# CVEs published 2020-07-28 86 CVEs were published on July 28, 2020: 28 critical, 22 high. Days are UTC. - [CVE-2020-6098](https://cve.now/CVE-2020-6098.md): An exploitable denial of service vulnerability exists in the freeDiameter functionality of freeDiameter 1.3.2. (CVSS 7.5, freeDiameter) - [CVE-2020-10982](https://cve.now/CVE-2020-10982.md): Gambio GX before 4.0.1.0 allows SQL Injection in admin/gv\_mail.php. (no CVSS) - [CVE-2020-10983](https://cve.now/CVE-2020-10983.md): Gambio GX before 4.0.1.0 allows SQL Injection in admin/mobile.php. (no CVSS) - [CVE-2020-10984](https://cve.now/CVE-2020-10984.md): Gambio GX before 4.0.1.0 allows admin/admin.php CSRF. (no CVSS) - [CVE-2020-10985](https://cve.now/CVE-2020-10985.md): Gambio GX before 4.0.1.0 allows XSS in admin/coupon\_admin.php. (no CVSS) - [CVE-2020-11474](https://cve.now/CVE-2020-11474.md): NCP Secure Enterprise Client before 10.15 r47589 allows a symbolic link attack on enumusb.reg via Support Assistant. (no CVSS) - [CVE-2020-11476](https://cve.now/CVE-2020-11476.md): Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file. (no CVSS, concrete5/concrete5) - [CVE-2020-13970](https://cve.now/CVE-2020-13970.md): Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. (no CVSS, shopware/platform) - [CVE-2020-13971](https://cve.now/CVE-2020-13971.md): In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScr (no CVSS, shopware/platform) - [CVE-2020-13997](https://cve.now/CVE-2020-13997.md): In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handlin (no CVSS, shopware/core · shopware/platform) - [CVE-2020-16094](https://cve.now/CVE-2020-16094.md): In imap\_scan\_tree\_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursi (no CVSS) - [CVE-2020-5377](https://cve.now/CVE-2020-5377.md): Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. (CVSS 9.1, Dell Open Manage Server Administrator) - [CVE-2020-15416](https://cve.now/CVE-2020-15416.md): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84\_10.0.58 r (CVSS 8.8, NETGEAR R6700) - [CVE-2020-15417](https://cve.now/CVE-2020-15417.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84\_10.0.58 (CVSS 6.3, NETGEAR R6700) - [CVE-2020-10929](https://cve.now/CVE-2020-10929.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84\_10.0.58 (CVSS 8.8, NETGEAR R6700) - [CVE-2020-10930](https://cve.now/CVE-2020-10930.md): This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.84\_ (CVSS 6.5, NETGEAR R6700) - [CVE-2020-10927](https://cve.now/CVE-2020-10927.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84\_10.0.58 (CVSS 7.5, NETGEAR R6700) - [CVE-2020-10928](https://cve.now/CVE-2020-10928.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84\_10.0.58 (CVSS 8.4, NETGEAR R6700) - [CVE-2020-10924](https://cve.now/CVE-2020-10924.md): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84\_10.0.58 r (CVSS 8.8, NETGEAR R6700) - [CVE-2020-10925](https://cve.now/CVE-2020-10925.md): This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETG (CVSS 7.5, NETGEAR R6700) - [CVE-2020-10926](https://cve.now/CVE-2020-10926.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84\_10.0.58 (CVSS 7.5, NETGEAR R6700) - [CVE-2020-10923](https://cve.now/CVE-2020-10923.md): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84\_10.0.58 r (CVSS 6.5, NETGEAR R6700) - [CVE-2020-15419](https://cve.now/CVE-2020-15419.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750\_20200415. (CVSS 7.5, Veeam ONE) - [CVE-2020-15418](https://cve.now/CVE-2020-15418.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750\_20200415. (CVSS 7.5, Veeam ONE) - [CVE-2020-15627](https://cve.now/CVE-2020-15627.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15628](https://cve.now/CVE-2020-15628.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15625](https://cve.now/CVE-2020-15625.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15626](https://cve.now/CVE-2020-15626.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15623](https://cve.now/CVE-2020-15623.md): This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15624](https://cve.now/CVE-2020-15624.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15621](https://cve.now/CVE-2020-15621.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15622](https://cve.now/CVE-2020-15622.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15619](https://cve.now/CVE-2020-15619.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15620](https://cve.now/CVE-2020-15620.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15616](https://cve.now/CVE-2020-15616.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15617](https://cve.now/CVE-2020-15617.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15618](https://cve.now/CVE-2020-15618.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923 (CVSS 7.5, CentOS Web Panel) - [CVE-2020-15614](https://cve.now/CVE-2020-15614.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15615](https://cve.now/CVE-2020-15615.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15612](https://cve.now/CVE-2020-15612.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15613](https://cve.now/CVE-2020-15613.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15610](https://cve.now/CVE-2020-15610.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15611](https://cve.now/CVE-2020-15611.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15608](https://cve.now/CVE-2020-15608.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15609](https://cve.now/CVE-2020-15609.