# CVEs published 2020-07-13

19 CVEs were published on July 13, 2020: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-14300](https://cve.now/CVE-2020-14300.md): The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://a (no CVSS, Docker)
- [CVE-2020-14298](https://cve.now/CVE-2020-14298.md): The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc mi (no CVSS, Docker)
- [CVE-2020-15050](https://cve.now/CVE-2020-15050.md): An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. (no CVSS)
- [CVE-2020-10987](https://cve.now/CVE-2020-10987.md): The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via t (CVSS 9.8, KEV)
- [CVE-2020-10989](https://cve.now/CVE-2020-10989.md): An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payl (no CVSS)
- [CVE-2020-10988](https://cve.now/CVE-2020-10988.md): A hard-coded telnet credential in the tenda\_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to (no CVSS)
- [CVE-2020-10986](https://cve.now/CVE-2020-10986.md): A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and (no CVSS)
- [CVE-2019-19338](https://cve.now/CVE-2019-19338.md): A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculativ (CVSS 5.5, \[UNKNOWN\] Linux Kernel)
- [CVE-2020-5766](https://cve.now/CVE-2020-5766.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 a (no CVSS, SRS Simple Hits Counter Plugin for WordPress)
- [CVE-2020-11749](https://cve.now/CVE-2020-11749.md): Pandora FMS 7.0 NG \<= 746 suffers from Multiple XSS vulnerabilities in different browser views. (no CVSS)
- [CVE-2019-4591](https://cve.now/CVE-2019-4591.md): IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another u (CVSS 5.9, IBM Maximo Asset Management)
- [CVE-2020-15689](https://cve.now/CVE-2020-15689.md): Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact ra (no CVSS)
- [CVE-2019-20901](https://cve.now/CVE-2019-20901.md): The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users t (no CVSS, Atlassian Jira Server)
- [CVE-2020-14174](https://cve.now/CVE-2020-14174.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct (no CVSS, Atlassian Jira Server)
- [CVE-2019-20900](https://cve.now/CVE-2019-20900.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site sc (no CVSS, Atlassian Jira Server)
- [CVE-2019-20899](https://cve.now/CVE-2019-20899.md): The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated (no CVSS, Atlassian Jira Server)
- [CVE-2019-20898](https://cve.now/CVE-2019-20898.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticate (no CVSS, Atlassian Jira Server)
- [CVE-2019-20897](https://cve.now/CVE-2019-20897.md): The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service (no CVSS, Atlassian Jira Server)
- [CVE-2019-20907](https://cve.now/CVE-2019-20907.md): In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.ope (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-07-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.