CVEs published July 29, 2020
60 CVEs were published on July 29, 2020: 3 critical, 11 high.
- Published
- 60
- Critical
- 3
- High
- 11
- Medium
- 13
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- open source OpenClinic GA
- 7
- IBM Security Key Lifecycle Manager
- 5
- Grandstream HT800 Series
- 4
- grub2 in Ubuntu
- 3
- kujirahand KonaWiki
- 3
- SICK Package Analytics
- 3
- Adobe Magento · magento/community-edition
- 2
- Adobe Magento · magento/community-edition +1
- 2
- IBM Planning Analytics
- 2
- TYPO3 CMS · typo3/cms-core +1
- 2
Critical 3
High 11
- CVE-2020-11933local snapd exploit through cloud-initCanonical snapd · Canonical core
- CVE-2020-15125Authorization header is not sanitized in an error object in auth0node-auth0 · auth0
- CVE-2020-15098Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMSTYPO3 CMS · typo3/cms-core +1
- CVE-2020-15099Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMSTYPO3 CMS · typo3/cms-core +1
- CVE-2020-4574IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers toIBM Security Key Lifecycle Manager
- CVE-2020-4567IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force IBM Security Key Lifecycle Manager
- CVE-2020-4463IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM Maximo Asset Management
- CVE-2020-14488OpenClinic GAopen source OpenClinic GA
- CVE-2020-7698Command InjectionGerapy
- CVE-2020-14493OpenClinic GAopen source OpenClinic GA
- CVE-2020-14490OpenClinic GAopen source OpenClinic GA
Medium, low and unrated 46
- CVE-2020-16143The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory.
- CVE-2020-16135libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
- CVE-2017-18923beroNet VoIP Gateways before 3.0.16 have a PHP script that allows downloading arbitrary files, including ones with credentials.
- CVE-2020-14308In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size.Grub
- CVE-2020-5763Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service.Grandstream HT800 Series
- CVE-2020-5762Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service.Grandstream HT800 Series
- CVE-2020-5761Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service.Grandstream HT800 Series
- CVE-2020-5760Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability.Grandstream HT800 Series
- CVE-2020-14316A flaw was found in kubevirt 0.29 and earlier.kubevirt · kubevirt.io/kubevirt
- CVE-2020-16117In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an in
- CVE-2020-16118In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by sen
- CVE-2020-15707GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.grub2 in Ubuntu
- CVE-2020-15706GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.grub2 in Ubuntu
- CVE-2020-15705GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shimgrub2 in Ubuntu
- CVE-2020-15588An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W.
- CVE-2019-20033On Aspire-derived NEC PBXes, including all versions of SV8100 devices, a set of documented, static login credentials may be used to access t
- CVE-2019-20032An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all ve
- CVE-2019-20031NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts i
- CVE-2019-20030An attacker with knowledge of the modem access number on a NEC UM8000 voicemail system may use SSH tunneling or standard Linux utilities to
- CVE-2019-20029An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of
- CVE-2019-20028Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticate
- CVE-2019-20027Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if in
- CVE-2019-20026The WebPro interface in NEC SV9100 software releases 7.0 or higher allows unauthenticated remote attackers to reset all existing usernames a
- CVE-2019-20025Certain builds of NEC SV9100 software could allow an unauthenticated, remote attacker to log into a device running an affected release with
- CVE-2020-11934Sandbox escape vulnerability via snapctl user-open (xdg-open)Canonical snapd
- CVE-2020-13699TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers.
- CVE-2020-8553Kubernetes ingress-nginx Compromise of auth via subset/superset namespace namesKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2020-16095The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.kitodo/presentation
- CVE-2020-4645IBM Planning Analytics Local 2.0.0 through 2.0.9.1 is vulnerable to cross-site scripting.IBM Planning Analytics
- CVE-2020-4644IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim.IBM Planning Analytics
- CVE-2020-4573IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated HTTP requests.IBM Security Key Lifecycle Manager
- CVE-2020-4572IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical errorIBM Security Key Lifecycle Manager
- CVE-2020-4569IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the existence or values of an input, but the inputIBM Security Key Lifecycle Manager
- CVE-2020-14486OpenClinic GAopen source OpenClinic GA
- CVE-2020-2078Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.1.1.SICK Package Analytics
- CVE-2020-2077SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings.SICK Package Analytics
- CVE-2020-2076SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with SICK Package Analytics
- CVE-2020-14492OpenClinic GAopen source OpenClinic GA
- CVE-2020-14489OpenClinic GAopen source OpenClinic GA
- CVE-2020-9691Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability.Adobe Magento · magento/community-edition +1
- CVE-2020-9692Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability.Adobe Magento · magento/community-edition
- CVE-2020-9690Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability.Adobe Magento · magento/community-edition
- CVE-2020-9689Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability.Adobe Magento · magento/community-edition +1
- CVE-2020-5614Directory traversal vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors.kujirahand KonaWiki
- CVE-2020-5613Cross-site scripting vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafkujirahand KonaWiki
- CVE-2020-5612Cross-site scripting vulnerability in KonaWiki 2.2.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafkujirahand KonaWiki