# CVEs published 2020-07-17

73 CVEs were published on July 17, 2020: 2 critical, 16 high. Days are UTC.

- [CVE-2020-9256](https://cve.now/CVE-2020-9256.md): Huawei Mate 30 Pro smartphones with versions earlier than 10.1.0.150(C00E136R5P3) have an improper authorization vulnerability. (no CVSS, Huawei Mate 30 Pro)
- [CVE-2020-9101](https://cve.now/CVE-2020-9101.md): There is an out-of-bounds write vulnerability in some products. (no CVSS, Huawei IPS Module · Huawei NGFW Module +4)
- [CVE-2020-9102](https://cve.now/CVE-2020-9102.md): There is a information leak vulnerability in some Huawei products, and it could allow a local attacker to get information. (no CVSS, Huawei CloudEngine)
- [CVE-2020-9255](https://cve.now/CVE-2020-9255.md): Huawei Honor 10 smartphones with versions earlier than 10.0.0.178(C00E178R1P4) have a denial of service vulnerability. (no CVSS, Huawei Honor)
- [CVE-2020-9259](https://cve.now/CVE-2020-9259.md): Huawei Honor V30 smartphones with versions earlier than 10.1.0.212(C00E210R5P1) have an improper authentication vulnerability. (no CVSS, Huawei Honor)
- [CVE-2020-9252](https://cve.now/CVE-2020-9252.md): HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8), HUAWEI Mate 20 X versions earlier than 10.1.0.135(C00E135R2P8), HUAWEI Mate 20 (no CVSS, HUAWEI Mate · Honor Magic2)
- [CVE-2020-9257](https://cve.now/CVE-2020-9257.md): HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and vers (no CVSS, HUAWEI P30 Pro)
- [CVE-2020-9254](https://cve.now/CVE-2020-9254.md): HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and vers (no CVSS, HUAWEI P30 Pro)
- [CVE-2020-9227](https://cve.now/CVE-2020-9227.md): Huawei Smart Phones Moana-AL00B with versions earlier than 10.1.0.166 have a missing initialization of resource vulnerability. (no CVSS, Huawei Moana-AL00B)
- [CVE-2020-10605](https://cve.now/CVE-2020-10605.md): Grundfos CIM 500 before v06.16.00 responds to unauthenticated requests for password storage files. (no CVSS, Grundfos CIM)
- [CVE-2020-5769](https://cve.now/CVE-2020-5769.md): Insufficient output sanitization in Teltonika firmware TRB2\_R\_00.02.02 allows a remote, authenticated attacker to conduct persistent cross-s (no CVSS, Teltonika Gateway TRB245)
- [CVE-2020-5767](https://cve.now/CVE-2020-5767.md): Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged em (no CVSS, Icegram Email Subscribers & Newsletters Plugin for WordPress)
- [CVE-2020-5768](https://cve.now/CVE-2020-5768.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for W (no CVSS, Icegram Email Subscribers & Newsletters Plugin for WordPress)
- [CVE-2020-7206](https://cve.now/CVE-2020-7206.md): HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability. (no CVSS, nagios-plugins-ilo)
- [CVE-2019-12000](https://cve.now/CVE-2019-12000.md): HPE has found a potential Remote Access Restriction Bypass in HPE MSE Msg Gw application E-LTU prior to version 3.2 when HTTPS is used betwe (no CVSS, HPE MSE Msg Gw application E-LTU)
- [CVE-2020-7818](https://cve.now/CVE-2020-7818.md): DaviewIndy Heap Overflow Vulnerability (CVSS 7.8, HumanTolk Co.Ltd DaviewIndy)
- [CVE-2020-4104](https://cve.now/CVE-2020-4104.md): HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps-\>Software module. (no CVSS, HCL BigFix WebUI)
- [CVE-2020-15110](https://cve.now/CVE-2020-15110.md): Possible pod name collisions in jupyterhub-kubespawner (CVSS 6.8, jupyterhub kubespawner · jupyterhub-kubespawner)
- [CVE-2020-5759](https://cve.now/CVE-2020-5759.md): Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. (no CVSS, Grandstream UCM6200 Series)
- [CVE-2020-5758](https://cve.now/CVE-2020-5758.md): Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. (no CVSS, Grandstream UCM6200 Series)
- [CVE-2020-5757](https://cve.now/CVE-2020-5757.md): Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. (no CVSS, Grandstream UCM6200 Series)
- [CVE-2020-15108](https://cve.now/CVE-2020-15108.md): SQL Injection in glpi (CVSS 7.1, glpi-project glpi)
- [CVE-2020-5756](https://cve.now/CVE-2020-5756.md): Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API (no CVSS, Tenable Grandstream GWN7000)
