CVEs published July 14, 2020
193 CVEs were published on July 14, 2020: 4 critical, 6 high. 4 are now in CISA KEV.
- Published
- 193
- Critical
- 4
- High
- 6
- Medium
- 20
- Low
- 4
- Unrated
- 159
- Now in CISA KEV
- 4
- Fix available
- 30
Most affected products
- Microsoft Windows
- 82
- Siemens AG SICAM MMU · Siemens AG SICAM SGU +1
- 9
- Microsoft Windows Server
- 6
- IBM QRadar SIEM
- 5
- SAP SE SAP Disclosure Management
- 5
- Microsoft SharePoint Enterprise Server · Microsoft Share… +4
- 4
- Microsoft SharePoint Enterprise Server · Microsoft SharePoi…
- 4
- Microsoft SharePoint Enterprise Server · Microsoft Share… +1
- 3
- SAP SE SAP Business Objects Business Intelligence Platform
- 3
- Siemens Camstar Enterprise Platform · Siemens Opcenter Exec…
- 3
Critical 4
- CVE-2020-1350A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows Microsoft Windows Server · Microsoft Windows Server,
- CVE-2020-1040A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaMicrosoft Windows Server
- CVE-2020-4512IBM QRadar SIEM 7.3 and 7.4 could allow a remote privileged user to execute commands.IBM QRadar SIEM
- CVE-2020-6287SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows anSAP SE SAP NetWeaver AS JAVA
High 6
- CVE-2020-1336Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-1147A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check theMicrosoft SharePoint Enterprise Server · Microsoft Shar… +21
- CVE-2020-5246LDAP injection vulnerability in Traccar GPS Tracking SystemTraccar
- CVE-2020-5374Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain a hard-coded cryptoDell OMIMSSC
- CVE-2020-4510IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM QRadar SIEM
- CVE-2020-6285SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) (versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50), under certain conditions allows an atSAP SE SAP NetWeaver - XML Toolkit for JAVA
Medium, low and unrated 183
- CVE-2020-1469A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service VulnerabiMicrosoft Bond · Bond.Core.CSharp
- CVE-2020-1481A remote code execution vulnerability exists in the ESLint extension for Visual Studio Code when it validates source code after opening a prMicrosoft Visual Studio Code ESLint extension
- CVE-2020-1463An elevation of privilege vulnerability exists in the way that the SharedStream Library handles objects in memory, aka 'Windows SharedStreamMicrosoft Windows
- CVE-2020-1465An elevation of privilege vulnerability exists in Microsoft OneDrive that allows file deletion in arbitrary locations.To exploit the vulneraMicrosoft OneDrive for Windows
- CVE-2020-1468An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2020-1461An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit thMicrosoft Forefront Endpoint Protection · Microsoft Syst… +2
- CVE-2020-1462An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge (EdgeHTML-based), aka 'Skype for BusinMicrosoft Edge (EdgeHTML-based) on Windows
- CVE-2020-1456A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2020-1458A remote code execution vulnerability exists when Microsoft Office improperly validates input before loading dynamic link library (DLL) fileMicrosoft 365 Apps for Enterprise for 32-bit Systems · Micr…
- CVE-2020-1451A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2020-1454This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.Microsoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2020-1449A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, akaMicrosoft Office · Microsoft 365 Apps for Enterprise for… +2
- CVE-2020-1450A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2020-1447A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft WMicrosoft SharePoint Enterprise Server · Microsoft Share… +4
- CVE-2020-1448A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft WMicrosoft SharePoint Enterprise Server · Microsoft Share… +2
- CVE-2020-1445An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka 'Microsoft Office Microsoft SharePoint Enterprise Server · Microsoft Share… +4
- CVE-2020-1446A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft WMicrosoft SharePoint Enterprise Server · Microsoft Share… +4
- CVE-2020-1443A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2020-1444A remote code execution vulnerability exists in the way Microsoft SharePoint software parses specially crafted email messages, aka 'MicrosofMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2020-1438An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'WindoMicrosoft Windows
- CVE-2020-1439A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source Microsoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2020-1442A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request, aka 'Office Web Apps Microsoft Office Online Server · Microsoft Office Web Apps
