# CVEs published 2020-07-02

54 CVEs were published on July 2, 2020: 0 critical, 5 high. Days are UTC.

- [CVE-2020-15469](https://cve.now/CVE-2020-15469.md): In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. (no CVSS)
- [CVE-2020-8176](https://cve.now/CVE-2020-8176.md): A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the \`shop (no CVSS, koa-shopify-auth · @shopify/koa-shopify-auth)
- [CVE-2020-8179](https://cve.now/CVE-2020-8179.md): Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks. (no CVSS, Nextcloud Deck)
- [CVE-2020-8166](https://cve.now/CVE-2020-8166.md): A CSRF forgery vulnerability exists in rails \< 5.2.5, rails \< 6.0.4 that makes it possible for an attacker to, given a global CSRF token suc (CVSS 4.3, https://github.com/rails/rails · actionpack)
- [CVE-2020-8188](https://cve.now/CVE-2020-8188.md): We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine P (no CVSS, Protect for UniFi Cloud Key Gen2 Plus, UniFi Dream Machine…)
- [CVE-2020-8163](https://cve.now/CVE-2020-8163.md): The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the \`locals\` argument o (no CVSS, https://github.com/rails/rails · actionview)
- [CVE-2020-8185](https://cve.now/CVE-2020-8185.md): A denial of service vulnerability exists in Rails \<6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app runni (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2020-4074](https://cve.now/CVE-2020-4074.md): Improper Authentication (CVSS 8.9, PrestaShop)
- [CVE-2020-15091](https://cve.now/CVE-2020-15091.md): Denial of Service in TenderMint (CVSS 6.5, tendermint · github.com/tendermint/tendermint)
- [CVE-2020-4061](https://cve.now/CVE-2020-4061.md): Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites (CVSS 3.7, October CMS October · october/backend)
- [CVE-2020-15082](https://cve.now/CVE-2020-15082.md): External control of configuration setting in the dashboard in PrestaShop (CVSS 7.1, PrestaShop)
- [CVE-2020-15083](https://cve.now/CVE-2020-15083.md): Reflected XSS when uploading an image in the Product page in PrestaShop (CVSS 4.7, PrestaShop)
- [CVE-2020-11074](https://cve.now/CVE-2020-11074.md): Stored XSS in PrestaShop (CVSS 5.4, PrestaShop)
- [CVE-2020-15079](https://cve.now/CVE-2020-15079.md): Improper access control in PrestaShop (CVSS 6.4, PrestaShop)
- [CVE-2020-15080](https://cve.now/CVE-2020-15080.md): Information disclosure in release archive in PrestaShop (CVSS 5.3, PrestaShop)
- [CVE-2020-15081](https://cve.now/CVE-2020-15081.md): Information exposure in the upload directory in PrestaShop (CVSS 5.3, PrestaShop)
- [CVE-2019-20894](https://cve.now/CVE-2019-20894.md): Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR\_BAD\_SSL\_CL (no CVSS, github.com/traefik/traefik/v2 · github.com/containous/tr… +1)
- [CVE-2020-14092](https://cve.now/CVE-2020-14092.md): The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection. (no CVSS)
- [CVE-2020-13653](https://cve.now/CVE-2020-13653.md): An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. (no CVSS)
- [CVE-2020-2219](https://cve.now/CVE-2020-2219.md): Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a sto (no CVSS, Jenkins project Jenkins Link Column Plugin · org.jenkins-ci…)
- [CVE-2020-2216](https://cve.now/CVE-2020-2216.md): A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission t (no CVSS, Jenkins project Jenkins Zephyr for JIRA Test Management Plu…)
- [CVE-2020-2217](https://cve.now/CVE-2020-2217.md): Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form v (no CVSS, Jenkins project Jenkins Compatibility Action Storage Plugin…)
- [CVE-2020-2218](https://cve.now/CVE-2020-2218.md): Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master wh (no CVSS, Jenkins project Jenkins HP ALM Quality Center Plugin · org.…)
- [CVE-2020-2214](https://cve.now/CVE-2020-2214.md): Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in works (no CVSS, Jenkins project Jenkins ZAP Pipeline Plugin · com.vrondakis…)
- [CVE-2020-2215](https://cve.now/CVE-2020-2215.md): A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to (no CVSS, Jenkins project Jenkins Zephyr for JIRA Test Management Plu…)
- [CVE-2020-2211](https://cve.now/CVE-2020-2211.md): Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitr (no CVSS, Jenkins project Jenkins ElasticBox Jenkins Kubernetes CI/CD…)
- [CVE-2020-2212](https://cve.now/CVE-2020-2212.md): Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master wh (no CVSS, Jenkins project Jenkins GitHub Coverage Reporter Plugin · i…)