- [CVE-2020-0230](https://cve.now/CVE-2020-0230.md): There is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2020-0231](https://cve.now/CVE-2020-0231.md): There is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2020-0228](https://cve.now/CVE-2020-0228.md): There is an improper configuration of recorder related service. (no CVSS, Android)
- [CVE-2020-0226](https://cve.now/CVE-2020-0226.md): In createWithSurfaceParent of Client.cpp, there is a possible out of bounds write due to type confusion. (no CVSS, Android)
- [CVE-2020-0224](https://cve.now/CVE-2020-0224.md): In FastKeyAccumulator::GetKeysSlow of keys.cc, there is a possible out of bounds write due to type confusion. (no CVSS, Android)
- [CVE-2020-0122](https://cve.now/CVE-2020-0122.md): In the permission declaration for com.google.android.providers.gsf.permission.WRITE\_GSERVICES in AndroidManifest.xml, there is a possible pe (no CVSS, Android)
- [CVE-2020-0107](https://cve.now/CVE-2020-0107.md): In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. (no CVSS, Android)
- [CVE-2020-0225](https://cve.now/CVE-2020-0225.md): In a2dp\_vendor\_ldac\_decoder\_decode\_packet of a2dp\_vendor\_ldac\_decoder.cc, there is a possible out of bounds write due to a missing bounds ch (no CVSS, Android)
- [CVE-2020-0227](https://cve.now/CVE-2020-0227.md): In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0305](https://cve.now/CVE-2020-0305.md): In cdev\_get of char\_dev.c, there is a possible use-after-free due to a race condition. (no CVSS, Android)
- [CVE-2020-0120](https://cve.now/CVE-2020-0120.md): In notifyErrorForPendingRequests of QCamera3HWI.cpp, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2020-15816](https://cve.now/CVE-2020-15816.md): In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute c (no CVSS)
- [CVE-2019-4090](https://cve.now/CVE-2019-4090.md): "HCL Campaign is vulnerable to cross-site scripting when a user provides XSS scripts in Campaign Description field." (no CVSS, "HCL Campaign")
- [CVE-2019-4091](https://cve.now/CVE-2019-4091.md): "HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, (no CVSS, "HCL Marketing Platform")
- [CVE-2020-1655](https://cve.now/CVE-2020-1655.md): Junos OS: MX Series: PFE crash on MPC7/8/9 upon receipt of large packets requiring fragmentation (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2020-1654](https://cve.now/CVE-2020-1654.md): Junos OS: SRX Series: processing a malformed HTTP message when ICAP redirect service is enabled may can lead to flowd process crash or remote code execution (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2020-1653](https://cve.now/CVE-2020-1653.md): Junos OS: Kernel crash (vmcore) or FPC crash due to mbuf leak (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2020-1652](https://cve.now/CVE-2020-1652.md): Junos Space: OpenNMS is accessible via port 9443 (CVSS 5.6, Juniper Networks Junos Space)
- [CVE-2020-1651](https://cve.now/CVE-2020-1651.md): Junos OS: MX Series: PFE on the line card may crash due to memory leak. (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2020-1650](https://cve.now/CVE-2020-1650.md): Junos OS: MX Series: Denial of Service vulnerability in MS-PIC component on MS-MIC or MS-MPC (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2020-1649](https://cve.now/CVE-2020-1649.md): Junos OS: MX Series: PFE crash on MPC7/8/9 upon receipt of small fragments requiring reassembly (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2020-1648](https://cve.now/CVE-2020-1648.md): Junos OS and Junos OS Evolved: RPD crash when processing a specific BGP packet (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2020-1647](https://cve.now/CVE-2020-1647.md): Junos OS: SRX Series: Double free vulnerability can lead to DoS or remote code execution due to the processing of a specific HTTP message when ICAP redirect service is enabled (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2020-1646](https://cve.now/CVE-2020-1646.md): Junos OS and Junos OS Evolved: RPD crash while processing a specific BGP update information. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2020-1645](https://cve.now/CVE-2020-1645.md): Junos OS: MX Series: Services card might restart when DNS filtering is enabled (CVSS 8.3, Juniper Networks Junos OS)
