# CVEs published 2020-07-27 25 CVEs were published on July 27, 2020: 0 critical, 0 high. Days are UTC. - [CVE-2020-12845](https://cve.now/CVE-2020-12845.md): Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. (no CVSS) - [CVE-2020-12460](https://cve.now/CVE-2020-12460.md): OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc\_xml\_parse that can result in a (no CVSS) - [CVE-2020-12880](https://cve.now/CVE-2020-12880.md): An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8. (no CVSS) - [CVE-2020-10643](https://cve.now/CVE-2020-10643.md): OSIsoft PI System (CVSS 6.5, OSIsoft PI Vision) - [CVE-2020-8558](https://cve.now/CVE-2020-8558.md): Kubernetes node setting allows for neighboring hosts to bypass localhost boundary (CVSS 5.4, Kubernetes · k8s.io/kubernetes) - [CVE-2020-10609](https://cve.now/CVE-2020-10609.md): Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to be read or allow modification to system se (no CVSS, Grundfos CIM) - [CVE-2020-1457](https://cve.now/CVE-2020-1457.md): A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka 'Microsoft Wind (no CVSS, Microsoft Windows) - [CVE-2020-1425](https://cve.now/CVE-2020-1425.md): A remoted code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka 'Microsoft Win (no CVSS, Microsoft Windows) - [CVE-2020-7016](https://cve.now/CVE-2020-7016.md): Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. (no CVSS, Elastic Kibana) - [CVE-2020-7017](https://cve.now/CVE-2020-7017.md): In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. (no CVSS, Elastic Kibana) - [CVE-2020-15120](https://cve.now/CVE-2020-15120.md): Authorization Bypass in I hate money (CVSS 4.9, spiral-project ihatemoney · ihatemoney) - [CVE-2020-15593](https://cve.now/CVE-2020-15593.md): SteelCentral Aternity Agent 11.0.0.120 on Windows mishandles IPC. (no CVSS) - [CVE-2020-15592](https://cve.now/CVE-2020-15592.md): SteelCentral Aternity Agent before 11.0.0.120 on Windows allows Privilege Escalation via a crafted file. (no CVSS) - [CVE-2020-4498](https://cve.now/CVE-2020-4498.md): IBM MQ Appliance 9.1 LTS and 9.1 CD could allow a local privileged user to obtain highly sensitve information due to inclusion of data withi (CVSS 4.1, IBM MQ Appliance) - [CVE-2020-4408](https://cve.now/CVE-2020-4408.md): The IBM QRadar Advisor 1.1 through 2.5.2 with Watson App for IBM QRadar SIEM does not adequately mask all passwords during input, which coul (CVSS 4.2, IBM Qradar Advisor) - [CVE-2020-4405](https://cve.now/CVE-2020-4405.md): IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due to world readable log (CVSS 3.1, IBM Verify Gateway) - [CVE-2020-11110](https://cve.now/CVE-2020-11110.md): Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject Ja (no CVSS, github.com/grafana/grafana) - [CVE-2020-9251](https://cve.now/CVE-2020-9251.md): HUAWEI Mate 20 smartphones with versions earlier than 10.1.0.160(C00E160R2P11) have an improper authorization vulnerability. (no CVSS, HUAWEI Mate) - [CVE-2020-9077](https://cve.now/CVE-2020-9077.md): HUAWEI P30 smart phones with versions earlier than 10.1.0.160(C00E160R2P11) have an information exposure vulnerability. (no CVSS, HUAWEI P30) - [CVE-2020-7695](https://cve.now/CVE-2020-7695.md): HTTP Response Splitting (CVSS 5.3, uvicorn) - [CVE-2020-7694](https://cve.now/CVE-2020-7694.md): Log Injection (CVSS 3.7, uvicorn) - [CVE-2020-5611](https://cve.now/CVE-2020-5611.md): Cross-site request forgery (CSRF) vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attackers to hijack the auth (no CVSS, Social Rocket Social Sharing Plugin) - [CVE-2020-15953](https://cve.now/CVE-2020-15953.md): LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and (no CVSS) - [CVE-2020-15954](https://cve.now/CVE-2020-15954.md): KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use. (no CVSS) - [CVE-2020-15103](https://cve.now/CVE-2020-15103.md): Integer Overflow in FreeRDP (CVSS 3.5, FreeRDP) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-07-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.