- [CVE-2020-2213](https://cve.now/CVE-2020-2213.md): Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files o (no CVSS, Jenkins project Jenkins White Source Plugin · org.jenkins-c…)
- [CVE-2020-2209](https://cve.now/CVE-2020-2209.md): Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it c (no CVSS, Jenkins project Jenkins TestComplete support Plugin · org.j…)
- [CVE-2020-2210](https://cve.now/CVE-2020-2210.md): Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configura (no CVSS, Jenkins project Jenkins Stash Branch Parameter Plugin · org…)
- [CVE-2020-2207](https://cve.now/CVE-2020-2207.md): Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a refl (no CVSS, Jenkins project Jenkins VncViewer Plugin · org.jenkins-ci.p…)
- [CVE-2020-2208](https://cve.now/CVE-2020-2208.md): Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewed (no CVSS, Jenkins project Jenkins Slack Upload Plugin · org.jenkins-c…)
- [CVE-2020-2204](https://cve.now/CVE-2020-2204.md): A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to (no CVSS, Jenkins project Jenkins Fortify on Demand Plugin · org.jenk…)
- [CVE-2020-2205](https://cve.now/CVE-2020-2205.md): Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the \`checkVncServ\` form validation endpoint, resulting in a store (no CVSS, Jenkins project Jenkins VncRecorder Plugin · org.jenkins-ci…)
- [CVE-2020-2206](https://cve.now/CVE-2020-2206.md): Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a r (no CVSS, Jenkins project Jenkins VncRecorder Plugin · org.jenkins-ci…)
- [CVE-2020-2202](https://cve.now/CVE-2020-2202.md): A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read acc (no CVSS, Jenkins project Jenkins Fortify on Demand Plugin · org.jenk…)
- [CVE-2020-2203](https://cve.now/CVE-2020-2203.md): A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally (no CVSS, Jenkins project Jenkins Fortify on Demand Plugin · org.jenk…)
- [CVE-2020-2201](https://cve.now/CVE-2020-2201.md): Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a (no CVSS, Jenkins project Jenkins Sonargraph Integration Plugin · org…)
- [CVE-2020-12119](https://cve.now/CVE-2020-12119.md): Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). (no CVSS)
- [CVE-2020-3282](https://cve.now/CVE-2020-3282.md): Cisco Unified Communications Products Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unity Connection)
- [CVE-2020-7820](https://cve.now/CVE-2020-7820.md): Tobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution Vulnerability (CVSS 7.8, Tobesoft NEXACRO14/17 ExCommonApiV13)
- [CVE-2020-7821](https://cve.now/CVE-2020-7821.md): Tobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution Vulnerability (CVSS 7.8, Tobesoft NEXACRO14/17 ExCommonApiV13)
- [CVE-2020-9498](https://cve.now/CVE-2020-9498.md): Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. (no CVSS, Apache Guacamole)
- [CVE-2020-9497](https://cve.now/CVE-2020-9497.md): Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. (no CVSS, Apache Guacamole)
- [CVE-2020-5909](https://cve.now/CVE-2020-5909.md): In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the a (no CVSS, NGINX Controller)
- [CVE-2020-5910](https://cve.now/CVE-2020-5910.md): In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Control (no CVSS, NGINX Controller)
- [CVE-2020-5911](https://cve.now/CVE-2020-5911.md): In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL (no CVSS, NGINX Controller)
- [CVE-2020-15502](https://cve.now/CVE-2020-15502.md): The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico (no CVSS)
- [CVE-2020-3402](https://cve.now/CVE-2020-3402.md): Cisco Unified Customer Voice Portal Information Disclosure Vulnerability (CVSS 5.3, Cisco Unified IP Interactive Voice Response)
- [CVE-2020-3391](https://cve.now/CVE-2020-3391.md): Cisco Digital Network Architecture Center Information Disclosure Vulnerability (CVSS 6.5, Cisco Digital Network Architecture Center)
- [CVE-2020-3340](https://cve.now/CVE-2020-3340.md): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2020-3297](https://cve.now/CVE-2020-3297.md): Cisco Small Business Smart and Managed Switches Session Management Vulnerability (CVSS 8.1, Cisco Small Business 200 Series Smart Switches)
- [CVE-2020-15503](https://cve.now/CVE-2020-15503.md): LibRaw before 0.20-RC1 lacks a thumbnail size range check. (no CVSS)
- [CVE-2020-8161](https://cve.now/CVE-2020-8161.md): A directory traversal vulnerability exists in rack \< 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Di (no CVSS, https://github.com/rack/rack · rack)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-07-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.