- [CVE-2020-1644](https://cve.now/CVE-2020-1644.md): Junos OS and Junos OS Evolved: RPD crash due to specific BGP UPDATE packets (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2020-1643](https://cve.now/CVE-2020-1643.md): Junos OS: EX Series: RPD crash when executing specific "show ospf interface" commands from the CLI with OSPF authentication configured (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2020-1641](https://cve.now/CVE-2020-1641.md): Junos OS: A race condition on receipt of crafted LLDP packets leads to a memory leak and an LLDP crash. (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2020-1640](https://cve.now/CVE-2020-1640.md): Junos OS: Receipt of certain genuine BGP packets from any BGP Speaker causes RPD to crash. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2020-15813](https://cve.now/CVE-2020-15813.md): Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. (no CVSS, org.graylog:graylog-parent)
- [CVE-2020-15497](https://cve.now/CVE-2020-15497.md): jcore/portal/ajaxPortal.jsp in Jalios JCMS 10.0.2 build-20200224104759 allows XSS via the types parameter. (CVSS 5.3)
- [CVE-2020-5131](https://cve.now/CVE-2020-5131.md): SonicWall NetExtender Windows client vulnerable to arbitrary file write vulnerability, this allows attacker to overwrite a DLL and execute c (no CVSS, SonicWall NetExtender)
- [CVE-2020-5130](https://cve.now/CVE-2020-5130.md): SonicOS SSLVPN LDAP login request allows remote attackers to cause external service interaction (DNS) due to improper validation of the requ (no CVSS, SonicWall SonicOS)
- [CVE-2020-14039](https://cve.now/CVE-2020-14039.md): In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if Verif (no CVSS, stdlib)
- [CVE-2020-15586](https://cve.now/CVE-2020-15586.md): Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, b (no CVSS, stdlib)
- [CVE-2020-15807](https://cve.now/CVE-2020-15807.md): GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files. (no CVSS)
- [CVE-2020-14928](https://cve.now/CVE-2020-14928.md): evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. (no CVSS)
- [CVE-2020-14001](https://cve.now/CVE-2020-14001.md): The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read acce (no CVSS, kramdown)
- [CVE-2020-7825](https://cve.now/CVE-2020-7825.md): A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier. (CVSS 8.8, TOBESOFT MiPlatform 320, 320U, 330,)
- [CVE-2020-7826](https://cve.now/CVE-2020-7826.md): EyeSurfer BflyInstallerX.ocx v1.0.0.16 and earlier versions contain a vulnerability that could allow remote files to be download by setting (CVSS 8.8, Bflysoft EyeSurfer BflyInstallerX.ocx)
- [CVE-2020-4464](https://cve.now/CVE-2020-4464.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with (CVSS 8.8, IBM WebSphere Application Server)
- [CVE-2020-7696](https://cve.now/CVE-2020-7696.md): Information Exposure (CVSS 5.3, react-native-fast-image)
- [CVE-2020-7684](https://cve.now/CVE-2020-7684.md): Directory Traversal (CVSS 7.5, rollup-plugin-serve)
- [CVE-2020-15801](https://cve.now/CVE-2020-15801.md): In Python 3.8.4, sys.path restrictions specified in a python38.\_pth file are ignored, allowing code to be loaded from arbitrary locations. (no CVSS, libpython · python +1)
- [CVE-2020-9688](https://cve.now/CVE-2020-9688.md): Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. (no CVSS, Adobe Download Manager)
- [CVE-2020-9682](https://cve.now/CVE-2020-9682.md): Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. (no CVSS, Adobe Creative Cloud Desktop Application)
- [CVE-2020-9673](https://cve.now/CVE-2020-9673.md): Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vu (CVSS 7.8, Adobe ColdFusion)
- [CVE-2020-9672](https://cve.now/CVE-2020-9672.md): Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vu (CVSS 7.8, Adobe ColdFusion)
- [CVE-2020-9671](https://cve.now/CVE-2020-9671.md): Adobe Creative Cloud Desktop Application versions 5.1 and earlier have an insecure file permissions vulnerability. (no CVSS, Adobe Creative Cloud Desktop Application)
- [CVE-2020-15803](https://cve.now/CVE-2020-15803.md): Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Wi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-07-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.