CVEs published July 9, 2020
51 CVEs were published on July 9, 2020: 0 critical, 6 high. 1 is now in CISA KEV.
- Published
- 51
- Critical
- 0
- High
- 6
- Medium
- 3
- Low
- 1
- Unrated
- 41
- Now in CISA KEV
- 1
- Fix available
- 34
Most affected products
- Mozilla Firefox
- 13
- Mozilla Firefox ESR · Mozilla Firefox +1
- 5
- Mozilla Thunderbird · Mozilla Firefox
- 4
- Atlassian Bitbucket Server
- 2
- FreeBSD
- 2
- Mozilla Firefox for iOS
- 2
- Android App 'Mercari'
- 1
- awslabs tough · tough
- 1
- com.google.oauth-client:google-oauth-client
- 1
- IBM InfoSphere Guardium Activity Monitor
- 1
High 6
- CVE-2020-4305IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to execute arbitrary code on the system, caused by the IBM InfoSphere Information Server
- CVE-2020-15093Improper verification of signature threshold in toughawslabs tough · tough
- CVE-2020-15092Stored XSS in TimelineJS3NUKnightLab TimelineJS3 · @knight-lab/timelinejs
- CVE-2020-5366Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability.Integrated Dell Remote Access Controller
- CVE-2020-7692Improper Authorizationcom.google.oauth-client:google-oauth-client
- CVE-2020-9377D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php.
Medium, low and unrated 45
- CVE-2020-4173IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies.IBM InfoSphere Guardium Activity Monitor
- CVE-2020-15299A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick
- CVE-2019-17638In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produceThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2020-15001An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1.
- CVE-2020-15000A PIN management problem was discovered on Yubico YubiKey 5 devices 5.2.0 to 5.2.6.
- CVE-2020-13132An issue was discovered in Yubico libykpiv before 2.1.0.
- CVE-2020-13131An issue was discovered in Yubico libykpiv before 2.1.0.
- CVE-2020-14170Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal netwAtlassian Bitbucket Server
- CVE-2020-14171Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requesAtlassian Bitbucket Server
- CVE-2020-15526In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive), the scope for disabling some TLS security certificate checks can extend beyond that
- CVE-2020-10756An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.Slirp
- CVE-2020-12414IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly Mozilla Firefox for iOS
- CVE-2020-12407Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the visMozilla Firefox
- CVE-2020-13994An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0.
- CVE-2020-12402During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly iMozilla Firefox
- CVE-2020-12399NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-13993An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0.
- CVE-2020-13992An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0.
- CVE-2020-12412By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with the https:// schemeMozilla Firefox
- CVE-2020-12408When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the addMozilla Firefox
- CVE-2020-12411Mozilla developers reported memory safety bugs present in Firefox 76.Mozilla Firefox
- CVE-2020-12409When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL.Mozilla Firefox
- CVE-2020-12398If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue witMozilla Thunderbird
- CVE-2020-12410Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-12405When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-12406Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-12404For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions.Mozilla Firefox for iOS
- CVE-2020-12416A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory cMozilla Firefox
- CVE-2020-12415When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a suMozilla Firefox
- CVE-2020-12417Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a poMozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-12419When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-freMozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-12420When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-12421When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-12422In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out oMozilla Firefox
- CVE-2020-12423When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%, Mozilla Firefox
- CVE-2020-12425Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential infoMozilla Firefox
- CVE-2020-12426Mozilla developers and community members reported memory safety bugs present in Firefox 77.Mozilla Firefox
- CVE-2020-12418Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript.Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-12424When constructing a permission prompt for WebRTC, a URI was supplied from the content process.Mozilla Firefox
- CVE-2018-12371An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM.Mozilla Firefox ESR · Mozilla Thunderbird +1
- CVE-2020-7458In FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEASE before p1, long values in the user-controlled PATH envirFreeBSD
- CVE-2020-7457In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before pFreeBSD
- CVE-2020-7693Denial of Service (DoS)sockjs
- CVE-2020-9376D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php.
- CVE-2020-5604Android App 'Mercari' (Japan version) prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a Android App 'Mercari'