# CVEs published 2020-07-10

24 CVEs were published on July 10, 2020: 0 critical, 2 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2020-15105](https://cve.now/CVE-2020-15105.md): In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session (CVSS 5.4, Bouke django-two-factor-auth · django-two-factor-auth)
- [CVE-2020-4042](https://cve.now/CVE-2020-4042.md): Authentication bypass in Bareos (CVSS 6.8, bareos)
- [CVE-2020-11061](https://cve.now/CVE-2020-11061.md): Heap-based Buffer Overflow in Bareos Director (CVSS 6.0, Bareos GmbH & Co. KG Bareos Director)
- [CVE-2020-11081](https://cve.now/CVE-2020-11081.md): osquery susceptible to DLL search order hijacking of zlib1.dll (CVSS 5.3, osquery)
- [CVE-2020-6114](https://cve.now/CVE-2020-6114.md): An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09 (CVSS 6.6, Glacies IceHRM")
- [CVE-2020-15504](https://cve.now/CVE-2020-15504.md): A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker (no CVSS)
- [CVE-2020-8181](https://cve.now/CVE-2020-8181.md): A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars. (no CVSS, Nextcloud Contact)
- [CVE-2020-8199](https://cve.now/CVE-2020-8199.md): Improper access control in Citrix ADC Gateway Linux client versions before 1.0.0.137 results in local privilege escalation to root. (no CVSS, Citrix Gateway Plug-in for Linux)
- [CVE-2020-8197](https://cve.now/CVE-2020-8197.md): Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5- (no CVSS, Citrix ADC, Citrix Gateway)
- [CVE-2020-8196](https://cve.now/CVE-2020-8196.md): Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and C (CVSS 4.3, KEV, Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP)
- [CVE-2020-8195](https://cve.now/CVE-2020-8195.md): Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and (CVSS 6.5, KEV, Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP)
- [CVE-2020-8198](https://cve.now/CVE-2020-8198.md): Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and (no CVSS, Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP)
- [CVE-2020-8194](https://cve.now/CVE-2020-8194.md): Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and (no CVSS, Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP)
- [CVE-2020-8193](https://cve.now/CVE-2020-8193.md): Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and C (CVSS 6.5, KEV, Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP)
- [CVE-2020-8191](https://cve.now/CVE-2020-8191.md): Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and (no CVSS, Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP)
- [CVE-2020-8186](https://cve.now/CVE-2020-8186.md): A command injection vulnerability in the \`devcert\` module may lead to remote code execution when users of the module pass untrusted input to (no CVSS, devcert)
- [CVE-2020-8187](https://cve.now/CVE-2020-8187.md): Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthenticated users to perform (no CVSS, Citrix ADC, Citrix Gateway)
- [CVE-2020-8190](https://cve.now/CVE-2020-8190.md): Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 al (no CVSS, Citrix ADC, Citrix Gateway)
- [CVE-2020-3974](https://cve.now/CVE-2020-3974.md): VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior before 11.2.0 ) and Horizon Client for Mac (5.x and prior (no CVSS, VMware Fusion, VMware Remote Console for Mac and Horizon Cl…)
- [CVE-2020-9258](https://cve.now/CVE-2020-9258.md): HUAWEI P30 smartphone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper input verification vulnerability. (no CVSS, HUAWEI P30)
- [CVE-2020-9260](https://cve.now/CVE-2020-9260.md): HUAWEI P30 and HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E22R2P5) and versions earlier than 10.1.0.160(C00E160R2P (no CVSS, HUAWEI P30;HUAWEI P30 Pro)
- [CVE-2020-7815](https://cve.now/CVE-2020-7815.md): XPLATFORM v9.2.260 and eariler versions contain a vulnerability that could allow remote files to be downloaded by setting the arguments to t (CVSS 7.8, TOBESOFT XPLATFORM)
- [CVE-2020-7814](https://cve.now/CVE-2020-7814.md): RAONWIZ v2018.0.2.50 and eariler versions contains a vulnerability that could allow remote files to be downloaded and excuted by lack of val (CVSS 7.8, RAONWIZ RAON KUpload)
- [CVE-2020-5607](https://cve.now/CVE-2020-5607.md): Open redirect vulnerability in SHIRASAGI v1.13.1 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct ph (no CVSS, SHIRASAGI Project SHIRASAGI)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.