Lista CVE - 2020 / Giugno
Visualizzazione 601 - 700 di 1807 CVE per Giugno 2020 (Pagina 7 di 19)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2020-1322 | 2020-06-09 | An information disclosure vulnerability exists when Microsoft Project reads out of bound memory due to an uninitialized variable, aka 'Microsoft Project Information Disclosure Vulnerability'. |
| CVE-2020-1323 | 2020-06-09 | An open redirect vulnerability exists in Microsoft SharePoint that could lead to spoofing.To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince... |
| CVE-2020-1324 | 2020-06-09 | An elevation of privilege (user to user) vulnerability exists in Windows Security Health Service when handling certain objects in memory.To exploit the vulnerability, an attacker would first have to log... |
| CVE-2020-1327 | 2020-06-09 | A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'. |
| CVE-2020-1329 | 2020-06-09 | A spoofing vulnerability exists when Microsoft Bing Search for Android improperly handles specific HTML content, aka 'Microsoft Bing Search Spoofing Vulnerability'. |
| CVE-2020-1331 | 2020-06-09 | A spoofing vulnerability exists when System Center Operations Manager (SCOM) does not properly sanitize a specially crafted web request to an affected SCOM instance, aka 'System Center Operations Manager Spoofing... |
| CVE-2020-1334 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1231, CVE-2020-1233,... |
| CVE-2020-1340 | 2020-06-09 | A spoofing vulnerability exists when the NuGetGallery does not properly sanitize input on package metadata values, aka 'NuGetGallery Spoofing Vulnerability'. |
| CVE-2020-1343 | 2020-06-09 | An information disclosure vulnerability exists in Visual Studio Code Live Share Extension when it exposes tokens in plain text, aka 'Visual Studio Code Live Share Information Disclosure Vulnerability'. |
| CVE-2020-1348 | 2020-06-09 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. |
| CVE-2019-6173 | 2020-06-09 | A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during installation if an attacker already has administrative privileges. |
| CVE-2019-6196 | 2020-06-09 | A symbolic link vulnerability in some Lenovo installation packages, prior to version 1.2.9.3, could allow privileged file operations during file extraction and installation. |
| CVE-2020-8320 | 2020-06-09 | An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege. |
| CVE-2020-8321 | 2020-06-09 | A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code execution. |
| CVE-2020-8322 | 2020-06-09 | A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code execution. |
| CVE-2020-8323 | 2020-06-09 | A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStation, and Lenovo Notebook models may allow arbitrary code execution. |
| CVE-2020-8334 | 2020-06-09 | The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T495s, X395, T495, A485, A285, A475, A275 which may allow for unauthorized access. |
| CVE-2020-8336 | 2020-06-09 | Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to prevent roll back of CSME Firmware in flash. |
| CVE-2020-8337 | 2020-06-09 | An unquoted search path vulnerability was reported in versions prior to 1.0.83.0 of the Synaptics Smart Audio UWP app associated with the DCHU audio drivers on Lenovo platforms that could... |
| CVE-2020-13996 | 2020-06-09 | The J2Store plugin before 3.3.13 for Joomla! allows a SQL injection attack by a trusted store manager. |
| CVE-2020-11798 | 2020-06-10 | A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories... |
| CVE-2020-7580 | 2020-06-10 | A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software... |
| CVE-2019-3617 | 2020-06-10 | Privilege escalation in ToPS for Mac |
| CVE-2019-3613 | 2020-06-10 | DLL search order hijacking in MA |
| CVE-2020-7279 | 2020-06-10 | DLL search order hijacking in Host IPS |
| CVE-2019-3585 | 2020-06-10 | VSE Escalation of Privileges through Alert pop-up window |
| CVE-2019-3588 | 2020-06-10 | Using VSE to bypass Windows Credentials on Lock screen |
| CVE-2020-7280 | 2020-06-10 | Symbolic Link vulnerability during DAT update |
| CVE-2020-6239 | 2020-06-10 | Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure. |
| CVE-2020-6246 | 2020-06-10 | SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in... |
| CVE-2020-6268 | 2020-06-10 | Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) does not execute... |
| CVE-2020-6270 | 2020-06-10 | SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated user due... |
| CVE-2020-6269 | 2020-06-10 | Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure. |
| CVE-2020-6271 | 2020-06-10 | SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of memory, causing the system to crash and read... |
| CVE-2020-6275 | 2020-06-10 | SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker... |
| CVE-2020-6260 | 2020-06-10 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation. The application shows additional... |
| CVE-2020-6263 | 2020-06-10 | Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11,... |
| CVE-2020-6264 | 2020-06-10 | SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leading to Information Disclosure. |
| CVE-2020-6266 | 2020-06-10 | SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL validation, leading to URL Redirection. |
| CVE-2019-4576 | 2020-06-10 | IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Patch 1 and 7.4.0 GA does not require that users should have strong passwords by default, which makes it easier for attackers... |
| CVE-2020-4432 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API.... |
| CVE-2020-4433 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute... |
| CVE-2020-4434 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute... |
| CVE-2020-4435 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate knowledge of the system to execute arbitrary code... |
| CVE-2020-4436 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service.... |
| CVE-2020-13271 | 2020-06-10 | A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1 |
| CVE-2020-13267 | 2020-06-10 | A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1 |
| CVE-2020-13268 | 2020-06-10 | A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerability affects GitLab CE/EE 12.10 and later... |
| CVE-2020-13270 | 2020-06-10 | Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API |
