Low-severity CVEs (page 86)
Page 86 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-23250 | Low | 2.3 | 2021-01-05 | GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database. |
CVE-2020-26292 | Low | 3.1 | 2021-01-04 | Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary re… |
CVE-2020-4919 | Low | 3.8 | 2021-01-04 | IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system. IBM X-F… |
CVE-2020-11947 | Low | 3.8 | 2020-12-31 | iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker. |
CVE-2020-26247 | Low | 2.6 | 2020-12-30 | Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE v… |
CVE-2020-35448 | Low | 3.3 | 2020-12-27 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occu… |
CVE-2020-2505 | Low | 2.3 | 2020-12-24 | If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in Q… |
CVE-2020-27336 | Low | 3.7 | 2020-12-22 | An issue was discovered in Treck IPv6 before 6.0.1.68. Improper input validation in the IPv6 component when handling a packet sent by an unauthenticated remote… |
CVE-2020-26422 | Low | 3.7 | 2020-12-21 | Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file |
CVE-2020-26173 | Low | 3.1 | 2020-12-18 | An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid docume… |
CVE-2020-24693 | Low | 3.3 | 2020-12-18 | The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow a local attacker to view system information due to insufficient output sanitiza… |
CVE-2020-4846 | Low | 2.7 | 2020-12-17 | IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retur… |
CVE-2020-4906 | Low | 3.3 | 2020-12-16 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to be stored locally which can be read by another user on the sy… |
CVE-2020-4008 | Low | 3.6 | 2020-12-16 | The installer of the macOS Sensor for VMware Carbon Black Cloud (prior to 3.5.1) handles certain files in an insecure way. A malicious actor who has local acce… |
CVE-2020-29480 | Low | 2.3 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest admini… |
CVE-2020-27057 | Low | 3.3 | 2020-12-15 | In getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission bypass due to a missing permission check. This could lead to… |
CVE-2020-27056 | Low | 3.3 | 2020-12-15 | In SELinux policies of mls, there is a missing permission check. This could lead to local information disclosure of package metadata with no additional executi… |
CVE-2020-0481 | Low | 3.3 | 2020-12-15 | In AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a non-system app to send a broadcast… |
CVE-2020-0368 | Low | 3.3 | 2020-12-15 | In queryInternal of CallLogProvider.java, there is a possible permission bypass due to improper input validation. This could lead to local information disclosu… |
CVE-2020-0459 | Low | 3.3 | 2020-12-14 | In sendConfiguredNetworkChangedBroadcast of WifiConfigManager.java, there is a possible leak of sensitive WiFi configuration data due to a missing permission c… |
CVE-2020-8284 | Low | 3.7 | 2020-12-14 | A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially… |
CVE-2020-26420 | Low | 3.1 | 2020-12-11 | Memory leak in RTPS protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file. |
CVE-2020-26419 | Low | 3.1 | 2020-12-11 | Memory leak in the dissection engine in Wireshark 3.4.0 allows denial of service via packet injection or crafted capture file. |
CVE-2020-26418 | Low | 3.1 | 2020-12-11 | Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file. |
CVE-2020-28838 | Low | 3.5 | 2020-12-11 | Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart. |
CVE-2020-26412 | Low | 3.1 | 2020-12-11 | Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2. |
CVE-2020-8908 | Low | 3.3 | 2020-12-10 | A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a tempor… |
CVE-2020-8920 | Low | 3.5 | 2020-12-10 | An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the Filter… |
CVE-2020-8919 | Low | 3.5 | 2020-12-10 | An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST AP… |
CVE-2020-29668 | Low | 3.7 | 2020-12-10 | Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie… |
CVE-2020-27351 | Low | 2.0 | 2020-12-10 | Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affec… |
CVE-2020-17097 | Low | 3.3 | 2020-12-10 | Windows Digital Media Receiver Elevation of Privilege Vulnerability |
CVE-2020-16128 | Low | 3.8 | 2020-12-09 | The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-2020-196. This affect… |
CVE-2020-27758 | Low | 3.3 | 2020-12-08 | A flaw was found in ImageMagick in coders/txt.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in th… |
CVE-2020-27757 | Low | 3.3 | 2020-12-08 | A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the r… |
CVE-2020-27755 | Low | 3.3 | 2020-12-08 | in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size… |
CVE-2020-27754 | Low | 3.3 | 2020-12-08 | In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick proc… |
CVE-2020-27751 | Low | 3.3 | 2020-12-08 | A flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined… |
CVE-2020-25675 | Low | 3.3 | 2020-12-08 | In the CropImage() and CropImageToTiles() routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsets was causing undefi… |
CVE-2020-27895 | Low | 3.3 | 2020-12-08 | An information disclosure issue existed in the transition of program state. This issue was addressed with improved state handling. This issue is fixed in iTune… |
CVE-2020-25666 | Low | 3.3 | 2020-12-08 | There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations. This occurs in the rg… |
CVE-2020-27818 | Low | 3.3 | 2020-12-08 | A flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be processed by pngcheck could cause a temp… |
CVE-2020-27773 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined be… |
CVE-2020-27772 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in th… |
CVE-2020-27776 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined beha… |
CVE-2020-27775 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavi… |
CVE-2020-27774 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined beha… |
CVE-2020-27771 | Low | 3.3 | 2020-12-04 | In RestoreMSCWarning() of /coders/pdf.c there are several areas where calls to GetPixelIndex() could result in values outside the range of representable for th… |