- CVE-2020-1436A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted fonts.For all systems exceptMicrosoft Windows
- CVE-2020-1437An elevation of privilege vulnerability exists in the way that the Windows Network Location Awareness Service handles objects in memory, akaMicrosoft Windows
- CVE-2020-1434An elevation of privilege vulnerability exists in the way that the Windows Sync Host Service handles objects in memory, aka 'Windows Sync HoMicrosoft Windows
- CVE-2020-1435A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka Microsoft Windows
- CVE-2020-1432An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer, aka 'Skype for Business via InternMicrosoft Internet Explorer 11 on Windows · Microsoft Inter…
- CVE-2020-1433An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF Microsoft Edge (EdgeHTML-based) on Windows
- CVE-2020-1430An elevation of privilege vulnerability exists when the Windows UPnP Device Host improperly handles memory.To exploit this vulnerability, anMicrosoft Windows
- CVE-2020-1431An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resultiMicrosoft Windows
- CVE-2020-1428An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'WindoMicrosoft Windows
- CVE-2020-1429An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash, aka 'Windows Error RMicrosoft Windows
- CVE-2020-1426An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationMicrosoft Windows
- CVE-2020-1427An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'WindoMicrosoft Windows
- CVE-2020-1422An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime ElevationMicrosoft Windows
- CVE-2020-1423An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles files, aka 'Windows Subsystem for LinMicrosoft Windows
- CVE-2020-1424An elevation of privilege vulnerability exists when the Windows Update Stack fails to properly handle objects in memory, aka 'Windows UpdateMicrosoft Windows
- CVE-2020-1420An information disclosure vulnerability exists when Windows Error Reporting improperly handles file operations.To exploit this vulnerabilityMicrosoft Windows
- CVE-2020-1421A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attaMicrosoft Windows
- CVE-2020-1418An elevation of privilege vulnerability exists when the Windows Diagnostics Execution Service fails to properly sanitize input, leading to aMicrosoft Windows
- CVE-2020-1419An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel InMicrosoft Windows
- CVE-2020-1415An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime ElevationMicrosoft Windows Server, · Microsoft Windows
- CVE-2020-1416An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual StuMicrosoft Visual Studio · Microsoft Azure Storage Explor… +1
- CVE-2020-1413An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime ElevationMicrosoft Windows
- CVE-2020-1414An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime ElevationMicrosoft Windows
- CVE-2020-1411An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel ElevaMicrosoft Windows
- CVE-2020-1412A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft GraphicsMicrosoft Windows
- CVE-2020-1409A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution VMicrosoft Windows · Microsoft Office
- CVE-2020-1410A remote code execution vulnerability exists when Windows Address Book (WAB) improperly processes vcard files.To exploit the vulnerability, Microsoft Windows
- CVE-2020-1407A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2020-1408A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'MicrosoMicrosoft Windows
- CVE-2020-1404An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime ElevationMicrosoft Windows
- CVE-2020-1405An elevation of privilege vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'WiMicrosoft Windows
- CVE-2020-1406An elevation of privilege vulnerability exists in the way that the Windows Network List Service handles objects in memory, aka 'Windows NetwMicrosoft Windows
- CVE-2020-1402An elevation of privilege vulnerability exists when the Windows ActiveX Installer Service improperly handles memory.To exploit this vulnerabMicrosoft Windows
- CVE-2020-1403A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code ExecutMicrosoft Internet Explorer 11 on Windows · Microsoft Inter…
- CVE-2020-1400A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2020-1401A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2020-1398An elevation of privilege vulnerability exists when Windows Lockscreen fails to properly handle Ease of Access dialog.An attacker who succesMicrosoft Windows
- CVE-2020-1399An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime ElevationMicrosoft Windows
- CVE-2020-1396An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker whoMicrosoft Windows
- CVE-2020-1397An information disclosure vulnerability exists in Windows when the Windows Imaging Component fails to properly handle objects in memory, akaMicrosoft Windows
