# CVEs published 2020-07-30

51 CVEs were published on July 30, 2020: 0 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-16166](https://cve.now/CVE-2020-16166.md): The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal st (no CVSS)
- [CVE-2020-16165](https://cve.now/CVE-2020-16165.md): The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. (no CVSS)
- [CVE-2020-7205](https://cve.now/CVE-2020-7205.md): A potential security vulnerability has been identified in HPE Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit (no CVSS, HP Intelligent Provisioning · HPE ProLiant BL460c Gen9… +87)
- [CVE-2020-15129](https://cve.now/CVE-2020-15129.md): Open redirect in Traefik (CVSS 6.1, containous traefik · github.com/traefik/traefik +7)
- [CVE-2020-16162](https://cve.now/CVE-2020-16162.md): An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. (no CVSS)
- [CVE-2020-16163](https://cve.now/CVE-2020-16163.md): An issue was discovered in RIPE NCC RPKI Validator 3.x before 3.1-2020.07.06.14.28. (no CVSS)
- [CVE-2020-16164](https://cve.now/CVE-2020-16164.md): An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. (no CVSS, net.ripe.rpki:rpki-validator-3)
- [CVE-2020-15130](https://cve.now/CVE-2020-15130.md): False-positive validity for NFT1 genesis transactions in SLPJS (CVSS 7.5, simpleledger slpjs · slpjs)
- [CVE-2020-15131](https://cve.now/CVE-2020-15131.md): False-positive validity for NFT1 genesis transactions in SLP Validate (CVSS 7.5, simpleledger slp-validate.js · slp-validate)
- [CVE-2020-16157](https://cve.now/CVE-2020-16157.md): A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -\> Email Users menu. (no CVSS)
- [CVE-2020-7828](https://cve.now/CVE-2020-7828.md): DaviewIndy Heap-based Buffer Overflow Vulnerability (CVSS 7.8, HumanTalk DavieIndy)
- [CVE-2020-7829](https://cve.now/CVE-2020-7829.md): DaviewIndy Heap-based Buffer Overflow Vulnerability (CVSS 7.8, HumanTalk DavieIndy)
- [CVE-2020-7827](https://cve.now/CVE-2020-7827.md): DaviewIndy Use-After-Free Vulnerability (CVSS 7.8, HumanTalk DavieIndy)
- [CVE-2020-15511](https://cve.now/CVE-2020-15511.md): HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when disabled, bypassing (no CVSS)
- [CVE-2020-14158](https://cve.now/CVE-2020-14158.md): The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that a (no CVSS)
- [CVE-2020-15957](https://cve.now/CVE-2020-15957.md): An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing (DP3T). (no CVSS)
- [CVE-2020-14162](https://cve.now/CVE-2020-14162.md): An issue was discovered in Pi-Hole through 5.0. (no CVSS)
- [CVE-2020-12620](https://cve.now/CVE-2020-12620.md): Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacte (no CVSS)
- [CVE-2020-10713](https://cve.now/CVE-2020-10713.md): A flaw was found in grub2, prior to version 2.06. (no CVSS, Grub)
- [CVE-2020-4186](https://cve.now/CVE-2020-4186.md): IBM Security Guardium 10.5, 10.6, and 11.1 could disclose sensitive information on the login page that could aid in further attacks against (CVSS 5.3, IBM Security Guardium)
- [CVE-2020-4185](https://cve.now/CVE-2020-4185.md): IBM Security Guardium 10.5, 10.6, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly (CVSS 5.9, IBM Security Guardium)
- [CVE-2020-8192](https://cve.now/CVE-2020-8192.md): A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (whe (no CVSS, fastify)
- [CVE-2020-8202](https://cve.now/CVE-2020-8202.md): Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when using a very long pa (no CVSS, Nextcloud Preferred Providers)
- [CVE-2020-8204](https://cve.now/CVE-2020-8204.md): A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure \<9.1R5 on the PSAL Page. (no CVSS, Pulse Connect Secure)
- [CVE-2020-8206](https://cve.now/CVE-2020-8206.md): An improper authentication vulnerability exists in Pulse Connect Secure \<9.1RB that allows an attacker with a users primary credentials to b (no CVSS, Pulse Connect Secure)
- [CVE-2020-8213](https://cve.now/CVE-2020-8213.md): An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid u (no CVSS, Protect for UniFi Cloud Key Gen2 Plus)
- [CVE-2020-8216](https://cve.now/CVE-2020-8216.md): An information disclosure vulnerability in meeting of Pulse Connect Secure \<9.1R8 allowed an authenticated end-users to find meeting details (no CVSS, Pulse Connect Secure)
- [CVE-2020-8217](https://cve.now/CVE-2020-8217.md): A cross site scripting (XSS) vulnerability in Pulse Connect Secure \<9.1R8 allowed attackers to exploit in the URL used for Citrix ICA. (no CVSS, Pulse Connect Secure)
- [CVE-2020-8218](https://cve.now/CVE-2020-8218.md): A code injection vulnerability exists in Pulse Connect Secure \<9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code e (CVSS 7.2, KEV, Pulse Connect Secure)
