Low-severity CVEs (page 88)
Page 88 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15637 | Low | 3.3 | 2020-08-20 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is req… |
CVE-2020-9710 | Low | 3.3 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9707 | Low | 3.3 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9706 | Low | 3.3 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-15141 | Low | 3.0 | 2020-08-14 | In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI docume… |
CVE-2020-13282 | Low | 3.1 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to imprope… |
CVE-2020-8905 | Low | 2.8 | 2020-08-12 | A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_re… |
CVE-2020-6653 | Low | 3.8 | 2020-08-12 | Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A… |
CVE-2020-2035 | Low | 3.0 | 2020-08-12 | When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL… |
CVE-2020-8912 | Low | 2.5 | 2020-08-11 | A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted b… |
CVE-2020-16092 | Low | 3.8 | 2020-08-11 | In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious… |
CVE-2020-4243 | Low | 3.7 | 2020-08-05 | IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information using man in the middle… |
CVE-2020-16201 | Low | 3.3 | 2020-08-04 | Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specia… |
CVE-2020-13523 | Low | 3.3 | 2020-08-04 | An exploitable information disclosure vulnerability exists in SoftPerfect’s RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can cau… |
CVE-2020-16116 | Low | 3.3 | 2020-08-03 | In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal. |
CVE-2020-16166 | Low | 3.7 | 2020-07-30 | The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network… |
CVE-2020-15408 | Low | 3.7 | 2020-07-28 | An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web int… |
CVE-2020-15103 | Low | 3.5 | 2020-07-27 | In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The in… |
CVE-2020-9251 | Low | 2.4 | 2020-07-27 | HUAWEI Mate 20 smartphones with versions earlier than 10.1.0.160(C00E160R2P11) have an improper authorization vulnerability. The software does not properly res… |
CVE-2020-9077 | Low | 3.3 | 2020-07-27 | HUAWEI P30 smart phones with versions earlier than 10.1.0.160(C00E160R2P11) have an information exposure vulnerability. The system does not properly authentica… |
CVE-2020-7694 | Low | 3.7 | 2020-07-27 | This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP req… |
CVE-2020-4371 | Low | 3.3 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against t… |
CVE-2020-15859 | Low | 3.3 | 2020-07-21 | QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO a… |
CVE-2020-1776 | Low | 3.5 | 2020-07-20 | When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the cas… |
CVE-2020-9252 | Low | 2.3 | 2020-07-17 | HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8), HUAWEI Mate 20 X versions earlier than 10.1.0.135(C00E135R2P8), HUAWEI Mate 20 RS versions earlie… |
CVE-2020-9102 | Low | 3.3 | 2020-07-17 | There is a information leak vulnerability in some Huawei products, and it could allow a local attacker to get information. The vulnerability is due to the impr… |
CVE-2020-14634 | Low | 2.7 | 2020-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vu… |
CVE-2020-14633 | Low | 2.7 | 2020-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vu… |
CVE-2020-14616 | Low | 2.7 | 2020-07-15 | Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). The supported version… |
CVE-2020-14590 | Low | 2.7 | 2020-07-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Page Request). Supported versions that are affected are 12.1… |
CVE-2020-14581 | Low | 3.7 | 2020-07-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 1… |
CVE-2020-14579 | Low | 3.7 | 2020-07-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u… |
CVE-2020-14578 | Low | 3.7 | 2020-07-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u… |
CVE-2020-14577 | Low | 3.7 | 2020-07-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11… |
CVE-2020-14573 | Low | 3.7 | 2020-07-15 | Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to… |
CVE-2020-14564 | Low | 2.7 | 2020-07-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Environment Mgmt Console). Supported versions that are affected… |
CVE-2020-14548 | Low | 3.4 | 2020-07-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions… |
CVE-2020-14542 | Low | 3.3 | 2020-07-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: libsuri). The supported version that is affected is 11. Easily exploitable vulnerabil… |
CVE-2020-14541 | Low | 2.0 | 2020-07-15 | Vulnerability in the Hyperion Financial Close Management product of Oracle Hyperion (component: Close Manager). The supported version that is affected is 11.1… |
CVE-2020-14533 | Low | 3.5 | 2020-07-15 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that are affected are 11… |
CVE-2020-15101 | Low | 2.8 | 2020-07-14 | In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk()… |
CVE-2020-11083 | Low | 3.5 | 2020-07-14 | In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS… |
CVE-2020-15100 | Low | 2.8 | 2020-07-14 | In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1. |
CVE-2020-6280 | Low | 2.7 | 2020-07-14 | SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise… |
CVE-2020-12025 | Low | 3.3 | 2020-07-14 | Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may allow an at… |
CVE-2020-15469 | Low | 2.3 | 2020-07-02 | In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. |
CVE-2020-4061 | Low | 3.7 | 2020-07-02 | In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a success… |
CVE-2020-2218 | Low | 3.3 | 2020-07-02 | Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewe… |
