CVEs published in June 2020
2,026 vulnerabilities, 225 critical, 10 exploited.
- nodejs node.js, oracle banking extensibility workbench, blockchain platform +2 more +4 moreTLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and ...7.4 High
- ibm maximo asset managementIBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to server side request forgery (SSRF)....7.3 High
- realtek adsl/pon modem soc, adsl router soc firmware +1 moreRealtek ADSL/PON Modem SoC - Security Misconfiguration9.6 Critical
- debian linux, linuxtv xawtv, canonical ubuntu linux +3 more +5 moreAn issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does...4.4 Medium
- solarwinds advanced monitoring agentSolarWinds Advanced Monitoring Agent before 10.8.9 allows local users to gain privileges via a...7.3 High
- pengutronix bareboxPengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c...9.1 Critical
- facade ignitionCritical severity vulnerability in Ignition9.8 Critical
- ffmpeg, canonical ubuntu linux, debian linux +2 moreFFmpeg 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because...5.5 Medium
- imagemagickImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in...7.1 High
- heskHESK before 3.1.10 allows reflected XSS.6.1 Medium
- p5-crypt-perl project p5-crypt-perlCrypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to...8.8 High
- dext5handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download...7.5 High
- apple macos, mac os x +1 moreA buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS...3.3 Low
- laborator neonThe Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in...5.4 Medium
- bluditshowAlert() in the administration panel in Bludit 3.12.0 allows XSS.5.4 Medium
- wso2 api manager, api microgateway, identity server as key manager +2 moreIn WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5...5.5 Medium
- pam tacplus project tacplus, arista cloudvision portal, canonical ubuntu linux +1 more +3 moreIn support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog...7.5 High
- sqlite, debian linux, fedoraproject fedora +12 more +14 moreSQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite...7.5 High
- netapp active iq unified manager, oncommand insight, oncommand workflow automation +6 more +8 morenapi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0,...8.1 High
- elementor page builderThe Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS...5.4 Medium
- elementor page builderThe Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS...5.4 Medium
- combodo itopIn Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop pr…6.1 Medium
- combodo itopIn Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop…6.1 Medium
- ijinshan cheetah free wifiIn the cheetah free wifi 5.1 driver file liebaonat.sys, local users are allowed to cause a denial...7.8 High
apollo-servernpm,apollo-server-azure-functionsnpm,apollo-server-cache-memcachednpm +9 more +11 moreIntrospection in schema validation in Apollo ServerNo scoreoctober/octoberPackagist,october/systemPackagist +1 moreUse of insecure jQuery version in OctoberCMSNo score- verbb commentsComments plugin Cross-Site Request Forgery (CSRF)6.5 Medium
- verbb commentsComments plugin stored Cross-site Scripting via a guest name5.4 Medium
- verbb commentsComments plugin stored Cross-site Scripting (XSS) via an asset volume name5.4 Medium
- zephyrproject zephyrInsufficient publish message length validation in MQTT9.0 Critical
- zephyrproject zephyrMQTT buffer overflow on receive buffer9.0 Critical
- zephyrproject zephyrZephyr Bluetooth DLE duplicate requests vulnerability5.1 Medium
- zephyrproject zephyrRemote Denial of Service in CoAP Option Parsing Due To Integer Overflow6.8 Medium
- zephyrproject zephyrPacket length decoding error in MQTT9.0 Critical
- zephyrproject zephyrError handling invalid packet sequence8.1 High
- targetcli-fb project targetcli-fb, fedoraproject fedora +1 moreOpen-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup...5.5 Medium
- apple ios, ipados, macos +5 more +7 moreA memory consumption issue was addressed with improved memory handling. This issue is fixed in...7.8 High
- huawei nip6800, secospace usg6600, usg9500 +3 more +5 moreHuawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability. An attacker...4.9 Medium
- huawei honor 20, honor 20 pro, honor view 20 +3 more +5 moreHuawei Smartphones HONOR 20 PRO;Honor View 20;HONOR 20 have an improper handling of exceptional...5.3 Medium
- apache unomiImproper Input Validation in Apache Unomi9.8 Critical
- docker desktopAn issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up...7.8 High
- pydio cellsIn Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link...5.4 Medium
- ibm websphere application serverIBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute...9.8 Critical
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker...7.5 High
- ibm websphere application server, websphere virtual enterprise +1 moreIBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote...9.8 Critical
- ibm mobile foundation, mobilefirst platform foundation +1 moreIBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user...5.6 Medium
- pydio cellsPydio Cells 2.0.4 allows any user to upload a profile image to the web application, including...5.4 Medium
- bitdefender antivirus free, antivirus 2020 +1 moreLink Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8604)7.2 High
- xack dns, xack, inc. xack dns +1 moreXACK DNS 1.11.0 to 1.11.4, 1.10.0 to 1.10.8, 1.8.0 to 1.8.23, 1.7.0 to 1.7.18, and versions...7.5 High
- freedesktop dbus, canonical ubuntu linux +1 moreCVE-2020-12049 does not affect BellSoft software5.5 Medium
- Show moreLoading…