- [CVE-2020-8219](https://cve.now/CVE-2020-8219.md): An insufficient permission check vulnerability exists in Pulse Connect Secure \<9.1R8 that allows an attacker to change the password of a ful (no CVSS, Pulse Connect Secure)
- [CVE-2020-8220](https://cve.now/CVE-2020-8220.md): A denial of service vulnerability exists in Pulse Connect Secure \<9.1R8 that allows an authenticated attacker to perform command injection v (no CVSS, Pulse Connect Secure)
- [CVE-2020-8221](https://cve.now/CVE-2020-8221.md): A path traversal vulnerability exists in Pulse Connect Secure \<9.1R8 which allows an authenticated attacker to read arbitrary files via the (no CVSS, Pulse Connect Secure)
- [CVE-2020-8222](https://cve.now/CVE-2020-8222.md): A path traversal vulnerability exists in Pulse Connect Secure \<9.1R8 that allowed an authenticated attacker via the administrator web interf (no CVSS, Pulse Connect Secure)
- [CVE-2020-14309](https://cve.now/CVE-2020-14309.md): There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UI (no CVSS, Grub)
- [CVE-2020-3701](https://cve.now/CVE-2020-3701.md): Use after free issue while processing error notification from camx driver due to not properly releasing the sequence data in Snapdragon Mobi (no CVSS, Qualcomm Snapdragon Mobile)
- [CVE-2020-3699](https://cve.now/CVE-2020-3699.md): Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3700](https://cve.now/CVE-2020-3700.md): Possible out of bounds read due to a missing bounds check and could lead to local information disclosure in the wifi driver with no addition (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3671](https://cve.now/CVE-2020-3671.md): Use-after-free issue could occur due to dangling pointer when generating a frame buffer in OpenGL ES in Snapdragon Compute, Snapdragon Consu (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2020-3688](https://cve.now/CVE-2020-3688.md): Possible buffer overflow while parsing mp4 clip with corrupted sample atoms due to improper validation of index in Snapdragon Auto, Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3698](https://cve.now/CVE-2020-3698.md): Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Snapdragon A (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14124](https://cve.now/CVE-2019-14124.md): Memory failure in content protection module due to not having pointer within the scope in Snapdragon Auto, Snapdragon Compute, Snapdragon Mo (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Mo…)
- [CVE-2019-14130](https://cve.now/CVE-2019-14130.md): Memory corruption can occurs in trusted application if offset size from HLOS is more than actual mapped buffer size in Snapdragon Auto, Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Mo…)
- [CVE-2019-14101](https://cve.now/CVE-2019-14101.md): Out of bounds read can happen in diag event set mask command handler when user provided length in the command request is less than expected (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14123](https://cve.now/CVE-2019-14123.md): Possible buffer overflow and over read possible due to missing bounds checks for fixed limits if we consider widevine HLOS client as non-tru (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Mo…)
- [CVE-2019-14099](https://cve.now/CVE-2019-14099.md): Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto, Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14100](https://cve.now/CVE-2019-14100.md): Register write via debugfs is disabled by default to prevent register writing via debugfs. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10580](https://cve.now/CVE-2019-10580.md): When kernel thread unregistered listener, Use after free issue happened as the listener client\`s private data has been already freed in Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14037](https://cve.now/CVE-2019-14037.md): Close and bind operations done on a socket can lead to a Use-After-Free condition. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14093](https://cve.now/CVE-2019-14093.md): Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snapdragon Con (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2020-7699](https://cve.now/CVE-2020-7699.md): Prototype Pollution (CVSS 7.5, express-fileupload)
- [CVE-2020-5610](https://cve.now/CVE-2020-5610.md): Global TechStream (GTS) for TOYOTA dealers version 15.10.032 and earlier allows an attacker to cause a denial-of-service (DoS) condition and (no CVSS, TOYOTA MOTOR Global TechStream (GTS) for TOYOTA dealers)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-07-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.