# CVEs published 2020-07-22

71 CVEs were published on July 22, 2020: 2 critical, 6 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-15126](https://cve.now/CVE-2020-15126.md): Information disclosure through Viewer query in parse-server (CVSS 6.5, parse-community parse-server · parse-server)
- [CVE-2020-10917](https://cve.now/CVE-2020-10917.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NEC ESMPRO Manager 6.42. (CVSS 9.8, NEC ESMPRO Manager)
- [CVE-2020-15904](https://cve.now/CVE-2020-15904.md): A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a (no CVSS, bsdiff4)
- [CVE-2020-15901](https://cve.now/CVE-2020-15901.md): In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys. (no CVSS)
- [CVE-2020-15902](https://cve.now/CVE-2020-15902.md): Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option. (no CVSS)
- [CVE-2020-4400](https://cve.now/CVE-2020-4400.md): IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force accoun (CVSS 7.5, IBM Verify Gateway)
- [CVE-2020-4399](https://cve.now/CVE-2020-4399.md): IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could allow an authenticated user to send malformed requests to cause a denial of service against t (CVSS 6.5, IBM Verify Gateway)
- [CVE-2020-4397](https://cve.now/CVE-2020-4397.md): IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an attacker using man in t (CVSS 6.8, IBM Verify Gateway)
- [CVE-2020-4385](https://cve.now/CVE-2020-4385.md): IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own (CVSS 6.8, IBM Verify Gateway)
- [CVE-2020-4372](https://cve.now/CVE-2020-4372.md): IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. (CVSS 6.2, IBM Verify Gateway)
- [CVE-2020-4371](https://cve.now/CVE-2020-4371.md): IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in furthe (CVSS 4.0, IBM Verify Gateway)
- [CVE-2020-4369](https://cve.now/CVE-2020-4369.md): IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user. (CVSS 5.1, IBM Verify Gateway)
- [CVE-2020-3452](https://cve.now/CVE-2020-3452.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability (CVSS 7.5, KEV, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-9664](https://cve.now/CVE-2020-9664.md): Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. (no CVSS, Adobe Magento · magento/core)
- [CVE-2020-9665](https://cve.now/CVE-2020-9665.md): Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. (no CVSS, Adobe Magento · magento/core)
- [CVE-2020-9663](https://cve.now/CVE-2020-9663.md): Adobe Reader Mobile versions 20.0.1 and earlier have a directory traversal vulnerability. (no CVSS, Adobe Reader Mobile)
- [CVE-2020-9680](https://cve.now/CVE-2020-9680.md): Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. (no CVSS, Adobe Prelude)
- [CVE-2020-9678](https://cve.now/CVE-2020-9678.md): Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. (no CVSS, Adobe Prelude)
- [CVE-2020-9677](https://cve.now/CVE-2020-9677.md): Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability. (no CVSS, Adobe Prelude)
- [CVE-2020-9679](https://cve.now/CVE-2020-9679.md): Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability. (no CVSS, Adobe Prelude)
- [CVE-2020-9683](https://cve.now/CVE-2020-9683.md): Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. (no CVSS, Adobe Photoshop)
- [CVE-2020-9685](https://cve.now/CVE-2020-9685.md): Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. (no CVSS, Adobe Photoshop)
- [CVE-2020-9687](https://cve.now/CVE-2020-9687.md): Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. (no CVSS, Adobe Photoshop)
- [CVE-2020-9686](https://cve.now/CVE-2020-9686.md): Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. (no CVSS, Adobe Photoshop)
- [CVE-2020-9684](https://cve.now/CVE-2020-9684.md): Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. (no CVSS, Adobe Photoshop)
- [CVE-2020-9675](https://cve.now/CVE-2020-9675.md): Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds read vulnerability. (CVSS 7.8, Adobe Bridge)
- [CVE-2020-9674](https://cve.now/CVE-2020-9674.md): Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. (CVSS 7.8, Adobe Bridge)
- [CVE-2020-9676](https://cve.now/CVE-2020-9676.md): Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. (CVSS 7.8, Adobe Bridge)
- [CVE-2020-15892](https://cve.now/CVE-2020-15892.md): An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. (no CVSS)
- [CVE-2020-15893](https://cve.now/CVE-2020-15893.md): An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. (no CVSS)
- [CVE-2020-15894](https://cve.now/CVE-2020-15894.md): An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. (no CVSS)
- [CVE-2020-15895](https://cve.now/CVE-2020-15895.md): An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. (no CVSS)
- [CVE-2020-15896](https://cve.now/CVE-2020-15896.md): An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. (no CVSS)
- [CVE-2020-15806](https://cve.now/CVE-2020-15806.md): CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation. (no CVSS)
- [CVE-2014-1422](https://cve.now/CVE-2014-1422.md): Location service uses cached authorization even after revocation (CVSS 5.0, Canonical trust-store)
