CVEs published July 17, 2020
73 CVEs were published on July 17, 2020: 2 critical, 16 high.
- Published
- 73
- Critical
- 2
- High
- 16
- Medium
- 8
- Low
- 0
- Unrated
- 47
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- Juniper Networks Junos OS
- 14
- Android
- 11
- Grandstream UCM6200 Series
- 3
- Adobe ColdFusion
- 2
- Adobe Creative Cloud Desktop Application
- 2
- Huawei Honor
- 2
- HUAWEI P30 Pro
- 2
- Icegram Email Subscribers & Newsletters Plugin for WordPress
- 2
- stdlib
- 2
- "HCL Campaign"
- 1
Critical 2
- CVE-2020-1654Junos OS: SRX Series: processing a malformed HTTP message when ICAP redirect service is enabled may can lead to flowd process crash or remote code executionJuniper Networks Junos OS
- CVE-2020-1647Junos OS: SRX Series: Double free vulnerability can lead to DoS or remote code execution due to the processing of a specific HTTP message when ICAP redirect service is enabledJuniper Networks Junos OS
High 16
- CVE-2020-7818DaviewIndy Heap Overflow VulnerabilityHumanTolk Co.Ltd DaviewIndy
- CVE-2020-15108SQL Injection in glpiglpi-project glpi
- CVE-2020-1653Junos OS: Kernel crash (vmcore) or FPC crash due to mbuf leakJuniper Networks Junos OS
- CVE-2020-1650Junos OS: MX Series: Denial of Service vulnerability in MS-PIC component on MS-MIC or MS-MPCJuniper Networks Junos OS
- CVE-2020-1649Junos OS: MX Series: PFE crash on MPC7/8/9 upon receipt of small fragments requiring reassemblyJuniper Networks Junos OS
- CVE-2020-1648Junos OS and Junos OS Evolved: RPD crash when processing a specific BGP packetJuniper Networks Junos OS
- CVE-2020-1646Junos OS and Junos OS Evolved: RPD crash while processing a specific BGP update information.Juniper Networks Junos OS
- CVE-2020-1645Junos OS: MX Series: Services card might restart when DNS filtering is enabledJuniper Networks Junos OS
- CVE-2020-1644Junos OS and Junos OS Evolved: RPD crash due to specific BGP UPDATE packetsJuniper Networks Junos OS
- CVE-2020-1640Junos OS: Receipt of certain genuine BGP packets from any BGP Speaker causes RPD to crash.Juniper Networks Junos OS
- CVE-2020-7825A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier.TOBESOFT MiPlatform 320, 320U, 330,
- CVE-2020-7826EyeSurfer BflyInstallerX.ocx v1.0.0.16 and earlier versions contain a vulnerability that could allow remote files to be download by setting Bflysoft EyeSurfer BflyInstallerX.ocx
- CVE-2020-4464IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system withIBM WebSphere Application Server
- CVE-2020-7684Directory Traversalrollup-plugin-serve
- CVE-2020-9673Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vuAdobe ColdFusion
- CVE-2020-9672Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vuAdobe ColdFusion
Medium, low and unrated 55
- CVE-2020-9256Huawei Mate 30 Pro smartphones with versions earlier than 10.1.0.150(C00E136R5P3) have an improper authorization vulnerability.Huawei Mate 30 Pro
- CVE-2020-9101There is an out-of-bounds write vulnerability in some products.Huawei IPS Module · Huawei NGFW Module +4
- CVE-2020-9102There is a information leak vulnerability in some Huawei products, and it could allow a local attacker to get information.Huawei CloudEngine
- CVE-2020-9255Huawei Honor 10 smartphones with versions earlier than 10.0.0.178(C00E178R1P4) have a denial of service vulnerability.Huawei Honor
- CVE-2020-9259Huawei Honor V30 smartphones with versions earlier than 10.1.0.212(C00E210R5P1) have an improper authentication vulnerability.Huawei Honor
- CVE-2020-9252HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8), HUAWEI Mate 20 X versions earlier than 10.1.0.135(C00E135R2P8), HUAWEI Mate 20HUAWEI Mate · Honor Magic2
- CVE-2020-9257HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and versHUAWEI P30 Pro
- CVE-2020-9254HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and versHUAWEI P30 Pro
- CVE-2020-9227Huawei Smart Phones Moana-AL00B with versions earlier than 10.1.0.166 have a missing initialization of resource vulnerability.Huawei Moana-AL00B
- CVE-2020-10605Grundfos CIM 500 before v06.16.00 responds to unauthenticated requests for password storage files.Grundfos CIM
- CVE-2020-5769Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.02 allows a remote, authenticated attacker to conduct persistent cross-sTeltonika Gateway TRB245
- CVE-2020-5767Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emIcegram Email Subscribers & Newsletters Plugin for WordPress
- CVE-2020-5768Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WIcegram Email Subscribers & Newsletters Plugin for WordPress
- CVE-2020-7206HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.nagios-plugins-ilo