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15606](https://cve.now/CVE-2020-15606.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15607](https://cve.now/CVE-2020-15607.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15433](https://cve.now/CVE-2020-15433.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15434](https://cve.now/CVE-2020-15434.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15435](https://cve.now/CVE-2020-15435.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15431](https://cve.now/CVE-2020-15431.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15432](https://cve.now/CVE-2020-15432.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15429](https://cve.now/CVE-2020-15429.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15430](https://cve.now/CVE-2020-15430.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15427](https://cve.now/CVE-2020-15427.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15428](https://cve.now/CVE-2020-15428.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15424](https://cve.now/CVE-2020-15424.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15425](https://cve.now/CVE-2020-15425.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15426](https://cve.now/CVE-2020-15426.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15422](https://cve.now/CVE-2020-15422.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15423](https://cve.now/CVE-2020-15423.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15420](https://cve.now/CVE-2020-15420.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15421](https://cve.now/CVE-2020-15421.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. (CVSS 9.8, CentOS Web Panel) - [CVE-2020-15899](https://cve.now/CVE-2020-15899.md): Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble. (no CVSS, grin) - [CVE-2020-7685](https://cve.now/CVE-2020-7685.md): Insecure Defaults (CVSS 5.4, UmbracoForms) - [CVE-2020-15863](https://cve.now/CVE-2020-15863.md): hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. (no CVSS) - [CVE-2020-15900](https://cve.now/CVE-2020-15900.md): A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. (no CVSS) - [CVE-2020-15408](https://cve.now/CVE-2020-15408.md): An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. (CVSS 3.7) - [CVE-2020-13919](https://cve.now/CVE-2020-13919.md): emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to achieve command injection via a crafted HTTP re (no CVSS) - [CVE-2020-13918](https://cve.now/CVE-2020-13918.md): Incorrect access control in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to leak system information (t (no CVSS) - [CVE-2020-13917](https://cve.now/CVE-2020-13917.md): rkscli in Ruckus Wireless Unleashed through 200.7.10.92 allows a remote attacker to achieve command injection and jailbreak the CLI via a cr (no CVSS) - [CVE-2020-13916](https://cve.now/CVE-2020-13916.md): A stack buffer overflow in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to execute code via an unauthe (no CVSS) - [CVE-2020-13915](https://cve.now/CVE-2020-13915.md): Insecure permissions in emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allow a remote attacker to overwrite admin credenti (no CVSS) - [CVE-2020-13914](https://cve.now/CVE-2020-13914.md): webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to cause a denial of service (Segmentation fault) to the (no CVSS) - [CVE-2020-13913](https://cve.now/CVE-2020-13913.md): An XSS issue in emfd in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to execute JavaScript code via an unauthe (no CVSS) - [CVE-2020-15715](https://cve.now/CVE-2020-15715.md): rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.ph (no CVSS) - [CVE-2020-15714](https://cve.now/CVE-2020-15714.md): rConfig 3.9.5 is vulnerable to SQL injection. (no CVSS) - [CVE-2020-15713](https://cve.now/CVE-2020-15713.md): rConfig 3.9.5 is vulnerable to SQL injection. (no CVSS) - [CVE-2020-15712](https://cve.now/CVE-2020-15712.md): rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. (no CVSS) - [CVE-2020-4465](https://cve.now/CVE-2020-4465.md): IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS is vulnerable to a buffer overflow vulnerability due to an err (CVSS 5.3, IBM MQ Appliance) - [CVE-2020-4375](https://cve.now/CVE-2020-4375.md): IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS could allow an attacker to cause a denial of service due to a memo (CVSS 5.9, IBM MQ Appliance) - [CVE-2020-4319](https://cve.now/CVE-2020-4319.md): IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user (CVSS 3.1, IBM MQ Appliance) - [CVE-2020-4318](https://cve.now/CVE-2020-4318.md): IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics ar (CVSS 5.4, IBM Intelligent Operations Center for Emergency Manageme… +1) - [CVE-2020-4317](https://cve.now/CVE-2020-4317.md): IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics ar (CVSS 5.4, IBM Intelligent Operations Center · IBM Water Operations fo…) - [CVE-2019-4731](https://cve.now/CVE-2019-4731.md): IBM MQ Appliance 9.1.4.CD could allow a local attacker to obtain highly sensitive information by inclusion of sensitive data within trace. (CVSS 5.1, IBM MQ Appliance) - [CVE-2020-16088](https://cve.now/CVE-2020-16088.md): iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a publi (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-07-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.