Skip to content
OpenAdvisories

Archive

July 2020

Vulnerabilities first published in this month (UTC), newest first.

← June 2020 2020 / July August 2020 →
  1. 171
  2. 254
  3. 311
  4. 41
  5. 513
  6. 628
  7. 770
  8. 818
  9. 951
  10. 1024
  11. 11 
  12. 12 
  13. 1320
  14. 14194
  15. 15278
  16. 1663
  17. 1773
  18. 18 
  19. 19 
  20. 2036
  21. 2118
  22. 2274
  23. 2341
  24. 2428
  25. 255
  26. 26 
  27. 2725
  28. 2886
  29. 2962
  30. 3051
  31. 3133
All Critical High Medium Low Exploited only Public exploit

1,428 results · Feed

  • Unscored —
    CVE-2020-15912

    Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC…

  • Unscored —
    CVE-2020-11440

    httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root.

  • Medium 6.1
    CVE-2020-15881

    MunkiReport munki_facts module Cross-Site Scripting (XSS) vulnerability

    A Cross-Site Scripting (XSS) vulnerability in the munki_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the key name.

    munkireport/munki_facts Packagist
  • Unscored —
    CVE-2020-15882

    A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines f…

  • Medium 6.1
    CVE-2020-15883

    MunkiReport Managed Installs module Reflected Cross-Site Scripting (XSS) vulnerability

    A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reporte…

    munkireport/managedinstalls Packagist
  • Unscored —
    CVE-2020-15884

    A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL c…

  • Medium 5.4
    CVE-2020-15885

    MunkiReport Cross-Site Scripting (XSS) Filter Bypass On Comment

    A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment.

    munkireport/comment Packagist
  • High 8.8
    CVE-2020-15886

    MunkiReport reportdata module SQL injection vulnerability

    A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute arbitrary SQL commands via the req parameter of the /module/reportdata/ip endpoint.

    munkireport/reportdata Packagist
  • High 8.8
    CVE-2020-15887

    MunkiReport Software Update module is vulnerable to SQL injection

    A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint.

    munkireport/softwareupdate Packagist
  • Unscored —
    CVE-2020-15688

    The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attack…

  • Unscored —
    CVE-2020-15908

    tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction fr…

  • Medium 6.5
    CVE-2020-15126

    Information disclosure through Viewer query in parse-server

    In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.

    parse-community parse-server parse-server npm
  • Critical 9.8
    CVE-2020-10917

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of NEC ESMPRO Manager 6.…

    NEC ESMPRO Manager
  • High 7.8
    CVE-2020-15904

    bsdiff4 out-of-bounds write via patch file

    A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.

    bsdiff4 PyPI
  • Unscored —
    CVE-2020-15901 EPSS 22%

    In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsu…

  • Unscored —
    CVE-2020-15902 EPSS 35%

    Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.

  • High 7.5
    CVE-2020-4400

    IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker …

    IBM Verify Gateway (IVG)
  • Medium 6.5
    CVE-2020-4399

    IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could allow an authenticated user to send malformed requests to cause a denial…

    IBM Verify Gateway (IVG)
  • Medium 6.8
    CVE-2020-4397

    IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an at…

    IBM Verify Gateway (IVG)
  • Medium 6.2
    CVE-2020-4372

    IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local us…

    IBM Verify Gateway (IVG)
  • Medium 6.8
    CVE-2020-4385

    IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, whic…

    IBM Verify Gateway (IVG)
  • Medium 4.0
    CVE-2020-4371

    IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a…

    IBM Verify Gateway (IVG)
  • Medium 5.1
    CVE-2020-4369

    IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a u…

    IBM Verify Gateway (IVG)
  • High 7.5
    CVE-2020-3452 Exploited Public exploit Scanner template EPSS 100%

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

    A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files…

    Cisco Cisco Adaptive Security Appliance (ASA) Software Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-9664

    Magento php object injection vulnerability

    Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.

    Adobe Magento magento/core Web / CMS Packagist
  • Medium 6.1
    CVE-2020-9665

    Magento stored cross-site scripting vulnerability

    Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

    Adobe Magento magento/core Web / CMS Packagist
  • Unscored —
    CVE-2020-9663

    Adobe Reader Mobile versions 20.0.1 and earlier have a directory traversal vulnerability. Successful exploitation could…

    Adobe Adobe Reader Mobile
  • Unscored —
    CVE-2020-9680

    Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to…

    Adobe Adobe Prelude
  • Unscored —
    CVE-2020-9678

    Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to…

    Adobe Adobe Prelude
  • Unscored —
    CVE-2020-9677

    Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to …

    Adobe Adobe Prelude
  • Unscored —
    CVE-2020-9679

    Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to …

    Adobe Adobe Prelude
  • Unscored —
    CVE-2020-9683

    Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Successful exp…

    Adobe Adobe Photoshop
  • Unscored —
    CVE-2020-9685

    Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Successful ex…

    Adobe Adobe Photoshop
  • Unscored —
    CVE-2020-9687

    Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Successful ex…

    Adobe Adobe Photoshop
  • Unscored —
    CVE-2020-9686

    Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Successful exp…

    Adobe Adobe Photoshop
  • Unscored —
    CVE-2020-9684

    Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Successful ex…

    Adobe Adobe Photoshop
  • High 7.8
    CVE-2020-9675

    Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead t…

    Adobe Adobe Bridge
  • High 7.8
    CVE-2020-9674

    Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead …

    Adobe Adobe Bridge
  • High 7.8
    CVE-2020-9676

    Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead …

    Adobe Adobe Bridge
  • Unscored —
    CVE-2020-15892

    An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login …