- CVE-2019-12000HPE has found a potential Remote Access Restriction Bypass in HPE MSE Msg Gw application E-LTU prior to version 3.2 when HTTPS is used betweHPE MSE Msg Gw application E-LTU
- CVE-2020-4104HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module.HCL BigFix WebUI
- CVE-2020-15110Possible pod name collisions in jupyterhub-kubespawnerjupyterhub kubespawner · jupyterhub-kubespawner
- CVE-2020-5759Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH.Grandstream UCM6200 Series
- CVE-2020-5758Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.Grandstream UCM6200 Series
- CVE-2020-5757Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.Grandstream UCM6200 Series
- CVE-2020-5756Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented APITenable Grandstream GWN7000
- CVE-2020-0230There is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2020-0231There is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2020-0228There is an improper configuration of recorder related service.Android
- CVE-2020-0226In createWithSurfaceParent of Client.cpp, there is a possible out of bounds write due to type confusion.Android
- CVE-2020-0224In FastKeyAccumulator::GetKeysSlow of keys.cc, there is a possible out of bounds write due to type confusion.Android
- CVE-2020-0122In the permission declaration for com.google.android.providers.gsf.permission.WRITE_GSERVICES in AndroidManifest.xml, there is a possible peAndroid
- CVE-2020-0107In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation.Android
- CVE-2020-0225In a2dp_vendor_ldac_decoder_decode_packet of a2dp_vendor_ldac_decoder.cc, there is a possible out of bounds write due to a missing bounds chAndroid
- CVE-2020-0227In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check.Android
- CVE-2020-0305In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition.Android
- CVE-2020-0120In notifyErrorForPendingRequests of QCamera3HWI.cpp, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2020-15816In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute c
- CVE-2019-4090"HCL Campaign is vulnerable to cross-site scripting when a user provides XSS scripts in Campaign Description field.""HCL Campaign"
- CVE-2019-4091"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, "HCL Marketing Platform"
- CVE-2020-1655Junos OS: MX Series: PFE crash on MPC7/8/9 upon receipt of large packets requiring fragmentationJuniper Networks Junos OS
- CVE-2020-1652Junos Space: OpenNMS is accessible via port 9443Juniper Networks Junos Space
- CVE-2020-1651Junos OS: MX Series: PFE on the line card may crash due to memory leak.Juniper Networks Junos OS
- CVE-2020-1643Junos OS: EX Series: RPD crash when executing specific "show ospf interface" commands from the CLI with OSPF authentication configuredJuniper Networks Junos OS
- CVE-2020-1641Junos OS: A race condition on receipt of crafted LLDP packets leads to a memory leak and an LLDP crash.Juniper Networks Junos OS
- CVE-2020-15813Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers.org.graylog:graylog-parent
- CVE-2020-15497jcore/portal/ajaxPortal.jsp in Jalios JCMS 10.0.2 build-20200224104759 allows XSS via the types parameter.
- CVE-2020-5131SonicWall NetExtender Windows client vulnerable to arbitrary file write vulnerability, this allows attacker to overwrite a DLL and execute cSonicWall NetExtender
- CVE-2020-5130SonicOS SSLVPN LDAP login request allows remote attackers to cause external service interaction (DNS) due to improper validation of the requSonicWall SonicOS
- CVE-2020-14039In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if Verifstdlib
- CVE-2020-15586Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, bstdlib
- CVE-2020-15807GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files.
- CVE-2020-14928evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3.
- CVE-2020-14001The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read accekramdown
- CVE-2020-7696Information Exposurereact-native-fast-image
- CVE-2020-15801In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations.libpython · python +1
- CVE-2020-9688Adobe Download Manager version 2.0.0.518 have a command injection vulnerability.Adobe Download Manager
- CVE-2020-9682Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability.Adobe Creative Cloud Desktop Application
- CVE-2020-9671Adobe Creative Cloud Desktop Application versions 5.1 and earlier have an insecure file permissions vulnerability.Adobe Creative Cloud Desktop Application
- CVE-2020-15803Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Wi