Skip to content
OpenAdvisories

Archive

8 June 2020

Vulnerabilities first published on this day (UTC), newest first.

← May 2020 2020 / June /8 July 2020 →
  1. 138
  2. 256
  3. 3127
  4. 4100
  5. 533
  6. 65
  7. 78
  8. 834
  9. 9222
  10. 1074
  11. 11123
  12. 1228
  13. 13 
  14. 143
  15. 1590
  16. 1653
  17. 1752
  18. 1884
  19. 19193
  20. 202
  21. 218
  22. 2280
  23. 2327
  24. 2466
  25. 2574
  26. 26104
  27. 272
  28. 283
  29. 2972
  30. 3052
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.4
    CVE-2020-4041

    The filename of uploaded files vulnerable to stored XSS in Bolt CMS

    In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload …

    bolt bolt bolt/bolt bolt Azure Linux Packagist
  • High 8.6
    CVE-2020-4040 Public exploit

    CSRF issue on preview pages in Bolt CMS

    Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of p…

    bolt bolt bolt/bolt bolt Azure Linux Packagist
  • High 7.4
    CVE-2020-4038

    Reflected XSS in GraphQL Playground

    GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in g…

    prisma-labs graphql-playground graphql-playground-html npm
  • High 7.5
    CVE-2020-13625

    Insufficient output escaping of attachment names in PHPMailer

    PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.

    cacti phpmailer/phpmailer libphp-phpmailer libphp-phpmailer Debian Ubuntu Alpine Packagist
  • High 8.0
    CVE-2020-6110

    An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages inc…

  • High 8.5
    CVE-2020-6109

    An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including anim…

  • High 7.3
    CVE-2020-4529

    IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to server side request forgery (SSRF). This may allow an auth…

    IBM Maximo Asset Management