# CVEs published 2020-07-24

28 CVEs were published on July 24, 2020: 0 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-10614](https://cve.now/CVE-2020-10614.md): In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-10604](https://cve.now/CVE-2020-10604.md): In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through speci (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-10600](https://cve.now/CVE-2020-10600.md): OSIsoft PI System (CVSS 5.9, OSIsoft PI Data Archive)
- [CVE-2020-10602](https://cve.now/CVE-2020-10602.md): In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager due to a race condition (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-10606](https://cve.now/CVE-2020-10606.md): In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-10608](https://cve.now/CVE-2020-10608.md): In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI Sy (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-10610](https://cve.now/CVE-2020-10610.md): In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI (no CVSS, OSIsoft PI System multiple products and versions)
- [CVE-2020-12812](https://cve.now/CVE-2020-12812.md): An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log (CVSS 7.5, KEV, Fortinet FortiOS)
- [CVE-2020-8174](https://cve.now/CVE-2020-8174.md): napi\_get\_value\_string\_\*() allows various kinds of memory corruption in node \< 10.21.0, 12.18.0, and \< 14.4.0. (no CVSS, https://github.com/nodejs/node)
- [CVE-2020-8175](https://cve.now/CVE-2020-8175.md): Uncontrolled resource consumption in \`jpeg-js\` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted (no CVSS, jpeg-js)
- [CVE-2020-8207](https://cve.now/CVE-2020-8207.md): Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the auto (no CVSS, Citrix Workspace App for Windows)
- [CVE-2020-15945](https://cve.now/CVE-2020-15945.md): Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG\_traceexec) because it incorrectly (no CVSS)
- [CVE-2020-14725](https://cve.now/CVE-2020-14725.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2020-15932](https://cve.now/CVE-2020-15932.md): Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges. (no CVSS)
- [CVE-2020-8326](https://cve.now/CVE-2020-8326.md): An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenti (CVSS 7.3, Lenovo Drivers Management)
- [CVE-2020-8317](https://cve.now/CVE-2020-8317.md): A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated u (CVSS 7.3, Lenovo Drivers Management)
- [CVE-2020-15860](https://cve.now/CVE-2020-15860.md): Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. (no CVSS)
- [CVE-2020-14297](https://cve.now/CVE-2020-14297.md): A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accum (CVSS 6.5, Red Hat wildfly · org.jboss:jboss-ejb-client)
- [CVE-2020-14175](https://cve.now/CVE-2020-14175.md): Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-S (no CVSS, Atlassian Confluence Server)
- [CVE-2020-15918](https://cve.now/CVE-2020-15918.md): Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0. (no CVSS)
- [CVE-2020-15919](https://cve.now/CVE-2020-15919.md): A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0. (no CVSS)
- [CVE-2020-15920](https://cve.now/CVE-2020-15920.md): There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with admini (no CVSS)
- [CVE-2020-15921](https://cve.now/CVE-2020-15921.md): Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, (no CVSS)
- [CVE-2020-15922](https://cve.now/CVE-2020-15922.md): There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (no CVSS)
- [CVE-2020-15923](https://cve.now/CVE-2020-15923.md): Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal. (no CVSS)
- [CVE-2020-15924](https://cve.now/CVE-2020-15924.md): There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. (no CVSS)
- [CVE-2020-14307](https://cve.now/CVE-2020-14307.md): A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations a (CVSS 6.5, Red Hat wildfly)
- [CVE-2020-15778](https://cve.now/CVE-2020-15778.md): scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destinat (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-07-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.