# CVEs published 2020-07-07

67 CVEs were published on July 7, 2020: 1 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-15600](https://cve.now/CVE-2020-15600.md): An issue was discovered in CMSUno before 1.6.1. (no CVSS)
- [CVE-2020-15599](https://cve.now/CVE-2020-15599.md): Victor CMS through 2019-02-28 allows XSS via the register.php user\_firstname or user\_lastname field. (no CVSS)
- [CVE-2020-8916](https://cve.now/CVE-2020-8916.md): Memory leak in wpanctl can lead to DoS (CVSS 5.0, Google wpantund)
- [CVE-2020-15008](https://cve.now/CVE-2020-15008.md): A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. (no CVSS)
- [CVE-2020-12736](https://cve.now/CVE-2020-12736.md): Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. (no CVSS)
- [CVE-2020-8521](https://cve.now/CVE-2020-8521.md): SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql (no CVSS, phpzag live add edit delete data tables records with ajax p…)
- [CVE-2020-8519](https://cve.now/CVE-2020-8519.md): SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql (no CVSS, phpzag live add edit delete data tables records with ajax p…)
- [CVE-2020-8520](https://cve.now/CVE-2020-8520.md): SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql (no CVSS, phpzag live add edit delete data tables records with ajax p…)
- [CVE-2020-12821](https://cve.now/CVE-2020-12821.md): Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack. (no CVSS)
- [CVE-2020-15095](https://cve.now/CVE-2020-15095.md): Sensitive information exposure through logs in npm cli (CVSS 4.4, npm cli · npm)
- [CVE-2019-20896](https://cve.now/CVE-2019-20896.md): WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter. (no CVSS)
- [CVE-2020-15350](https://cve.now/CVE-2020-15350.md): RIOT 2020.04 has a buffer overflow in the base64 decoder. (no CVSS)
- [CVE-2019-19935](https://cve.now/CVE-2019-19935.md): Froala Editor before 3.2.3 allows XSS. (no CVSS, froala-editor)
- [CVE-2020-11882](https://cve.now/CVE-2020-11882.md): The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications. (no CVSS)
- [CVE-2020-15028](https://cve.now/CVE-2020-15028.md): NeDi 1.9C is vulnerable to a cross-site scripting (XSS) attack. (no CVSS)
- [CVE-2020-15029](https://cve.now/CVE-2020-15029.md): NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. (no CVSS)
- [CVE-2020-15030](https://cve.now/CVE-2020-15030.md): NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. (no CVSS)
- [CVE-2020-15031](https://cve.now/CVE-2020-15031.md): NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. (no CVSS)
- [CVE-2020-15032](https://cve.now/CVE-2020-15032.md): NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. (no CVSS)
- [CVE-2020-15033](https://cve.now/CVE-2020-15033.md): NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. (no CVSS)
- [CVE-2020-15034](https://cve.now/CVE-2020-15034.md): NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. (no CVSS)
- [CVE-2020-15035](https://cve.now/CVE-2020-15035.md): NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. (no CVSS)
- [CVE-2020-15515](https://cve.now/CVE-2020-15515.md): The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution. (no CVSS, marcwillmann/turn)
- [CVE-2019-4323](https://cve.now/CVE-2019-4323.md): "HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of un (no CVSS, "HCL AppScan Enterprise")
- [CVE-2019-4324](https://cve.now/CVE-2019-4324.md): "HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy." (no CVSS, "HCL AppScan Enterprise")
- [CVE-2020-15036](https://cve.now/CVE-2020-15036.md): NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. (no CVSS)
- [CVE-2020-15037](https://cve.now/CVE-2020-15037.md): NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. (no CVSS)
- [CVE-2020-15367](https://cve.now/CVE-2020-15367.md): Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. (no CVSS)
- [CVE-2020-15392](https://cve.now/CVE-2020-15392.md): A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. (no CVSS)
- [CVE-2020-15509](https://cve.now/CVE-2020-15509.md): Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applicat (no CVSS)
- [CVE-2020-15525](https://cve.now/CVE-2020-15525.md): GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint. (no CVSS)
- [CVE-2020-15513](https://cve.now/CVE-2020-15513.md): The typo3\_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control. (no CVSS, mittwald/typo3\_forum)
- [CVE-2020-15514](https://cve.now/CVE-2020-15514.md): The jh\_captcha extension through 2.1.3, and 3.x through 3.0.2, for TYPO3 allows XSS. (no CVSS, haffner/jh\_captcha)
- [CVE-2020-15516](https://cve.now/CVE-2020-15516.md): The mm\_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF. (no CVSS)