- [CVE-2020-15124](https://cve.now/CVE-2020-15124.md): Path traversal in Goobi viewer Core (CVSS 9.6, intranda goobi-viewer-core)
- [CVE-2020-6535](https://cve.now/CVE-2020-6535.md): Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer proc (no CVSS, Google Chrome)
- [CVE-2020-6536](https://cve.now/CVE-2020-6536.md): Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA t (no CVSS, Google Chrome)
- [CVE-2020-6531](https://cve.now/CVE-2020-6531.md): Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin dat (no CVSS, Google Chrome)
- [CVE-2020-6533](https://cve.now/CVE-2020-6533.md): Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2020-6534](https://cve.now/CVE-2020-6534.md): Heap buffer overflow in WebRTC in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2020-6529](https://cve.now/CVE-2020-6529.md): Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak c (no CVSS, Google Chrome)
- [CVE-2020-6530](https://cve.now/CVE-2020-6530.md): Out of bounds memory access in developer tools in Google Chrome prior to 84.0.4147.89 allowed an attacker who convinced a user to install a (no CVSS, Google Chrome)
- [CVE-2020-6527](https://cve.now/CVE-2020-6527.md): Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy vi (no CVSS, Google Chrome)
- [CVE-2020-6528](https://cve.now/CVE-2020-6528.md): Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote attacker to spoof the contents of the Omn (no CVSS, Google Chrome)
- [CVE-2020-6525](https://cve.now/CVE-2020-6525.md): Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2020-6526](https://cve.now/CVE-2020-6526.md): Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass navigation restric (no CVSS, Google Chrome)
- [CVE-2020-6523](https://cve.now/CVE-2020-6523.md): Out of bounds write in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2020-6524](https://cve.now/CVE-2020-6524.md): Heap buffer overflow in WebAudio in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2020-6521](https://cve.now/CVE-2020-6521.md): Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitiv (no CVSS, Google Chrome)
- [CVE-2020-6522](https://cve.now/CVE-2020-6522.md): Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially p (no CVSS, Google Chrome)
- [CVE-2020-6519](https://cve.now/CVE-2020-6519.md): Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML p (no CVSS, Google Chrome)
- [CVE-2020-6520](https://cve.now/CVE-2020-6520.md): Buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2020-6517](https://cve.now/CVE-2020-6517.md): Heap buffer overflow in history in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2020-6518](https://cve.now/CVE-2020-6518.md): Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had convinced the user to use develop (no CVSS, Google Chrome)
- [CVE-2020-6515](https://cve.now/CVE-2020-6515.md): Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2020-6516](https://cve.now/CVE-2020-6516.md): Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (no CVSS, Google Chrome)
- [CVE-2020-6513](https://cve.now/CVE-2020-6513.md): Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2020-6514](https://cve.now/CVE-2020-6514.md): Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potent (no CVSS, Google Chrome)
- [CVE-2020-6511](https://cve.now/CVE-2020-6511.md): Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a (no CVSS, Google Chrome)
- [CVE-2020-6512](https://cve.now/CVE-2020-6512.md): Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2020-6509](https://cve.now/CVE-2020-6509.md): Use after free in extensions in Google Chrome prior to 83.0.4103.116 allowed an attacker who convinced a user to install a malicious extensi (no CVSS, Google Chrome)
- [CVE-2020-6510](https://cve.now/CVE-2020-6510.md): Heap buffer overflow in background fetch in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corrup (no CVSS, Google Chrome)
- [CVE-2020-6506](https://cve.now/CVE-2020-6506.md): Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isola (no CVSS, Google Chrome · react-native-webview)
- [CVE-2020-6507](https://cve.now/CVE-2020-6507.md): Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2020-6505](https://cve.now/CVE-2020-6505.md): Use after free in speech in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially perform a sandbox escape via a cra (no CVSS, Google Chrome)
- [CVE-2019-16244](https://cve.now/CVE-2019-16244.md): OMERO.server before 5.6.1 allows attackers to bypass the security filters and access hidden objects via a crafted query. (no CVSS)
- [CVE-2020-8559](https://cve.now/CVE-2020-8559.md): Privilege escalation from compromised node to cluster (CVSS 6.4, Kubernetes · k8s.io/apimachinery +1)
- [CVE-2019-18618](https://cve.now/CVE-2019-18618.md): Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to (no CVSS)
- [CVE-2019-18619](https://cve.now/CVE-2019-18619.md): Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) all (no CVSS)
- [CVE-2020-12774](https://cve.now/CVE-2020-12774.md): D-Link DSL-7740C - Command Injection (CVSS 8.2, D-Link DSL-7740C)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-07-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.