- CVE-2020-1394An elevation of privilege vulnerability exists in the way that the Windows Geolocation Framework handles objects in memory, aka 'Windows EleMicrosoft Windows
- CVE-2020-1395An elevation of privilege vulnerability exists in the way that the Windows Speech Brokered API handles objects in memory, aka 'Windows ElevaMicrosoft Windows
- CVE-2020-1392An elevation of privilege vulnerability exists when the Windows Delivery Optimization service improperly handles objects in memory, aka 'WinMicrosoft Windows
- CVE-2020-1393An elevation of privilege vulnerability exists when the Windows Diagnostics Hub Standard Collector Service fails to properly sanitize input,Microsoft Windows · Microsoft Visual Studio
- CVE-2020-1390An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'WindoMicrosoft Windows
- CVE-2020-1391An information disclosure vulnerability exists when the Windows Agent Activation Runtime (AarSvc) fails to properly handle objects in memoryMicrosoft Windows
- CVE-2020-1387An elevation of privilege vulnerability exists in the way the Windows Push Notification Service handles objects in memory, aka 'Windows PushMicrosoft Windows
- CVE-2020-1388An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory, aka 'Windows Elevation of PrivilegeMicrosoft Windows
- CVE-2020-1389An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel InMicrosoft Windows
- CVE-2020-1385An elevation of privilege vulnerability exists in the way that the Windows Credential Picker handles objects in memory, aka 'Windows CredentMicrosoft Windows
- CVE-2020-1386An information vulnerability exists when Windows Connected User Experiences and Telemetry Service improperly discloses file information, akaMicrosoft Windows
- CVE-2020-1382An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows GraphiMicrosoft Windows
- CVE-2020-1384An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles Microsoft Windows
- CVE-2020-1375An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of PriMicrosoft Windows
- CVE-2020-1381An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows GraphiMicrosoft Windows
- CVE-2020-1373An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'WindoMicrosoft Windows
- CVE-2020-1374A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote DeMicrosoft Windows
- CVE-2020-1371An elevation of privilege vulnerability exists when the Windows Event Logging Service improperly handles memory.To exploit this vulnerabilitMicrosoft Windows
- CVE-2020-1372An elevation of privilege vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles objects in memory,Microsoft Windows
- CVE-2020-1369An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServiMicrosoft Windows
- CVE-2020-1370An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime ElevationMicrosoft Windows
- CVE-2020-1366An elevation of privilege vulnerability exists when the Windows Print Workflow Service improperly handles objects in memory, aka 'Windows PrMicrosoft Windows
- CVE-2020-1367An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationMicrosoft Windows
- CVE-2020-1368An elevation of privilege vulnerability exists in the way that the Credential Enrollment Manager service handles objects in memory, aka 'WinMicrosoft Windows
- CVE-2020-1364A denial of service vulnerability exists in the way that the WalletService handles files, aka 'Windows WalletService Denial of Service VulneMicrosoft Windows
- CVE-2020-1365An elevation of privilege vulnerability exists when the Windows Event Logging Service improperly handles memory.To exploit this vulnerabilitMicrosoft Windows
- CVE-2020-1362An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServiMicrosoft Windows
- CVE-2020-1363An elevation of privilege vulnerability exists when the Windows Picker Platform improperly handles memory.To exploit this vulnerability, an Microsoft Windows
- CVE-2020-1360An elevation of privilege vulnerability exists when the Windows Profile Service improperly handles file operations, aka 'Windows Profile SerMicrosoft Windows
- CVE-2020-1361An information disclosure vulnerability exists in the way that the WalletService handles memory.To exploit the vulnerability, an attacker woMicrosoft Windows
- CVE-2020-1358An information disclosure vulnerability exists when the Windows Resource Policy component improperly handles memory.To exploit this vulnerabMicrosoft Windows
- CVE-2020-1359An elevation of privilege vulnerability exists when the Windows Cryptography Next Generation (CNG) Key Isolation service improperly handles Microsoft Windows
- CVE-2020-1356An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations, aka 'Windows iSCSI Microsoft Windows Server, · Microsoft Windows Server
- CVE-2020-1357An elevation of privilege vulnerability exists when the Windows System Events Broker improperly handles file operations, aka 'Windows SystemMicrosoft Windows
