CVEs published July 20, 2020
36 CVEs were published on July 20, 2020: 2 critical, 6 high.
- Published
- 36
- Critical
- 2
- High
- 6
- Medium
- 7
- Low
- 1
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- AMD
- 4
- OpenClinic GA
- 4
- Rockwell Automation FactoryTalk View SE
- 4
- <R5300G4?R8500G4?R5500G4>
- 2
- com.liferay.portal:release.portal.bom · com.liferay.portal:…
- 2
- IBM Planning Analytics
- 2
- "HCL Marketing Operations"
- 1
- Apache ActiveMQ Artemis · org.apache.activemq:apache-artemis
- 1
- Cisco ClamAV
- 1
- Cisco DUO Connect
- 1
Critical 2
High 6
- CVE-2020-15121Command injection in Radare2radareorg radare2
- CVE-2020-3481Clam AntiVirus (ClamAV) Software Null Pointer Dereference VulnerabilityCisco ClamAV
- CVE-2020-12028Rockwell Automation FactoryTalk View SERockwell Automation FactoryTalk View SE
- CVE-2020-12031Rockwell Automation FactoryTalk View SERockwell Automation FactoryTalk View SE
- CVE-2020-15842Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-micom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2020-15841Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely testcom.liferay.portal:release.portal.bom · com.liferay.portal:…
Medium, low and unrated 28
- CVE-2020-4125Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some "HCL Marketing Operations"
- CVE-2020-13932In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit Apache ActiveMQ Artemis · org.apache.activemq:apache-artemis
- CVE-2020-1776Invalidating or changing user does not invalidate sessionOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2020-6103An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.1900AMD
- CVE-2020-6102An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.1900AMD
- CVE-2020-3442DuoConnect SSH Connection VulnerabilityCisco DUO Connect
- CVE-2020-6101An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.1900AMD
- CVE-2020-6100An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver.AMD
- CVE-2020-15852An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests.
- CVE-2020-15118Cross-Site Scripting in Wagtailwagtail
- CVE-2020-15111CRLF vulnerability in Fibergofiber fiber · github.com/gofiber/fiber
- CVE-2020-6872The server management software module of ZTE has a storage XSS vulnerability.<R5300G4?R8500G4?R5500G4>
- CVE-2020-6871The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the<R5300G4?R8500G4?R5500G4>
- CVE-2020-15053An issue was discovered in Artica Proxy CE before 4.28.030.418.
- CVE-2020-15052An issue was discovered in Artica Proxy CE before 4.28.030.418.
- CVE-2020-7680docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS).docsify
- CVE-2020-12027Rockwell Automation FactoryTalk View SERockwell Automation FactoryTalk View SE
- CVE-2020-8214A path traversal vulnerability in servey version < 3 allows an attacker to read content of any arbitrary file.servey
- CVE-2020-8215A buffer overflow is present in canvas version <= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it procnode-canvas · canvas
- CVE-2020-8205The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacuppy · @uppy/companion
- CVE-2020-14491OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege OpenClinic GA
- CVE-2020-14494OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexitOpenClinic GA
- CVE-2020-14484OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute fOpenClinic GA
- CVE-2020-14485OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiateOpenClinic GA
- CVE-2020-4527IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag for tIBM Planning Analytics
- CVE-2020-4466IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due to an error within thIBM MQ for HPE NonStop
- CVE-2020-4361IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responseIBM Planning Analytics
- CVE-2020-15009AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2_Upgrade_Tool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 (