# CVEs published 2020-07-23

40 CVEs were published on July 23, 2020: 2 critical, 5 high. Days are UTC.

- [CVE-2020-7519](https://cve.now/CVE-2020-7519.md): A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to c (no CVSS, Easergy Builder)
- [CVE-2020-7518](https://cve.now/CVE-2020-7518.md): A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to mod (no CVSS, Easergy Builder)
- [CVE-2020-7517](https://cve.now/CVE-2020-7517.md): A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow (no CVSS, Easergy Builder)
- [CVE-2020-7516](https://cve.now/CVE-2020-7516.md): A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow (no CVSS, Easergy Builder V1.4.7.2 and prior)
- [CVE-2020-7515](https://cve.now/CVE-2020-7515.md): A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and prior which could al (no CVSS, Easergy Builder V1.4.7.2 and prior)
- [CVE-2020-7514](https://cve.now/CVE-2020-7514.md): A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could (no CVSS, Easergy Builder)
- [CVE-2020-7491](https://cve.now/CVE-2020-7491.md): \*\*VERSION NOT SUPPORTED WHEN ASSIGNED\*\* A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 through 10.5.3 is vis (no CVSS, Tricon system versions 10.2.0 through)
- [CVE-2020-7520](https://cve.now/CVE-2020-7520.md): A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and (no CVSS, Schneider Electric Software Update (SESU) V2.4.0 and prior.)
- [CVE-2020-15632](https://cve.now/CVE-2020-15632.md): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. (CVSS 8.8, D-Link DIR-842)
- [CVE-2020-15633](https://cve.now/CVE-2020-15633.md): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR- (CVSS 8.8, D-Link Multiple Routers)
- [CVE-2020-15631](https://cve.now/CVE-2020-15631.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 1.04B03\_HOTFIX W (CVSS 8.0, D-Link DAP-1860)
- [CVE-2020-11625](https://cve.now/CVE-2020-11625.md): An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP (no CVSS)
- [CVE-2020-11624](https://cve.now/CVE-2020-11624.md): An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP (no CVSS)
- [CVE-2020-11623](https://cve.now/CVE-2020-11623.md): An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP (no CVSS)
- [CVE-2020-15492](https://cve.now/CVE-2020-15492.md): An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. (no CVSS)
- [CVE-2020-15477](https://cve.now/CVE-2020-15477.md): The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. (no CVSS)
- [CVE-2020-15391](https://cve.now/CVE-2020-15391.md): The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the We (no CVSS, github.com/loft-sh/devspace)
- [CVE-2019-18834](https://cve.now/CVE-2019-18834.md): Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript be (no CVSS)
- [CVE-2020-15917](https://cve.now/CVE-2020-15917.md): common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled. (no CVSS)
- [CVE-2020-15916](https://cve.now/CVE-2020-15916.md): goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell (no CVSS)
- [CVE-2020-8557](https://cve.now/CVE-2020-8557.md): Kubernetes node disk Denial of Service by writing to container /etc/hosts (CVSS 5.5, Kubernetes · k8s.io/kubernetes/pkg/kubelet +1)
- [CVE-2020-4447](https://cve.now/CVE-2020-4447.md): IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. (CVSS 5.4, IBM FileNet Content Manager)
- [CVE-2020-12638](https://cve.now/CVE-2020-12638.md): An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266\_NONOS\_SDK devices through 3.0.3, and ESP8266\_RTO (no CVSS)
- [CVE-2020-10922](https://cve.now/CVE-2020-10922.md): This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware vers (CVSS 7.5, C-MORE HMI EA9)
- [CVE-2020-10920](https://cve.now/CVE-2020-10920.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch (CVSS 9.8, C-MORE HMI EA9)
- [CVE-2020-10921](https://cve.now/CVE-2020-10921.md): This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen (CVSS 9.8, C-MORE HMI EA9)
- [CVE-2020-10918](https://cve.now/CVE-2020-10918.md): This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch (CVSS 7.5, C-MORE HMI EA9)
- [CVE-2020-10919](https://cve.now/CVE-2020-10919.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6. (CVSS 5.9, C-MORE HMI EA9)
- [CVE-2019-11252](https://cve.now/CVE-2019-11252.md): Credential leakage when failing to mount (CVSS 5.9, Kubernetes)
- [CVE-2020-15912](https://cve.now/CVE-2020-15912.md): Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. (no CVSS)
- [CVE-2020-11440](https://cve.now/CVE-2020-11440.md): httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root. (no CVSS)
- [CVE-2020-15881](https://cve.now/CVE-2020-15881.md): A Cross-Site Scripting (XSS) vulnerability in the munki\_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attacke (no CVSS, munkireport/munki\_facts)
- [CVE-2020-15882](https://cve.now/CVE-2020-15882.md): A CSRF issue in manager/delete\_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines from the MunkiReport d (no CVSS)
- [CVE-2020-15883](https://cve.now/CVE-2020-15883.md): A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitr (no CVSS, munkireport/managedinstalls)
- [CVE-2020-15884](https://cve.now/CVE-2020-15884.md): A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order (no CVSS)
- [CVE-2020-15885](https://cve.now/CVE-2020-15885.md): A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web (no CVSS, munkireport/comment)
- [CVE-2020-15886](https://cve.now/CVE-2020-15886.md): A SQL injection vulnerability in reportdata\_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute a (no CVSS, munkireport/reportdata)
- [CVE-2020-15887](https://cve.now/CVE-2020-15887.md): A SQL injection vulnerability in softwareupdate\_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to (no CVSS, munkireport/softwareupdate)
- [CVE-2020-15688](https://cve.now/CVE-2020-15688.md): The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. (no CVSS)
- [CVE-2020-15908](https://cve.now/CVE-2020-15908.md): tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction from a TAR archive. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-07-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.