- CVE-2020-1354An elevation of privilege vulnerability exists when the Windows UPnP Device Host improperly handles memory.To exploit this vulnerability, anMicrosoft Windows
- CVE-2020-1355A remote code execution vulnerability exists when the Windows Font Driver Host improperly handles memory.An attacker who successfully exploiMicrosoft Windows
- CVE-2020-1351An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory, aka 'Microsoft GrapMicrosoft Windows
- CVE-2020-1352An elevation of privilege vulnerability exists when the Windows USO Core Worker improperly handles memory.To exploit this vulnerability, an Microsoft Windows
- CVE-2020-1353An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime ElevationMicrosoft Windows
- CVE-2020-1346An elevation of privilege vulnerability exists when the Windows Modules Installer improperly handles file operations, aka 'Windows Modules IMicrosoft Windows
- CVE-2020-1347An elevation of privilege vulnerability exists when the Windows Storage Services improperly handle file operations, aka 'Windows Storage SerMicrosoft Windows
- CVE-2020-1342An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, whMicrosoft SharePoint Enterprise Server · Microsoft Share… +4
- CVE-2020-1344An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServiMicrosoft Windows
- CVE-2020-1333An elevation of privilege vulnerability exists when Group Policy Services Policy Processing improperly handle reparse points, aka 'Group PolMicrosoft Windows
- CVE-2020-1326A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOpsMicrosoft Azure DevOps Server
- CVE-2020-1330An information disclosure vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'WiMicrosoft Windows Server, · Microsoft Windows
- CVE-2020-1249An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime ElevationMicrosoft Windows
- CVE-2020-1267This security update corrects a denial of service in the Local Security Authority Subsystem Service (LSASS) caused when an authenticated attMicrosoft Windows
- CVE-2020-1240A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft 365 Apps for Enterprise for 32-bit Systems · Micr…
- CVE-2020-1042A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaMicrosoft Windows Server
- CVE-2020-1043A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaMicrosoft Windows Server
- CVE-2020-1085An elevation of privilege vulnerability exists in the way that the Windows Function Discovery Service handles objects in memory, aka 'WindowMicrosoft Windows
- CVE-2020-1041A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaMicrosoft Windows Server
- CVE-2020-1032A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaMicrosoft Windows Server
- CVE-2020-1036A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaMicrosoft Windows Server
- CVE-2020-1025Microsoft Office Elevation of Privilege VulnerabilityMicrosoft Skype for Business Server 2019 CU2 · Microsof… +4
- CVE-2020-15104TLS Validation Vulnerability in Envoyenvoyproxy envoy
- CVE-2020-15101Nested directory structure can lead to Uncontrolled Resource Consumption in freewvsschokokeksorg freewvs · freewvs
- CVE-2020-11084Command Injection in iPearyaBobJonez iPear
- CVE-2020-11083Stored XSS in OctoberOctober CMS October · october/backend
- CVE-2020-5373Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an improper authentDell OMIMSSC
- CVE-2019-12773An issue was discovered in Verint Impact 360 15.1.
- CVE-2019-12784An issue was discovered in Verint Impact 360 15.1.
- CVE-2019-12783An issue was discovered in Verint Impact 360 15.1.
- CVE-2020-11546SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php.
- CVE-2020-15100Uncontrolled Resource Consumption in freewvsschokokeksorg freewvs · freewvs
- CVE-2020-9297Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators.Netflix Titus
- CVE-2020-13846Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.github.com/sylabs/singularity
- CVE-2020-15074OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens OpenVPN Access Server
- CVE-2020-13845Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value.github.com/sylabs/singularity
- CVE-2020-13847Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check.
- CVE-2020-11827In GOG Galaxy 1.2.67, there is a service that is vulnerable to weak file/service permissions: GalaxyClientService.exe.
- CVE-2020-13935The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.Apache Tomcat · tomcat +3
- CVE-2020-13934An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 procesApache Tomcat · tomcat +2
- CVE-2020-15721RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.francoisjacquet/rosariosis
- CVE-2020-15719libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support
- CVE-2020-15720In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation.