CVE-2020-27767 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavi… |
CVE-2020-27765 | Low | 3.3 | 2020-12-04 | A flaw was found in ImageMagick in MagickCore/segment.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavi… |
CVE-2020-28923 | Low | 2.7 | 2020-12-03 | An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects us… |
CVE-2020-27764 | Low | 3.3 | 2020-12-03 | In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() where a size_t cast should have been a ssize_t cast, which causes out-of-range v… |
CVE-2020-27763 | Low | 3.3 | 2020-12-03 | A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavio… |
CVE-2020-27761 | Low | 3.3 | 2020-12-03 | WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsi… |
CVE-2020-27759 | Low | 3.3 | 2020-12-03 | In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value outside the range of t… |
CVE-2020-25723 | Low | 3.2 | 2020-12-02 | A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memor… |
CVE-2020-11990 | Low | 3.3 | 2020-12-01 | We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead… |
CVE-2020-11867 | Low | 3.3 | 2020-11-30 | Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to… |
CVE-2020-6317 | Low | 3.5 | 2020-11-30 | In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive information which appears… |
CVE-2020-29374 | Low | 3.6 | 2020-11-28 | An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for… |
CVE-2020-29371 | Low | 3.3 | 2020-11-28 | An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd. |
CVE-2020-27746 | Low | 3.7 | 2020-11-27 | Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race c… |
CVE-2020-29042 | Low | 3.7 | 2020-11-26 | An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that… |
CVE-2020-26229 | Low | 3.7 | 2020-11-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML e… |
CVE-2020-25688 | Low | 3.5 | 2020-11-23 | A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the sour… |
CVE-2020-15249 | Low | 2.8 | 2020-11-23 | October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, ba… |
CVE-2020-6879 | Low | 3.5 | 2020-11-19 | Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of t… |
CVE-2020-13350 | Low | 3.1 | 2020-11-17 | CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runne… |
CVE-2020-13353 | Low | 2.5 | 2020-11-17 | When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. |
CVE-2020-13352 | Low | 3.7 | 2020-11-17 | Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10… |
CVE-2020-24366 | Low | 3.3 | 2020-11-16 | Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups. |
CVE-2019-19563 | Low | 2.4 | 2020-11-16 | A misconfiguration in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with direct physical access to device hardware to obtain cellular mode… |
CVE-2019-19561 | Low | 2.4 | 2020-11-16 | A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular mode… |
CVE-2019-19557 | Low | 2.4 | 2020-11-16 | A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem… |
CVE-2020-4886 | Low | 3.3 | 2020-11-13 | IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system… |
CVE-2020-2048 | Low | 3.3 | 2020-11-12 | An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed… |
CVE-2020-26220 | Low | 3.5 | 2020-11-11 | toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain i… |
CVE-2020-8352 | Low | 2.4 | 2020-11-11 | In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes. |
CVE-2020-17020 | Low | 3.3 | 2020-11-11 | Microsoft Word Security Feature Bypass Vulnerability |
CVE-2020-16127 | Low | 2.8 | 2020-11-11 | An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations… |
CVE-2020-16126 | Low | 3.3 | 2020-11-11 | An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing u… |
CVE-2020-26807 | Low | 3.3 | 2020-11-10 | SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder which allows anyone t… |
CVE-2020-4650 | Low | 3.3 | 2020-11-09 | IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the syste… |
CVE-2020-24406 | Low | 3.7 | 2020-11-09 | When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installat… |
CVE-2020-24404 | Low | 2.7 | 2020-11-09 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability co… |
CVE-2020-24403 | Low | 2.7 | 2020-11-09 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability… |
CVE-2020-16121 | Low | 3.3 | 2020-11-07 | PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be u… |
CVE-2020-24439 | Low | 2.8 | 2020-11-05 | Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security fea… |
CVE-2020-24438 | Low | 3.3 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnera… |
CVE-2020-24434 | Low | 3.3 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vu… |
CVE-2020-24427 | Low | 3.3 | 2020-11-05 | Acrobat Reader versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an input validation vulnera… |
CVE-2020-24426 | Low | 3.3 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vu… |
CVE-2018-1725 | Low | 2.3 | 2020-11-05 | IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440. |
CVE-2019-4349 | Low | 3.5 | 2020-11-03 | IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 applications can be installed on a deprecated operating system version that could compromised the co… |
CVE-2020-8173 | Low | 2.2 | 2020-11-02 | A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended. |
CVE-2020-25374 | Low | 2.6 | 2020-10-28 | CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle t… |
CVE-2020-9786 | Low | 3.3 | 2020-10-27 | This issue was addressed with improved checks This issue is fixed in macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-002 High Sie… |
CVE-2019-8857 | Low | 3.3 | 2020-10-27 | The issue was addressed with improved validation when an iCloud Link is created. This issue is fixed in iOS 13.3 and iPadOS 13.3. Live Photo audio and video da… |
CVE-2019-8856 | Low | 3.3 | 2020-10-27 | An API issue existed in the handling of outgoing phone calls initiated with Siri. This issue was addressed with improved state handling. This issue is fixed in… |
CVE-2019-8842 | Low | 3.3 | 2020-10-27 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Upd… |