Skip to content
OpenAdvisories

Archive

July 2020

Vulnerabilities first published in this month (UTC), newest first.

← June 2020 2020 / July August 2020 →
  1. 171
  2. 254
  3. 311
  4. 41
  5. 513
  6. 628
  7. 770
  8. 818
  9. 951
  10. 1024
  11. 11 
  12. 12 
  13. 1320
  14. 14194
  15. 15278
  16. 1663
  17. 1773
  18. 18 
  19. 19 
  20. 2036
  21. 2118
  22. 2274
  23. 2341
  24. 2428
  25. 255
  26. 26 
  27. 2725
  28. 2886
  29. 2962
  30. 3051
  31. 3133
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 6.5
    CVE-2020-10923 Public exploit EPSS 85%

    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R670…

    NETGEAR R6700 Network devices
  • Medium 5.4
    CVE-2020-8558 Public exploit

    Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

    The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network …

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  • Medium 5.4
    CVE-2020-11110 Public exploit

    Grafana stored XSS

    Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

    grafana github.com/grafana/grafana Ubuntu Go
  • Medium 5.5
    CVE-2020-8175 Public exploit

    Uncontrolled resource consumption in jpeg-js

    Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.

    jpeg-js npm
  • Medium 6.4
    CVE-2020-8559 Public exploit

    Privilege escalation from compromised node to cluster

    The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a ful…

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Alpine Go
  • Medium 6.5
    CVE-2020-15873 Public exploit

    LibreNMS SQL Injection vulnerability

    In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php.

    librenms/librenms Packagist
  • Medium 6.1
    CVE-2020-7680 Public exploit

    Cross-site Scripting in docsify

    docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after th…

    docsify npm
  • Medium 4.3
    CVE-2020-12027 Public exploit EPSS 53%

    Rockwell Automation FactoryTalk View SE

    All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacker may be able to leverage this information for reconnaissance efforts. Rockwell Automation recommends enabling built …

    Rockwell Automation FactoryTalk® View SE ICS / OT
  • Medium 6.6
    CVE-2020-2969 Public exploit

    Vulnerability in the Data Pump component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, …

    Oracle Oracle Database
  • Medium 4.1
    CVE-2020-2978 Public exploit

    Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server. Supported versions that …

    Oracle Oracle Database
  • Medium 5.3
    CVE-2020-6286 Public exploit EPSS 24%

    The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configurati…

    SAP_SE SAP NetWeaver AS JAVA (LM Configuration Wizard)
  • Medium 6.5
    CVE-2020-8193 Exploited Public exploit EPSS 88%

    Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…

    KEV Nov 3, 2021
  • Medium 5.3
    CVE-2020-7693 Public exploit

    Denial of Service (DoS)

    Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.

    sockjs npm
  • Medium 6.5
    CVE-2019-14900 Public exploit

    SQL Injection in Hibernate ORM

    A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw c…

    org.hibernate:hibernate-core Maven
  • Medium 6.1
    CVE-2020-15500 Public exploit EPSS 12%

    Cross-site scripting in TileServer GL

    An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.

    tileserver-gl npm