# CVEs published 2020-07-09

51 CVEs were published on July 9, 2020: 0 critical, 6 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-4305](https://cve.now/CVE-2020-4305.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to execute arbitrary code on the system, caused by the (CVSS 8.1, IBM InfoSphere Information Server)
- [CVE-2020-4173](https://cve.now/CVE-2020-4173.md): IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.1, IBM InfoSphere Guardium Activity Monitor)
- [CVE-2020-15093](https://cve.now/CVE-2020-15093.md): Improper verification of signature threshold in tough (CVSS 8.6, awslabs tough · tough)
- [CVE-2020-15092](https://cve.now/CVE-2020-15092.md): Stored XSS in TimelineJS3 (CVSS 7.2, NUKnightLab TimelineJS3 · @knight-lab/timelinejs)
- [CVE-2020-15299](https://cve.now/CVE-2020-15299.md): A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick (no CVSS)
- [CVE-2019-17638](https://cve.now/CVE-2019-17638.md): In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2020-15001](https://cve.now/CVE-2020-15001.md): An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. (no CVSS)
- [CVE-2020-15000](https://cve.now/CVE-2020-15000.md): A PIN management problem was discovered on Yubico YubiKey 5 devices 5.2.0 to 5.2.6. (no CVSS)
- [CVE-2020-13132](https://cve.now/CVE-2020-13132.md): An issue was discovered in Yubico libykpiv before 2.1.0. (CVSS 4.3)
- [CVE-2020-13131](https://cve.now/CVE-2020-13131.md): An issue was discovered in Yubico libykpiv before 2.1.0. (CVSS 4.3)
- [CVE-2020-14170](https://cve.now/CVE-2020-14170.md): Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal netw (no CVSS, Atlassian Bitbucket Server)
- [CVE-2020-14171](https://cve.now/CVE-2020-14171.md): Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import reques (no CVSS, Atlassian Bitbucket Server)
- [CVE-2020-15526](https://cve.now/CVE-2020-15526.md): In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive), the scope for disabling some TLS security certificate checks can extend beyond that (no CVSS)
- [CVE-2020-10756](https://cve.now/CVE-2020-10756.md): An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. (no CVSS, Slirp)
- [CVE-2020-12414](https://cve.now/CVE-2020-12414.md): IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly (no CVSS, Mozilla Firefox for iOS)
- [CVE-2020-12407](https://cve.now/CVE-2020-12407.md): Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the vis (no CVSS, Mozilla Firefox)
- [CVE-2020-13994](https://cve.now/CVE-2020-13994.md): An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. (no CVSS)
- [CVE-2020-12402](https://cve.now/CVE-2020-12402.md): During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly i (no CVSS, Mozilla Firefox)
- [CVE-2020-12399](https://cve.now/CVE-2020-12399.md): NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2020-13993](https://cve.now/CVE-2020-13993.md): An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. (no CVSS)
- [CVE-2020-13992](https://cve.now/CVE-2020-13992.md): An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. (no CVSS)
- [CVE-2020-12412](https://cve.now/CVE-2020-12412.md): By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with the https:// scheme (no CVSS, Mozilla Firefox)
- [CVE-2020-12408](https://cve.now/CVE-2020-12408.md): When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the add (no CVSS, Mozilla Firefox)
- [CVE-2020-12411](https://cve.now/CVE-2020-12411.md): Mozilla developers reported memory safety bugs present in Firefox 76. (no CVSS, Mozilla Firefox)
- [CVE-2020-12409](https://cve.now/CVE-2020-12409.md): When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. (no CVSS, Mozilla Firefox)
- [CVE-2020-12398](https://cve.now/CVE-2020-12398.md): If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue wit (no CVSS, Mozilla Thunderbird)
- [CVE-2020-12410](https://cve.now/CVE-2020-12410.md): Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2020-12405](https://cve.now/CVE-2020-12405.md): When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2020-12406](https://cve.now/CVE-2020-12406.md): Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2020-12404](https://cve.now/CVE-2020-12404.md): For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. (no CVSS, Mozilla Firefox for iOS)
- [CVE-2020-12416](https://cve.now/CVE-2020-12416.md): A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory c (no CVSS, Mozilla Firefox)
- [CVE-2020-12415](https://cve.now/CVE-2020-12415.md): When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a su (no CVSS, Mozilla Firefox)
- [CVE-2020-12417](https://cve.now/CVE-2020-12417.md): Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a po (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1)
- [CVE-2020-12419](https://cve.now/CVE-2020-12419.md): When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-fre (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1)
- [CVE-2020-12420](https://cve.now/CVE-2020-12420.md): When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1)
- [CVE-2020-12421](https://cve.now/CVE-2020-12421.md): When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1)
- [CVE-2020-12422](https://cve.now/CVE-2020-12422.md): In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out o (no CVSS, Mozilla Firefox)
- [CVE-2020-12423](https://cve.now/CVE-2020-12423.md): When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%, (no CVSS, Mozilla Firefox)
- [CVE-2020-12425](https://cve.now/CVE-2020-12425.md): Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential info (no CVSS, Mozilla Firefox)
- [CVE-2020-12426](https://cve.now/CVE-2020-12426.md): Mozilla developers and community members reported memory safety bugs present in Firefox 77. (no CVSS, Mozilla Firefox)
- [CVE-2020-12418](https://cve.now/CVE-2020-12418.md): Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1)
- [CVE-2020-12424](https://cve.now/CVE-2020-12424.md): When constructing a permission prompt for WebRTC, a URI was supplied from the content process. (no CVSS, Mozilla Firefox)
- [CVE-2018-12371](https://cve.now/CVE-2018-12371.md): An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2020-7458](https://cve.now/CVE-2020-7458.md): In FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEASE before p1, long values in the user-controlled PATH envir (no CVSS, FreeBSD)
- [CVE-2020-7457](https://cve.now/CVE-2020-7457.md): In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p (no CVSS, FreeBSD)
- [CVE-2020-5366](https://cve.now/CVE-2020-5366.md): Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. (CVSS 7.1, Integrated Dell Remote Access Controller)
- [CVE-2020-7693](https://cve.now/CVE-2020-7693.md): Denial of Service (DoS) (CVSS 5.3, sockjs)
- [CVE-2020-7692](https://cve.now/CVE-2020-7692.md): Improper Authorization (CVSS 7.4, com.google.oauth-client:google-oauth-client)
- [CVE-2020-9376](https://cve.now/CVE-2020-9376.md): D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED\_GROUP=1 to getcfg.php. (no CVSS)
- [CVE-2020-9377](https://cve.now/CVE-2020-9377.md): D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. (CVSS 8.8, KEV)
- [CVE-2020-5604](https://cve.now/CVE-2020-5604.md): Android App 'Mercari' (Japan version) prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a (no CVSS, Android App 'Mercari')

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-07-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.