# CVEs published 2020-07-21 18 CVEs were published on July 21, 2020: 0 critical, 1 high. Days are UTC. - [CVE-2020-15888](https://cve.now/CVE-2020-15888.md): Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-bas (no CVSS) - [CVE-2020-15889](https://cve.now/CVE-2020-15889.md): Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list memb (no CVSS) - [CVE-2020-15890](https://cve.now/CVE-2020-15890.md): LuaJit through 2.1.0-beta3 has an out-of-bounds read because \_\_gc handler frame traversal is mishandled. (no CVSS) - [CVE-2020-15102](https://cve.now/CVE-2020-15102.md): Improper access control on dashboard form in PrestaShop (CVSS 6.5, PrestaShop dashproducts) - [CVE-2020-15724](https://cve.now/CVE-2020-15724.md): In the version 12.1.0.1005 and below of 360 Total Security, when the Gamefolde calls GameChrome.exe, there exists a local privilege escalati (no CVSS, 360 Total Security) - [CVE-2020-14063](https://cve.now/CVE-2020-14063.md): A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remot (no CVSS) - [CVE-2020-15722](https://cve.now/CVE-2020-15722.md): In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privilege escalation vulnera (no CVSS, 360 Total Security) - [CVE-2020-15723](https://cve.now/CVE-2020-15723.md): In the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total Security calls GameChrome.exe, there exists a (no CVSS, 360 Total Security) - [CVE-2020-15877](https://cve.now/CVE-2020-15877.md): An issue was discovered in LibreNMS before 1.65.1. (no CVSS, librenms/librenms) - [CVE-2020-15879](https://cve.now/CVE-2020-15879.md): Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: a (no CVSS) - [CVE-2016-7064](https://cve.now/CVE-2016-7064.md): A flaw was found in pritunl-client before version 1.0.1116.6. (no CVSS, pritunl-client-electron) - [CVE-2016-7063](https://cve.now/CVE-2016-7063.md): A flaw was found in pritunl-client before version 1.0.1116.6. (no CVSS, pritunl-client-electron) - [CVE-2020-15873](https://cve.now/CVE-2020-15873.md): In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device\_id POST parameter to ajax\_fo (no CVSS, librenms/librenms) - [CVE-2020-15859](https://cve.now/CVE-2020-15859.md): QEMU 4.2.0 has a use-after-free in hw/net/e1000e\_core.c because a guest OS user can trigger an e1000e packet with the data's address set to (no CVSS) - [CVE-2020-12499](https://cve.now/CVE-2020-12499.md): PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier: Improper path sanitation vulnerability. (CVSS 8.2, PHOENIX CONTACT PLCnext Engineer) - [CVE-2020-15866](https://cve.now/CVE-2020-15866.md): mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb\_yield\_with\_class function in vm.c because of incorrect VM stack handling. (no CVSS) - [CVE-2020-12432](https://cve.now/CVE-2020-12432.md): The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, a (no CVSS) - [CVE-2018-21036](https://cve.now/CVE-2018-21036.md): Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hoo (no CVSS, sails-hook-sockets) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-07-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.