Skip to content
OpenAdvisories

Archive

10 July 2020

Vulnerabilities first published on this day (UTC), newest first.

← June 2020 2020 / July /10 August 2020 →
  1. 171
  2. 254
  3. 311
  4. 41
  5. 513
  6. 628
  7. 770
  8. 818
  9. 951
  10. 1024
  11. 11 
  12. 12 
  13. 1320
  14. 14194
  15. 15278
  16. 1663
  17. 1773
  18. 18 
  19. 19 
  20. 2036
  21. 2118
  22. 2274
  23. 2341
  24. 2428
  25. 255
  26. 26 
  27. 2725
  28. 2886
  29. 2962
  30. 3051
  31. 3133
All Critical High Medium Low Exploited only Public exploit

24 results · Feed

  • Medium 5.4
    CVE-2020-15105

    In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session

    Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authenticat…

    Bouke django-two-factor-auth django-two-factor-auth PyPI
  • Medium 6.8
    CVE-2020-4042

    Authentication bypass in Bareos

    Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay th…

    Bareos GmbH & Co. KG bareos bareos bareos Ubuntu Alpine
  • Medium 6.0
    CVE-2020-11061

    Heap-based Buffer Overflow in Bareos Director

    In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates t…

    Bareos GmbH & Co. KG Bareos Director bareos bacula Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2020-11081

    osquery susceptible to DLL search order hijacking of zlib1.dll

    osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs…

    osquery osquery
  • Medium 6.6
    CVE-2020-6114

    An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Comm…

  • Unscored —
    CVE-2020-15504

    A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentiall…

  • Unscored —
    CVE-2020-8181

    A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.

    Web / CMS
  • Unscored —
    CVE-2020-8199

    Improper access control in Citrix ADC Gateway Linux client versions before 1.0.0.137 results in local privilege escalat…

    Linux
  • Unscored —
    CVE-2020-8197

    Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21,…

  • Medium 4.3
    CVE-2020-8196 Exploited EPSS 26%

    Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…

    KEV Nov 3, 2021
  • Medium 6.5
    CVE-2020-8195 Exploited EPSS 33%

    Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.…

    KEV Nov 3, 2021
  • Unscored —
    CVE-2020-8198

    Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.…

  • Unscored —
    CVE-2020-8194 Scanner template EPSS 11%

    Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.1…

  • Medium 6.5
    CVE-2020-8193 Exploited Public exploit Scanner template EPSS 88%

    Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…

    KEV Nov 3, 2021
  • Unscored —
    CVE-2020-8191 Scanner template EPSS 23%

    Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.…

  • Critical 9.8
    CVE-2020-8186

    Injection and Command Injection in devcert

    A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.

    devcert npm
  • Unscored —
    CVE-2020-8187

    Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthentica…

  • Unscored —
    CVE-2020-8190

    Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64…

  • Unscored —
    CVE-2020-3974

    VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior before 11.2.0 ) and Horizon Client fo…

  • Unscored —
    CVE-2020-9258

    HUAWEI P30 smartphone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper input verification vulnerabi…

  • Unscored —
    CVE-2020-9260

    HUAWEI P30 and HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E22R2P5) and versions earlier than …

  • High 7.8
    CVE-2020-7815

    XPLATFORM v9.2.260 and eariler versions contain a vulnerability that could allow remote files to be downloaded by setti…

    Tobesoft XPlatform
  • High 7.8
    CVE-2020-7814

    RAONWIZ v2018.0.2.50 and eariler versions contains a vulnerability that could allow remote files to be downloaded and e…

    RAONWiz RAON KUpload
  • Unscored —
    CVE-2020-5607

    Open redirect vulnerability in SHIRASAGI v1.13.1 and earlier allows remote attackers to redirect users to arbitrary web…

    SHIRASAGI Project SHIRASAGI