it cJenkins project Jenkins TestComplete support Plugin · org.j…
- CVE-2020-2210Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuraJenkins project Jenkins Stash Branch Parameter Plugin · org…
- CVE-2020-2207Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflJenkins project Jenkins VncViewer Plugin · org.jenkins-ci.p…
- CVE-2020-2208Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewedJenkins project Jenkins Slack Upload Plugin · org.jenkins-c…
- CVE-2020-2204A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect toJenkins project Jenkins Fortify on Demand Plugin · org.jenk…
- CVE-2020-2205Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint, resulting in a storeJenkins project Jenkins VncRecorder Plugin · org.jenkins-ci…
- CVE-2020-2206Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a rJenkins project Jenkins VncRecorder Plugin · org.jenkins-ci…
- CVE-2020-2202A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read accJenkins project Jenkins Fortify on Demand Plugin · org.jenk…
- CVE-2020-2203A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globallyJenkins project Jenkins Fortify on Demand Plugin · org.jenk…
- CVE-2020-2201Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in aJenkins project Jenkins Sonargraph Integration Plugin · org…
- CVE-2020-12119Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF).
- CVE-2020-3282Cisco Unified Communications Products Cross-Site Scripting VulnerabilityCisco Unity Connection
- CVE-2020-9498Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels.Apache Guacamole
- CVE-2020-9497Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels.Apache Guacamole
- CVE-2020-5909In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the aNGINX Controller
- CVE-2020-5910In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX ControlNGINX Controller
- CVE-2020-5911In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL NGINX Controller
- CVE-2020-15502The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico
- CVE-2020-3402Cisco Unified Customer Voice Portal Information Disclosure VulnerabilityCisco Unified IP Interactive Voice Response
- CVE-2020-3391Cisco Digital Network Architecture Center Information Disclosure VulnerabilityCisco Digital Network Architecture Center
- CVE-2020-3340Cisco Identity Services Engine Stored Cross-Site Scripting VulnerabilitiesCisco Identity Services Engine Software
- CVE-2020-15503LibRaw before 0.20-RC1 lacks a thumbnail size range check.
- CVE-2020-8161A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Dihttps://github.com/rack/rack · rack