| CVE-2020-13269 | 2020-06-10 | A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1 |
| CVE-2020-7670 | 2020-06-10 | agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might... |
| CVE-2020-7671 | 2020-06-10 | goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks... |
| CVE-2020-7672 | 2020-06-10 | mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution. |
| CVE-2020-7673 | 2020-06-10 | node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in... |
| CVE-2020-7674 | 2020-06-10 | access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the `template` function is executed by the `eval` function resulting in code execution. |
| CVE-2020-7675 | 2020-06-10 | cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the `color` argument executed by the `eval` function resulting in code execution. |
| CVE-2020-10755 | 2020-06-10 | An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder... |
| CVE-2020-7585 | 2020-06-10 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC... |
| CVE-2020-7586 | 2020-06-10 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC... |
| CVE-2020-7589 | 2020-06-10 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions). The vulnerability could lead to an attacker reading and modifying the device configuration and obtain project... |
| CVE-2020-0114 | 2020-06-10 | In onCreateSliceProvider of KeyguardSliceProvider.java, there is a possible confused deputy due to a PendingIntent error. This could lead to local escalation of privilege that allows actions performed as the System... |
| CVE-2020-0121 | 2020-06-10 | In updateUidProcState of AppOpsService.java, there is a possible permission bypass due to a logic error. This could lead to local information disclosure of location data with User execution privileges needed.... |
| CVE-2020-0115 | 2020-06-10 | In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This could lead to local escalation of privilege with... |
| CVE-2020-0119 | 2020-06-10 | In addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no... |
| CVE-2020-0118 | 2020-06-10 | In addListener of RegionSamplingThread.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges... |
| CVE-2020-0113 | 2020-06-10 | In sendCaptureResult of Camera3OutputUtils.cpp, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges... |
| CVE-2020-0117 | 2020-06-10 | In aes_cmac of aes_cmac.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution in the bluetooth server with no... |
| CVE-2020-0116 | 2020-06-10 | In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges... |
| CVE-2020-14010 | 2020-06-10 | The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter. |
| CVE-2020-2026 | 2020-06-10 | Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path |
| CVE-2020-2027 | 2020-06-10 | PAN-OS: Buffer overflow in authd authentication response |
| CVE-2020-2028 | 2020-06-10 | PAN-OS: OS command injection vulnerability in FIPS-CC mode certificate verification |
| CVE-2020-2029 | 2020-06-10 | PAN-OS: OS command injection vulnerability in management interface certificate generator |
| CVE-2020-2032 | 2020-06-10 | GlobalProtect App: File race condition vulnerability leads to local privilege escalation during upgrade |
| CVE-2020-2033 | 2020-06-10 | GlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookie |
| CVE-2020-2023 | 2020-06-10 | Kata Containers - Containers have access to the guest root filesystem device |
| CVE-2020-14012 | 2020-06-10 | scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description. The attacker must be an Agent. |
| CVE-2020-13445 | 2020-06-10 | In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict... |
| CVE-2020-13444 | 2020-06-10 | Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned... |
| CVE-2020-13905 | 2020-06-10 | IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000038ed4. |
| CVE-2020-13906 | 2020-06-10 | IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000038eb7. |
| CVE-2020-13223 | 2020-06-10 | HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2. |
| CVE-2020-12757 | 2020-06-10 | HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured... |
| CVE-2020-10705 | 2020-06-10 | A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially... |
| CVE-2020-4043 | 2020-06-10 | Phar unserialization vulnerability in phpMussel |
| CVE-2020-13238 | 2020-06-10 | Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the network, because this denial of service attack... |
| CVE-2020-11622 | 2020-06-10 | A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.22.x train, 4.21.3M to 4.21.9M releases... |
| CVE-2020-5362 | 2020-06-10 | Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which an unauthorized actor, with local system access with OS administrator privileges, could... |
| CVE-2020-5363 | 2020-06-10 | Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin... |
| CVE-2020-13898 | 2020-06-10 | An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_process in sdp.c has a NULL pointer dereference. |
| CVE-2020-13899 | 2020-06-10 | An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_process_incoming_request in janus.c discloses information from uninitialized stack memory. |
| CVE-2020-13900 | 2020-06-10 | An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_preparse in sdp.c has a NULL pointer dereference. |
| CVE-2020-13901 | 2020-06-10 | An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_merge in sdp.c has a stack-based buffer overflow. |
| CVE-2020-11090 | 2020-06-11 | Uncontrolled Resource Consumption in Indy Node |
| CVE-2020-12713 | 2020-06-11 | An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger 1.1.1 through 3.1.1-0. Attackers with administrative access to the web interface have... |
| CVE-2020-12714 | 2020-06-11 | An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger Virtual Appliances 1.1.1 through 3.1.1-0. A Diffie-Hellman... |
| CVE-2020-12850 | 2020-06-11 | The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0.3) have a looser policy restriction... |
| CVE-2020-13998 | 2020-06-11 | Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA error page only occurs after a... |
| CVE-2020-13850 | 2020-06-11 | Artica Pandora FMS 7.44 has inadequate access controls on a web folder. |
| CVE-2020-13855 | 2020-06-11 | Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature. |