- [CVE-2020-15517](https://cve.now/CVE-2020-15517.md): The ke\_search (aka Faceted Search) extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS. (no CVSS, tpwd/ke\_search)
- [CVE-2020-10730](https://cve.now/CVE-2020-10730.md): A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and (no CVSS, Samba)
- [CVE-2020-15577](https://cve.now/CVE-2020-15577.md): An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. (no CVSS)
- [CVE-2020-10745](https://cve.now/CVE-2020-10745.md): A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. (no CVSS, Samba)
- [CVE-2020-15578](https://cve.now/CVE-2020-15578.md): An issue was discovered on Samsung mobile devices with O(8.x) software. (no CVSS)
- [CVE-2020-15579](https://cve.now/CVE-2020-15579.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. (no CVSS)
- [CVE-2020-15580](https://cve.now/CVE-2020-15580.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. (no CVSS)
- [CVE-2020-15581](https://cve.now/CVE-2020-15581.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. (no CVSS)
- [CVE-2020-15582](https://cve.now/CVE-2020-15582.md): An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 7885 chipsets) software. (no CVSS)
- [CVE-2020-15583](https://cve.now/CVE-2020-15583.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. (no CVSS)
- [CVE-2020-15584](https://cve.now/CVE-2020-15584.md): An issue was discovered on Samsung mobile devices with Q(10.0) software. (no CVSS)
- [CVE-2020-15573](https://cve.now/CVE-2020-15573.md): SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421. (no CVSS)
- [CVE-2020-15574](https://cve.now/CVE-2020-15574.md): SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893. (no CVSS)
- [CVE-2020-15575](https://cve.now/CVE-2020-15575.md): SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194. (no CVSS)
- [CVE-2020-15576](https://cve.now/CVE-2020-15576.md): SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response. (no CVSS)
- [CVE-2020-15567](https://cve.now/CVE-2020-15567.md): An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non- (no CVSS)
- [CVE-2020-15564](https://cve.now/CVE-2020-15564.md): An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check (no CVSS)
- [CVE-2020-15565](https://cve.now/CVE-2020-15565.md): An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain p (no CVSS)
- [CVE-2020-15563](https://cve.now/CVE-2020-15563.md): An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. (no CVSS)
- [CVE-2020-15566](https://cve.now/CVE-2020-15566.md): An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event (no CVSS)
- [CVE-2020-5600](https://cve.now/CVE-2020-5600.md): TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, (no CVSS, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23)
- [CVE-2020-5598](https://cve.now/CVE-2020-5598.md): TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, (no CVSS, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23)
- [CVE-2020-5599](https://cve.now/CVE-2020-5599.md): TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, (no CVSS, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23)
- [CVE-2020-5595](https://cve.now/CVE-2020-5595.md): TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, (no CVSS, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23)
- [CVE-2020-5596](https://cve.now/CVE-2020-5596.md): TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, (no CVSS, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23)
- [CVE-2020-5597](https://cve.now/CVE-2020-5597.md): TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, (no CVSS, Mitsubishi Electric GOT2000 series GT27, GT25, and GT23)
- [CVE-2020-15505](https://cve.now/CVE-2020-15505.md): A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, (CVSS 9.8, KEV)
- [CVE-2020-15506](https://cve.now/CVE-2020-15506.md): An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, (no CVSS)
- [CVE-2020-15507](https://cve.now/CVE-2020-15507.md): An arbitrary file reading vulnerability in MobileIron Core versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, (no CVSS)
- [CVE-2020-15096](https://cve.now/CVE-2020-15096.md): Context isolation bypass via Promise in Electron (CVSS 6.8, electron)
- [CVE-2020-4075](https://cve.now/CVE-2020-4075.md): Arbitrary file read via window-open IPC in Electron (CVSS 6.8, electron)
- [CVE-2020-4076](https://cve.now/CVE-2020-4076.md): Context isolation bypass via leaked cross-context objects in Electron (CVSS 7.8, electron)
- [CVE-2020-4077](https://cve.now/CVE-2020-4077.md): Context isolation bypass via contextBridge in Electron (CVSS 7.7, electron)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-07-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.