CVEs published July 30, 2020
51 CVEs were published on July 30, 2020: 0 critical, 7 high. 1 is now in CISA KEV.
- Published
- 51
- Critical
- 0
- High
- 7
- Medium
- 3
- Low
- 0
- Unrated
- 41
- Now in CISA KEV
- 1
- Fix available
- 6
Most affected products
- Pulse Connect Secure
- 9
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 9
- HumanTalk DavieIndy
- 3
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Mo…
- 3
- Grub
- 2
- IBM Security Guardium
- 2
- containous traefik · github.com/traefik/traefik +7
- 1
- express-fileupload
- 1
- fastify
- 1
- HP Intelligent Provisioning · HPE ProLiant BL460c Gen9… +87
- 1
High 7
- CVE-2020-15130False-positive validity for NFT1 genesis transactions in SLPJSsimpleledger slpjs · slpjs
- CVE-2020-15131False-positive validity for NFT1 genesis transactions in SLP Validatesimpleledger slp-validate.js · slp-validate
- CVE-2020-7828DaviewIndy Heap-based Buffer Overflow VulnerabilityHumanTalk DavieIndy
- CVE-2020-7829DaviewIndy Heap-based Buffer Overflow VulnerabilityHumanTalk DavieIndy
- CVE-2020-7827DaviewIndy Use-After-Free VulnerabilityHumanTalk DavieIndy
- CVE-2020-8218A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code ePulse Connect Secure
- CVE-2020-7699Prototype Pollutionexpress-fileupload
Medium, low and unrated 44
- CVE-2020-16166The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal st
- CVE-2020-16165The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause.
- CVE-2020-7205A potential security vulnerability has been identified in HPE Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKitHP Intelligent Provisioning · HPE ProLiant BL460c Gen9… +87
- CVE-2020-15129Open redirect in Traefikcontainous traefik · github.com/traefik/traefik +7
- CVE-2020-16162An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28.
- CVE-2020-16163An issue was discovered in RIPE NCC RPKI Validator 3.x before 3.1-2020.07.06.14.28.
- CVE-2020-16164An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28.net.ripe.rpki:rpki-validator-3
- CVE-2020-16157A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.
- CVE-2020-15511HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when disabled, bypassing
- CVE-2020-14158The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that a
- CVE-2020-15957An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing (DP3T).
- CVE-2020-14162An issue was discovered in Pi-Hole through 5.0.
- CVE-2020-12620Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacte
- CVE-2020-10713A flaw was found in grub2, prior to version 2.06.Grub
- CVE-2020-4186IBM Security Guardium 10.5, 10.6, and 11.1 could disclose sensitive information on the login page that could aid in further attacks against IBM Security Guardium
- CVE-2020-4185IBM Security Guardium 10.5, 10.6, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highlyIBM Security Guardium
- CVE-2020-8192A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (whefastify
- CVE-2020-8202Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when using a very long paNextcloud Preferred Providers
- CVE-2020-8204A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page.Pulse Connect Secure
- CVE-2020-8206An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bPulse Connect Secure
- CVE-2020-8213An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid uProtect for UniFi Cloud Key Gen2 Plus
- CVE-2020-8216An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting detailsPulse Connect Secure
- CVE-2020-8217A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA.Pulse Connect Secure
- CVE-2020-8219An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a fulPulse Connect Secure
- CVE-2020-8220A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection vPulse Connect Secure
- CVE-2020-8221A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the Pulse Connect Secure
- CVE-2020-8222A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interfPulse Connect Secure
- CVE-2020-14309There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UIGrub
- CVE-2020-3701Use after free issue while processing error notification from camx driver due to not properly releasing the sequence data in Snapdragon MobiQualcomm Snapdragon Mobile
- CVE-2020-3699Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-3700Possible out of bounds read due to a missing bounds check and could lead to local information disclosure in the wifi driver with no additionQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-3671Use-after-free issue could occur due to dangling pointer when generating a frame buffer in OpenGL ES in Snapdragon Compute, Snapdragon ConsuQualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…
- CVE-2020-3688Possible buffer overflow while parsing mp4 clip with corrupted sample atoms due to improper validation of index in Snapdragon Auto, SnapdragQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-3698Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Snapdragon AQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14124Memory failure in content protection module due to not having pointer within the scope in Snapdragon Auto, Snapdragon Compute, Snapdragon MoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Mo…
- CVE-2019-14130Memory corruption can occurs in trusted application if offset size from HLOS is more than actual mapped buffer size in Snapdragon Auto, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Mo…
- CVE-2019-14101Out of bounds read can happen in diag event set mask command handler when user provided length in the command request is less than expected Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14123Possible buffer overflow and over read possible due to missing bounds checks for fixed limits if we consider widevine HLOS client as non-truQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Mo…
- CVE-2019-14099Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto, SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14100Register write via debugfs is disabled by default to prevent register writing via debugfs.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10580When kernel thread unregistered listener, Use after free issue happened as the listener client`s private data has been already freed in SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14037Close and bind operations done on a socket can lead to a Use-After-Free condition.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14093Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snapdragon ConQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2020-5610Global TechStream (GTS) for TOYOTA dealers version 15.10.032 and earlier allows an attacker to cause a denial-of-service (DoS) condition andTOYOTA MOTOR Global TechStream (GTS) for TOYOTA dealers