CVEs published July 23, 2020
40 CVEs were published on July 23, 2020: 2 critical, 5 high.
- Published
- 40
- Critical
- 2
- High
- 5
- Medium
- 4
- Low
- 0
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- C-MORE HMI EA9
- 5
- Easergy Builder
- 4
- Easergy Builder V1.4.7.2 and prior
- 2
- D-Link DAP-1860
- 1
- D-Link DIR-842
- 1
- D-Link Multiple Routers
- 1
- github.com/loft-sh/devspace
- 1
- IBM FileNet Content Manager
- 1
- Kubernetes
- 1
- Kubernetes · k8s.io/kubernetes/pkg/kubelet +1
- 1
Critical 2
- CVE-2020-10920This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touchC-MORE HMI EA9
- CVE-2020-10921This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen C-MORE HMI EA9
High 5
- CVE-2020-15632This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers.D-Link DIR-842
- CVE-2020-15633This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-D-Link Multiple Routers
- CVE-2020-15631This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 1.04B03_HOTFIX WD-Link DAP-1860
- CVE-2020-10922This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware versC-MORE HMI EA9
- CVE-2020-10918This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch C-MORE HMI EA9
Medium, low and unrated 33
- CVE-2020-7519A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to cEasergy Builder
- CVE-2020-7518A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to modEasergy Builder
- CVE-2020-7517A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow Easergy Builder
- CVE-2020-7516A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allowEasergy Builder V1.4.7.2 and prior
- CVE-2020-7515A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and prior which could alEasergy Builder V1.4.7.2 and prior
- CVE-2020-7514A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could Easergy Builder
- CVE-2020-7491**VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 through 10.5.3 is visTricon system versions 10.2.0 through
- CVE-2020-7520A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 andSchneider Electric Software Update (SESU) V2.4.0 and prior.
- CVE-2020-11625An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP
- CVE-2020-11624An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP
- CVE-2020-11623An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP
- CVE-2020-15492An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804.
- CVE-2020-15477The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI.
- CVE-2020-15391The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the Wegithub.com/loft-sh/devspace
- CVE-2019-18834Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript be
- CVE-2020-15917common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.
- CVE-2020-15916goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell
- CVE-2020-8557Kubernetes node disk Denial of Service by writing to container /etc/hostsKubernetes · k8s.io/kubernetes/pkg/kubelet +1
- CVE-2020-4447IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting.IBM FileNet Content Manager
- CVE-2020-12638An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTO
- CVE-2020-10919This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.C-MORE HMI EA9
- CVE-2019-11252Credential leakage when failing to mountKubernetes
- CVE-2020-15912Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay.
- CVE-2020-11440httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root.
- CVE-2020-15881A Cross-Site Scripting (XSS) vulnerability in the munki_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attackemunkireport/munki_facts
- CVE-2020-15882A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines from the MunkiReport d
- CVE-2020-15883A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrmunkireport/managedinstalls
- CVE-2020-15884A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order
- CVE-2020-15885A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web munkireport/comment
- CVE-2020-15886A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute amunkireport/reportdata
- CVE-2020-15887A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to munkireport/softwareupdate
- CVE-2020-15688The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks.
- CVE-2020-15908tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction from a TAR archive.