Skip to content
OpenAdvisories

Archive

June 2020

Vulnerabilities first published in this month (UTC), newest first.

← May 2020 2020 / June July 2020 →
  1. 138
  2. 256
  3. 3127
  4. 4100
  5. 533
  6. 65
  7. 78
  8. 834
  9. 9222
  10. 1074
  11. 11123
  12. 1228
  13. 13 
  14. 143
  15. 1590
  16. 1653
  17. 1752
  18. 1884
  19. 19193
  20. 202
  21. 218
  22. 2280
  23. 2327
  24. 2466
  25. 2574
  26. 26104
  27. 272
  28. 283
  29. 2972
  30. 3052
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.5
    CVE-2020-11996 Public exploit EPSS 27%

    Uncontrolled Resource Consumption in Apache Tomcat

    A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 conne…

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  • High 7.5
    CVE-2020-8162 Public exploit

    Circumvention of file size limits in ActiveStorage

    A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.

    rails rails activestorage Debian Ubuntu RubyGems
  • High 7.0
    CVE-2020-13162 Public exploit

    A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down…

  • High 8.1
    CVE-2020-14195 Public exploit

    Deserialization of untrusted data in Jackson Databind

    FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • High 8.8
    CVE-2020-9802 Public exploit

    A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, w…

    Apple watchOS tvOS Safari Windows iOS Browsers Debian Ubuntu Alpine
  • High 8.6
    CVE-2020-4040 Public exploit

    CSRF issue on preview pages in Bolt CMS

    Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of p…

    bolt bolt bolt/bolt Packagist
  • High 7.2
    CVE-2020-8103 Public exploit

    Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8604)

    A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects Bitdefender Antivirus Free versions prior to …

    Bitdefender Bitdefender Antivirus Free
  • High 7.5
    CVE-2020-7661 Public exploit

    Regular expression denial of service in url-regex

    all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.

    url-regex npm
  • High 7.5
    CVE-2020-5410 Exploited Public exploit EPSS 96%

    Directory Traversal with spring-cloud-config-server

    Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send …

    Spring by VMware Spring Cloud Config org.springframework.cloud:spring-cloud-config-server Maven
    KEV Mar 25, 2022