Skip to content
OpenAdvisories

Archive

July 2020

Vulnerabilities first published in this month (UTC), newest first.

← June 2020 2020 / July August 2020 →
  1. 171
  2. 254
  3. 311
  4. 41
  5. 513
  6. 628
  7. 770
  8. 818
  9. 951
  10. 1024
  11. 11 
  12. 12 
  13. 1320
  14. 14194
  15. 15278
  16. 1663
  17. 1773
  18. 18 
  19. 19 
  20. 2036
  21. 2118
  22. 2274
  23. 2341
  24. 2428
  25. 255
  26. 26 
  27. 2725
  28. 2886
  29. 2962
  30. 3051
  31. 3133
All Critical High Medium Low Exploited only Public exploit

253 results · Clear filters · Feed

  • High 7.1
    CVE-2020-15082

    External control of configuration setting in the dashboard in PrestaShop

    In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fixed in 1.7.6.6

    PrestaShop PrestaShop Web / CMS
  • High 7.5
    CVE-2019-20894

    Improper Authentication

    Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLIENT_AUTH_CERT should have occurred.

    github.com/traefik/traefik/v2 github.com/containous/traefik github.com/containous/traefik/v2 Go
  • High 8.8
    CVE-2020-2211

    RCE vulnerability in ElasticBox Jenkins Kubernetes CI/CD Plugin

    Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

    Jenkins Project Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin com.elasticbox.jenkins-ci.plugins:kubernetes-ci Web / CMS Maven
  • High 7.8
    CVE-2020-7820

    Tobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution Vulnerability

    Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by setting the arguments to the vulnerable API. This can be leveraged for code execution by rebooting the victim’s PC

    Tobesoft NEXACRO14/17 ExCommonApiV13
  • High 7.8
    CVE-2020-7821

    Tobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution Vulnerability

    Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by modifying the value of registry path. This can be leveraged for code execution by rebooting the victim’s PC

    Tobesoft NEXACRO14/17 ExCommonApiV13
  • High 8.1
    CVE-2020-3297

    Cisco Small Business Smart and Managed Switches Session Management Vulnerability

    A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface.…

    Cisco Cisco Small Business 200 Series Smart Switches Network devices
  • High 8.6
    CVE-2020-8161

    Directory traversal in Rack::Directory app bundled with Rack

    A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

    rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  • High 8.4
    CVE-2020-7688

    Command Injection

    The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.

    mversion npm
  • High 7.8
    CVE-2020-12498

    Phoenix Contact Automation Worx <= 1.87: out-of-bounds read remote code execution

    mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

    Phoenix Contact Automation Worx Automation Worx Express ICS / OT
  • High 7.8
    CVE-2020-12497 EPSS 15%

    Phoenix Contact Automation Worx <= 1.87: stack-based overflow

    PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.

    Phoenix Contact Automation Worx Automation Worx Express ICS / OT
  • High 8.8
    CVE-2020-6089

    An exploitable code execution vulnerability exists in the ANI file format parser of Leadtools 20. A specially crafted A…

  • High 7.5
    CVE-2020-4420

    IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauth…

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • High 8.4
    CVE-2020-4363

    IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a bu…

    IBM DB2 for Linux, UNIX and Windows Linux Windows