- CVE-2020-10041A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18).Siemens AG SICAM MMU · Siemens AG SICAM SGU +1
- CVE-2020-10042A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18).Siemens AG SICAM MMU · Siemens AG SICAM SGU +1
- CVE-2020-10043A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18).Siemens AG SICAM MMU · Siemens AG SICAM SGU +1
- CVE-2020-10044A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18).Siemens AG SICAM MMU · Siemens AG SICAM SGU +1
- CVE-2020-10045A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18).Siemens AG SICAM MMU · Siemens AG SICAM SGU +1
- CVE-2020-7576A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2), Opcenter ESiemens Camstar Enterprise Platform · Siemens Opcenter Exec…
- CVE-2020-7577A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2).Siemens Camstar Enterprise Platform · Siemens Opcenter Exec…
- CVE-2020-7578A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2).Siemens Camstar Enterprise Platform · Siemens Opcenter Exec…
- CVE-2020-7581A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2Siemens Opcenter Execution Discrete · Siemens Opcenter E… +9
- CVE-2020-7584A vulnerability has been identified in SIMATIC S7-200 SMART CPU family (All versions >= V2.2 < V2.5.1).Siemens AG SIMATIC S7-200 SMART CPU family
- CVE-2020-7587A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2Siemens Opcenter Execution Discrete · Siemens Opcenter… +11
- CVE-2020-7588A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2Siemens Opcenter Execution Discrete · Siemens Opcenter… +11
- CVE-2020-7592A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl.Siemens AG SIMATIC HMI Basic Panels 1st Generation · Sie… +4
- CVE-2020-7593A vulnerability has been identified in LOGO! 8 BM (incl.Siemens AG LOGO! 8 BM
- CVE-2020-10037A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18).Siemens AG SICAM MMU · Siemens AG SICAM SGU +1
- CVE-2020-10038A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18).Siemens AG SICAM MMU · Siemens AG SICAM SGU +1
- CVE-2020-10039A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18).Siemens AG SICAM MMU · Siemens AG SICAM SGU +1
- CVE-2020-10040A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18).Siemens AG SICAM MMU · Siemens AG SICAM SGU +1
- CVE-2020-1948This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower.Apache Dubbo · org.apache.dubbo:dubbo +1
- CVE-2020-4513IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting.IBM QRadar SIEM
- CVE-2020-4511IBM QRadar SIEM 7.3 and 7.4 could allow an authenticated user to cause a denial of service of the qflow process by sending a malformed sflowIBM QRadar SIEM
- CVE-2020-4364IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting.IBM QRadar SIEM
- CVE-2020-13753The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl.
- CVE-2020-11956An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices.
- CVE-2020-11955An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices.
- CVE-2020-11953An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70_4 devices.
- CVE-2020-11952An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices.
- CVE-2020-11951An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices.
- CVE-2020-13926Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configuraApache Kylin · org.apache.kylin:kylin-server-base
- CVE-2020-13925Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the seApache Kylin · org.apache.kylin:kylin-server-base
- CVE-2020-12025Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, whRockwell Automation Logix Designer Studio 5000 Versions 32.…
- CVE-2020-6267Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only SAP SE SAP Disclosure Management
- CVE-2020-6276SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting SAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6278SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scriSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6280SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files whicSAP SE SAP NetWeaver (ABAP Server) and ABAP Platform
- CVE-2020-6281SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resultSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6282SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP servicSAP SE SAP NetWeaver AS JAVA (IIOP service)
- CVE-2020-6286The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions SAP SE SAP NetWeaver AS JAVA
- CVE-2020-6289SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user iSAP SE SAP Disclosure Management
- CVE-2020-6290SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specifiSAP SE SAP Disclosure Management
- CVE-2020-6291SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authentSAP SE SAP Disclosure Management
- CVE-2020-6292Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient SessionSAP SE SAP Disclosure Management
- CVE-2020-15711In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.
- CVE-2020-1349A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'MicrosofMicrosoft 365 Apps for Enterprise for 32-bit Systems · M… +2