CVE-2019-4706 | Low | 2.7 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable guidance to an attac… |
CVE-2019-4705 | Low | 2.7 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attac… |
CVE-2020-12039 | Low | 2.4 | 2020-06-29 | Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hard… |
CVE-2020-9558 | Low | 3.3 | 2020-06-26 | Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2020-9553 | Low | 3.3 | 2020-06-26 | Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2020-9626 | Low | 3.3 | 2020-06-26 | Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability. Successful exploitation could lead to information d… |
CVE-2020-14477 | Low | 3.6 | 2020-06-26 | In Philips Ultrasound ClearVue Versions 3.2 and prior, Ultrasound CX Versions 5.0.2 and prior, Ultrasound EPIQ/Affiniti Versions VM5.0 and prior, Ultrasound Sp… |
CVE-2020-3970 | Low | 3.8 | 2020-06-25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and F… |
CVE-2020-15005 | Low | 3.1 | 2020-06-24 | In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image autho… |
CVE-2020-4071 | Low | 2.2 | 2020-06-24 | In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASIC_A… |
CVE-2020-4033 | Low | 3.1 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. T… |
CVE-2020-4032 | Low | 3.1 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks ar… |
CVE-2020-4031 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affec… |
CVE-2020-4030 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fix… |
CVE-2020-11099 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of… |
CVE-2020-11098 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is… |
CVE-2020-11097 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PR… |
CVE-2020-11096 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-ca… |
CVE-2020-11095 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PR… |
CVE-2020-4066 | Low | 3.8 | 2020-06-22 | In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they mig… |
CVE-2016-11077 | Low | 2.7 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of… |
CVE-2020-3972 | Low | 3.3 | 2020-06-19 | VMware Tools for macOS (11.x.x and prior before 11.1.1) contains a denial-of-service vulnerability in the Host-Guest File System (HGFS) implementation. Success… |
CVE-2018-21260 | Low | 2.7 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations… |
CVE-2018-21249 | Low | 3.7 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing. |
CVE-2019-13033 | Low | 3.3 | 2020-06-18 | In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be us… |
CVE-2020-6752 | Low | 3.8 | 2020-06-17 | In OMERO before 5.6.1, group owners can access members' data in other groups. |
CVE-2020-4053 | Low | 3.7 | 2020-06-16 | In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It i… |
CVE-2020-4051 | Low | 3.7 | 2020-06-15 | In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and great… |
CVE-2017-18869 | Low | 2.5 | 2020-06-15 | A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via sy… |
CVE-2020-4050 | Low | 3.5 | 2020-06-12 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an ad… |
CVE-2020-4049 | Low | 2.4 | 2020-06-12 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-a… |
CVE-2020-10732 | Low | 3.3 | 2020-06-12 | A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and… |
CVE-2020-12023 | Low | 2.0 | 2020-06-11 | Philips IntelliBridge Enterprise (IBE), Versions B.12 and prior, IntelliBridge Enterprise system integration with SureSigns (VS4), EarlyVue (VS30) and IntelliV… |
CVE-2020-2023 | Low | 3.8 | 2020-06-10 | Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on… |
CVE-2020-9848 | Low | 2.4 | 2020-06-09 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5. A person with physical access to an iOS d… |
CVE-2020-1775 | Low | 3.5 | 2020-06-08 | BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior… |
CVE-2020-13838 | Low | 3.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The DeX Lockscreen feature does not block access to Quick Panel and notific… |
CVE-2020-13837 | Low | 3.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with Q(10.0) software. The Lockscreen feature does not block Quick Panel access to Music Share. The Samsung I… |
CVE-2020-11080 | Low | 3.7 | 2020-06-03 | In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious cli… |
CVE-2020-5297 | Low | 3.4 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp… |
CVE-2020-3322 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-3321 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-3319 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-13659 | Low | 2.5 | 2020-06-02 | address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. |
CVE-2020-1831 | Low | 2.4 | 2020-05-29 | HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.195(SP31C00E74R3P8) have an improper authorization vulnerability. The digital balance function doe… |
CVE-2020-3959 | Low | 3.3 | 2020-05-29 | VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), VMware Workstation (15.x before 15.1.0) and VMware Fusion (11.x before 11.1… |
CVE-2020-1833 | Low | 2.4 | 2020-05-29 | Honor 9X smartphones with versions earlier than 9.1.1.172(C00E170R8P1) have an improper authentication vulnerability. A logic error occurs when handling clock… |
CVE-2020-1797 | Low | 2.4 | 2020-05-29 | HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. The system does not properly restric… |
CVE-2020-11089 | Low | 3.7 | 2020-05-29 | In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, print… |
CVE-2020-11088 | Low | 3.1 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. |
CVE-2020-11087 | Low | 3.1 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0. |
CVE-2020-11086 | Low | 3.1 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an intern… |