CVEs published July 24, 2020
28 CVEs were published on July 24, 2020: 0 critical, 4 high. 1 is now in CISA KEV.
- Published
- 28
- Critical
- 0
- High
- 4
- Medium
- 4
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 1
- Fix available
- 6
Most affected products
- OSIsoft PI System multiple products and versions
- 6
- Lenovo Drivers Management
- 2
- Atlassian Confluence Server
- 1
- Citrix Workspace App for Windows
- 1
- Fortinet FortiOS
- 1
- https://github.com/nodejs/node
- 1
- jpeg-js
- 1
- Oracle MySQL Server
- 1
- OSIsoft PI Data Archive
- 1
- Red Hat wildfly
- 1
High 4
- CVE-2020-12812An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to logFortinet FortiOS
- CVE-2020-8326An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authentiLenovo Drivers Management
- CVE-2020-8317A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated uLenovo Drivers Management
- CVE-2020-15778scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destinat
Medium, low and unrated 24
- CVE-2020-10614In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject OSIsoft PI System multiple products and versions
- CVE-2020-10604In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through speciOSIsoft PI System multiple products and versions
- CVE-2020-10600OSIsoft PI SystemOSIsoft PI Data Archive
- CVE-2020-10602In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager due to a race conditionOSIsoft PI System multiple products and versions
- CVE-2020-10606In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software.OSIsoft PI System multiple products and versions
- CVE-2020-10608In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI SyOSIsoft PI System multiple products and versions
- CVE-2020-10610In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PIOSIsoft PI System multiple products and versions
- CVE-2020-8174napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.https://github.com/nodejs/node
- CVE-2020-8175Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a craftedjpeg-js
- CVE-2020-8207Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the autoCitrix Workspace App for Windows
- CVE-2020-15945Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly
- CVE-2020-14725Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2020-15932Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges.
- CVE-2020-15860Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution.
- CVE-2020-14297A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumRed Hat wildfly · org.jboss:jboss-ejb-client
- CVE-2020-14175Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-SAtlassian Confluence Server
- CVE-2020-15918Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0.
- CVE-2020-15919A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0.
- CVE-2020-15920There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with admini
- CVE-2020-15921Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities,
- CVE-2020-15922There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative
- CVE-2020-15923Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal.
- CVE-2020-15924There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure.
- CVE-2020-14307A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations aRed Hat wildfly