CVEs published July 22, 2020
71 CVEs were published on July 22, 2020: 2 critical, 6 high. 1 is now in CISA KEV.
- Published
- 71
- Critical
- 2
- High
- 6
- Medium
- 9
- Low
- 0
- Unrated
- 54
- Now in CISA KEV
- 1
- Fix available
- 36
Most affected products
- Google Chrome
- 29
- IBM Verify Gateway
- 7
- Adobe Photoshop
- 5
- Adobe Prelude
- 4
- Adobe Bridge
- 3
- Adobe Magento · magento/core
- 2
- Adobe Reader Mobile
- 1
- bsdiff4
- 1
- Canonical trust-store
- 1
- Cisco Adaptive Security Appliance (ASA) Software
- 1
Critical 2
High 6
- CVE-2020-4400IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force accounIBM Verify Gateway
- CVE-2020-3452Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2020-9675Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds read vulnerability.Adobe Bridge
- CVE-2020-9674Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability.Adobe Bridge
- CVE-2020-9676Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability.Adobe Bridge
- CVE-2020-12774D-Link DSL-7740C - Command InjectionD-Link DSL-7740C
Medium, low and unrated 63
- CVE-2020-15126Information disclosure through Viewer query in parse-serverparse-community parse-server · parse-server
- CVE-2020-15904A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via absdiff4
- CVE-2020-15901In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.
- CVE-2020-15902Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.
- CVE-2020-4399IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could allow an authenticated user to send malformed requests to cause a denial of service against tIBM Verify Gateway
- CVE-2020-4397IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an attacker using man in tIBM Verify Gateway
- CVE-2020-4385IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ownIBM Verify Gateway
- CVE-2020-4372IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user.IBM Verify Gateway
- CVE-2020-4371IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in furtheIBM Verify Gateway
- CVE-2020-4369IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user.IBM Verify Gateway
- CVE-2020-9664Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability.Adobe Magento · magento/core
- CVE-2020-9665Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability.Adobe Magento · magento/core
- CVE-2020-9663Adobe Reader Mobile versions 20.0.1 and earlier have a directory traversal vulnerability.Adobe Reader Mobile
- CVE-2020-9680Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability.Adobe Prelude
- CVE-2020-9678Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability.Adobe Prelude
- CVE-2020-9677Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability.Adobe Prelude
- CVE-2020-9679Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability.Adobe Prelude
- CVE-2020-9683Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability.Adobe Photoshop
- CVE-2020-9685Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability.Adobe Photoshop
- CVE-2020-9687Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability.Adobe Photoshop
- CVE-2020-9686Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability.Adobe Photoshop
- CVE-2020-9684Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability.Adobe Photoshop
- CVE-2020-15892An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02.
- CVE-2020-15893An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02.
- CVE-2020-15894An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02.
- CVE-2020-15895An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02.
- CVE-2020-15896An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02.
- CVE-2020-15806CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.
- CVE-2014-1422Location service uses cached authorization even after revocationCanonical trust-store
- CVE-2020-6535Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2020-6536Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA tGoogle Chrome
- CVE-2020-6531Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin datGoogle Chrome
- CVE-2020-6533Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2020-6534Heap buffer overflow in WebRTC in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2020-6529Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak cGoogle Chrome
- CVE-2020-6530Out of bounds memory access in developer tools in Google Chrome prior to 84.0.4147.89 allowed an attacker who convinced a user to install a Google Chrome
- CVE-2020-6527Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy viGoogle Chrome
- CVE-2020-6528Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote attacker to spoof the contents of the OmnGoogle Chrome
- CVE-2020-6525Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2020-6526Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass navigation restricGoogle Chrome
- CVE-2020-6523Out of bounds write in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2020-6524Heap buffer overflow in WebAudio in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2020-6521Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitivGoogle Chrome
- CVE-2020-6522Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially pGoogle Chrome
- CVE-2020-6519Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML pGoogle Chrome
- CVE-2020-6520Buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2020-6517Heap buffer overflow in history in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2020-6518Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had convinced the user to use developGoogle Chrome
- CVE-2020-6515Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2020-6516Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.Google Chrome
- CVE-2020-6513Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2020-6514Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentGoogle Chrome
- CVE-2020-6511Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via aGoogle Chrome
- CVE-2020-6512Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2020-6509Use after free in extensions in Google Chrome prior to 83.0.4103.116 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2020-6510Heap buffer overflow in background fetch in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corrupGoogle Chrome
- CVE-2020-6506Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isolaGoogle Chrome · react-native-webview
- CVE-2020-6507Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2020-6505Use after free in speech in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially perform a sandbox escape via a craGoogle Chrome
- CVE-2019-16244OMERO.server before 5.6.1 allows attackers to bypass the security filters and access hidden objects via a crafted query.
- CVE-2020-8559Privilege escalation from compromised node to clusterKubernetes · k8s.io/apimachinery +1
- CVE-2019-18618Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to
- CVE-2019-18619Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) all