CVEs published July 7, 2020
67 CVEs were published on July 7, 2020: 1 critical, 2 high. 1 is now in CISA KEV.
- Published
- 67
- Critical
- 1
- High
- 2
- Medium
- 4
- Low
- 0
- Unrated
- 60
- Now in CISA KEV
- 1
- Fix available
- 10
Most affected products
- Mitsubishi Electric GOT2000 series GT27, GT25, and GT23
- 6
- electron
- 4
- phpzag live add edit delete data tables records with ajax p…
- 3
- "HCL AppScan Enterprise"
- 2
- Samba
- 2
- froala-editor
- 1
- Google wpantund
- 1
- haffner/jh_captcha
- 1
- marcwillmann/turn
- 1
- mittwald/typo3_forum
- 1
Critical 1
High 2
Medium, low and unrated 64
- CVE-2020-15600An issue was discovered in CMSUno before 1.6.1.
- CVE-2020-15599Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
- CVE-2020-8916Memory leak in wpanctl can lead to DoSGoogle wpantund
- CVE-2020-15008A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12.
- CVE-2020-12736Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution.
- CVE-2020-8521SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysqlphpzag live add edit delete data tables records with ajax p…
- CVE-2020-8519SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysqlphpzag live add edit delete data tables records with ajax p…
- CVE-2020-8520SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysqlphpzag live add edit delete data tables records with ajax p…
- CVE-2020-12821Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
- CVE-2020-15095Sensitive information exposure through logs in npm clinpm cli · npm
- CVE-2019-20896WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter.
- CVE-2020-15350RIOT 2020.04 has a buffer overflow in the base64 decoder.
- CVE-2019-19935Froala Editor before 3.2.3 allows XSS.froala-editor
- CVE-2020-11882The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications.
- CVE-2020-15028NeDi 1.9C is vulnerable to a cross-site scripting (XSS) attack.
- CVE-2020-15029NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
- CVE-2020-15030NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
- CVE-2020-15031NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
- CVE-2020-15032NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
- CVE-2020-15033NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
- CVE-2020-15034NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
- CVE-2020-15035NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
- CVE-2020-15515The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.marcwillmann/turn
- CVE-2019-4323"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of un"HCL AppScan Enterprise"
- CVE-2019-4324"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy.""HCL AppScan Enterprise"
- CVE-2020-15036NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
- CVE-2020-15037NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
- CVE-2020-15367Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts.
- CVE-2020-15392A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2.
- CVE-2020-15509Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applicat
- CVE-2020-15525GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint.
- CVE-2020-15513The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control.mittwald/typo3_forum
- CVE-2020-15514The jh_captcha extension through 2.1.3, and 3.x through 3.0.2, for TYPO3 allows XSS.haffner/jh_captcha
- CVE-2020-15516The mm_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF.
- CVE-2020-15517The ke_search (aka Faceted Search) extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS.tpwd/ke_search
- CVE-2020-10730A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 andSamba
- CVE-2020-15577An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software.
- CVE-2020-10745A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP.Samba
- CVE-2020-15578An issue was discovered on Samsung mobile devices with O(8.x) software.
- CVE-2020-15579An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
- CVE-2020-15580An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
- CVE-2020-15581An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
- CVE-2020-15582An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 7885 chipsets) software.
- CVE-2020-15583An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
- CVE-2020-15584An issue was discovered on Samsung mobile devices with Q(10.0) software.
- CVE-2020-15573SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421.
- CVE-2020-15574SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893.
- CVE-2020-15575SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194.
- CVE-2020-15576SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response.
- CVE-2020-15567An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-
- CVE-2020-15564An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check
- CVE-2020-15565An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain p
- CVE-2020-15563An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash.
- CVE-2020-15566An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event
- CVE-2020-5600TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23
- CVE-2020-5598TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23
- CVE-2020-5599TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23
- CVE-2020-5595TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23
- CVE-2020-5596TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23
- CVE-2020-5597TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23
- CVE-2020-15506An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3,
- CVE-2020-15507An arbitrary file reading vulnerability in MobileIron Core versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0,
- CVE-2020-15096Context isolation bypass via Promise in Electronelectron
- CVE-2020-4075Arbitrary file read via window-open IPC in Electronelectron