# CVEs published 2020-07-20 36 CVEs were published on July 20, 2020: 2 critical, 6 high. Days are UTC. - [CVE-2020-4125](https://cve.now/CVE-2020-4125.md): Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some (no CVSS, "HCL Marketing Operations") - [CVE-2020-13932](https://cve.now/CVE-2020-13932.md): In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit (no CVSS, Apache ActiveMQ Artemis · org.apache.activemq:apache-artemis) - [CVE-2020-1776](https://cve.now/CVE-2020-1776.md): Invalidating or changing user does not invalidate session (CVSS 3.5, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS) - [CVE-2020-6103](https://cve.now/CVE-2020-6103.md): An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.1900 (no CVSS, AMD) - [CVE-2020-6102](https://cve.now/CVE-2020-6102.md): An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.1900 (no CVSS, AMD) - [CVE-2020-3442](https://cve.now/CVE-2020-3442.md): DuoConnect SSH Connection Vulnerability (CVSS 4.8, Cisco DUO Connect) - [CVE-2020-6101](https://cve.now/CVE-2020-6101.md): An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.1900 (no CVSS, AMD) - [CVE-2020-6100](https://cve.now/CVE-2020-6100.md): An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. (no CVSS, AMD) - [CVE-2020-15852](https://cve.now/CVE-2020-15852.md): An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. (no CVSS) - [CVE-2020-15121](https://cve.now/CVE-2020-15121.md): Command injection in Radare2 (CVSS 7.4, radareorg radare2) - [CVE-2020-15118](https://cve.now/CVE-2020-15118.md): Cross-Site Scripting in Wagtail (CVSS 5.7, wagtail) - [CVE-2020-3481](https://cve.now/CVE-2020-3481.md): Clam AntiVirus (ClamAV) Software Null Pointer Dereference Vulnerability (CVSS 7.5, Cisco ClamAV) - [CVE-2020-15111](https://cve.now/CVE-2020-15111.md): CRLF vulnerability in Fiber (CVSS 4.2, gofiber fiber · github.com/gofiber/fiber) - [CVE-2020-15123](https://cve.now/CVE-2020-15123.md): Command injection in codecov (npm package) (CVSS 9.3, codecov-node · codecov) - [CVE-2020-6872](https://cve.now/CVE-2020-6872.md): The server management software module of ZTE has a storage XSS vulnerability. (no CVSS, \) - [CVE-2020-6871](https://cve.now/CVE-2020-6871.md): The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the (no CVSS, \) - [CVE-2020-15053](https://cve.now/CVE-2020-15053.md): An issue was discovered in Artica Proxy CE before 4.28.030.418. (no CVSS) - [CVE-2020-15052](https://cve.now/CVE-2020-15052.md): An issue was discovered in Artica Proxy CE before 4.28.030.418. (no CVSS) - [CVE-2020-7680](https://cve.now/CVE-2020-7680.md): docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). (no CVSS, docsify) - [CVE-2020-12028](https://cve.now/CVE-2020-12028.md): Rockwell Automation FactoryTalk View SE (CVSS 7.3, Rockwell Automation FactoryTalk View SE) - [CVE-2020-12027](https://cve.now/CVE-2020-12027.md): Rockwell Automation FactoryTalk View SE (CVSS 4.3, Rockwell Automation FactoryTalk View SE) - [CVE-2020-12031](https://cve.now/CVE-2020-12031.md): Rockwell Automation FactoryTalk View SE (CVSS 7.5, Rockwell Automation FactoryTalk View SE) - [CVE-2020-8214](https://cve.now/CVE-2020-8214.md): A path traversal vulnerability in servey version \< 3 allows an attacker to read content of any arbitrary file. (no CVSS, servey) - [CVE-2020-8215](https://cve.now/CVE-2020-8215.md): A buffer overflow is present in canvas version \<= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it proc (no CVSS, node-canvas · canvas) - [CVE-2020-8205](https://cve.now/CVE-2020-8205.md): The uppy npm package \< 1.13.2 and \< 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attac (no CVSS, uppy · @uppy/companion) - [CVE-2020-12029](https://cve.now/CVE-2020-12029.md): Rockwell Automation FactoryTalk View SE (CVSS 9.0, Rockwell Automation FactoryTalk View SE) - [CVE-2020-14491](https://cve.now/CVE-2020-14491.md): OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege (no CVSS, OpenClinic GA) - [CVE-2020-14494](https://cve.now/CVE-2020-14494.md): OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexit (no CVSS, OpenClinic GA) - [CVE-2020-14484](https://cve.now/CVE-2020-14484.md): OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute f (no CVSS, OpenClinic GA) - [CVE-2020-14485](https://cve.now/CVE-2020-14485.md): OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate (no CVSS, OpenClinic GA) - [CVE-2020-4527](https://cve.now/CVE-2020-4527.md): IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag for t (CVSS 5.9, IBM Planning Analytics) - [CVE-2020-4466](https://cve.now/CVE-2020-4466.md): IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due to an error within th (CVSS 6.5, IBM MQ for HPE NonStop) - [CVE-2020-4361](https://cve.now/CVE-2020-4361.md): IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP response (CVSS 4.3, IBM Planning Analytics) - [CVE-2020-15009](https://cve.now/CVE-2020-15009.md): AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2\_Upgrade\_Tool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 ( (no CVSS) - [CVE-2020-15842](https://cve.now/CVE-2020-15842.md): Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-mi (CVSS 8.1, com.liferay.portal:release.portal.bom · com.liferay.portal:…) - [CVE-2020-15841](https://cve.now/CVE-2020-15841.md): Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test (CVSS 8.3, com.liferay.portal:release.portal.bom · com.liferay.portal:…) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-07-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.