CVEs published July 21, 2020
18 CVEs were published on July 21, 2020: 0 critical, 1 high.
- Published
- 18
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 16
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- 360 Total Security
- 3
- librenms/librenms
- 2
- pritunl-client-electron
- 2
- PHOENIX CONTACT PLCnext Engineer
- 1
- PrestaShop dashproducts
- 1
- sails-hook-sockets
- 1
High 1
Medium, low and unrated 17
- CVE-2020-15888Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-bas
- CVE-2020-15889Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list memb
- CVE-2020-15890LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is mishandled.
- CVE-2020-15102Improper access control on dashboard form in PrestaShopPrestaShop dashproducts
- CVE-2020-15724In the version 12.1.0.1005 and below of 360 Total Security, when the Gamefolde calls GameChrome.exe, there exists a local privilege escalati360 Total Security
- CVE-2020-14063A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remot
- CVE-2020-15722In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privilege escalation vulnera360 Total Security
- CVE-2020-15723In the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total Security calls GameChrome.exe, there exists a360 Total Security
- CVE-2020-15877An issue was discovered in LibreNMS before 1.65.1.librenms/librenms
- CVE-2020-15879Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: a
- CVE-2016-7064A flaw was found in pritunl-client before version 1.0.1116.6.pritunl-client-electron
- CVE-2016-7063A flaw was found in pritunl-client before version 1.0.1116.6.pritunl-client-electron
- CVE-2020-15873In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_folibrenms/librenms
- CVE-2020-15859QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to
- CVE-2020-15866mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb_yield_with_class function in vm.c because of incorrect VM stack handling.
- CVE-2020-12432The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, a
- CVE-2018-21036Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hoosails-hook-sockets