Low-severity CVEs (page 89)
Page 89 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11043 | Low | 2.2 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset. Invalid data fed to RFX decoder results in garbage on sc… |
CVE-2020-11040 | Low | 2.2 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This ha… |
CVE-2020-11041 | Low | 2.2 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse… |
CVE-2020-4248 | Low | 2.7 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message i… |
CVE-2020-13362 | Low | 3.2 | 2020-05-28 | In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. |
CVE-2020-13361 | Low | 3.9 | 2020-05-28 | In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out… |
CVE-2020-12394 | Low | 3.3 | 2020-05-26 | A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing… |
CVE-2020-4345 | Low | 3.3 | 2020-05-17 | IBM i 7.2, 7.3, and 7.4 users running complex SQL statements under a specific set of circumstances may allow a local user to obtain sensitive information that… |
CVE-2020-11526 | Low | 2.2 | 2020-05-15 | libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read. |
CVE-2020-11525 | Low | 2.2 | 2020-05-15 | libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read. |
CVE-2020-9073 | Low | 2.4 | 2020-05-15 | Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability. The vulnerability is due to that when… |
CVE-2020-11931 | Low | 3.3 | 2020-05-15 | An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restri… |
CVE-2020-11063 | Low | 3.7 | 2020-05-13 | In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. Th… |
CVE-2020-1993 | Low | 3.7 | 2020-05-13 | The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an at… |
CVE-2020-11932 | Low | 2.3 | 2020-05-13 | It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered. |
CVE-2020-11058 | Low | 2.2 | 2020-05-12 | In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a man… |
CVE-2020-5833 | Low | 3.3 | 2020-05-11 | Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to an out of bounds vulnerability, which is a type of issue that results in an existing… |
CVE-2020-12755 | Low | 3.3 | 2020-05-09 | fishProtocol::establishConnection in fish/fish.cpp in KDE kio-extras through 20.04.0 makes a cacheAuthentication call even if the user had not set the keepPass… |
CVE-2020-11054 | Low | 3.5 | 2020-05-07 | In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qut… |
CVE-2020-11048 | Low | 2.2 | 2020-05-07 | In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed i… |
CVE-2020-11045 | Low | 2.2 | 2020-05-07 | In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The… |
CVE-2020-11044 | Low | 2.2 | 2020-05-07 | In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipu… |
CVE-2019-4266 | Low | 2.4 | 2020-05-06 | IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 does not have device jailbreak detection which could result in an attacker gaining sensitive informa… |
CVE-2020-10717 | Low | 3.3 | 2020-05-04 | A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant to share a… |
CVE-2020-5893 | Low | 3.7 | 2020-04-30 | In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication request… |
CVE-2020-12251 | Low | 2.2 | 2020-04-29 | An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an authenticated user to change the filename value (in the POST method) f… |
CVE-2019-15790 | Low | 2.8 | 2020-04-28 | Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs t… |
CVE-2020-11869 | Low | 3.3 | 2020-04-27 | An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/displ… |
CVE-2020-9488 | Low | 3.7 | 2020-04-27 | Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-mid… |
CVE-2020-1807 | Low | 3.5 | 2020-04-27 | HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.188(C00E74R3P8) have an improper authorization vulnerability. The software does not properly restr… |
CVE-2020-11810 | Low | 3.7 | 2020-04-27 | An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such pack… |
CVE-2020-6824 | Low | 2.8 | 2020-04-24 | Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequ… |
CVE-2020-10905 | Low | 3.3 | 2020-04-22 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is req… |
CVE-2020-10903 | Low | 3.3 | 2020-04-22 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is req… |
CVE-2020-10901 | Low | 3.3 | 2020-04-22 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is req… |
CVE-2020-10894 | Low | 3.3 | 2020-04-22 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is req… |
CVE-2020-11692 | Low | 2.7 | 2020-04-22 | In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators. |
CVE-2020-11686 | Low | 2.7 | 2020-04-22 | In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings. |
CVE-2020-5301 | Low | 3.0 | 2020-04-21 | SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in `SimpleSAML\Module` that processes requests for… |
CVE-2017-18819 | Low | 3.3 | 2020-04-21 | NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect configuration of security settings. |
CVE-2017-18824 | Low | 3.3 | 2020-04-20 | Certain NETGEAR devices are affected by directory traversal. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2… |
CVE-2019-20648 | Low | 3.5 | 2020-04-15 | NETGEAR RN42400 devices before 6.10.2 are affected by incorrect configuration of security settings. |
CVE-2020-2933 | Low | 2.2 | 2020-04-15 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 5.1.48 and prior. Difficult to… |
CVE-2020-2922 | Low | 3.7 | 2020-04-15 | Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8… |
CVE-2020-2909 | Low | 2.8 | 2020-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior t… |
CVE-2020-2900 | Low | 3.7 | 2020-04-15 | Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: Tools). Supported versions that are affected are 19.3.1 and 20.0.0… |
CVE-2020-2778 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit… |
CVE-2020-2773 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u251, 8u241… |
CVE-2020-2771 | Low | 2.5 | 2020-04-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Whodo). Supported versions that are affected are 10 and 11. Difficult to exploit vuln… |
CVE-2020-2769 | Low | 2.4 | 2020-04-15 | Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion (component: Web Based Report Designer). The supported version that is affected is… |
CVE-2020-2764 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE product of Oracle Java SE (component: Advanced Management Console). The supported version that is affected is Java Advanced Manage… |
CVE-2020-2757 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8… |
CVE-2020-2756 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8… |
CVE-2020-2755 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0… |
CVE-2020-2754 | Low | 3.7 | 2020-04-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0… |
CVE-2020-2749 | Low | 2.5 | 2020-04-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: SMF command svcbundle). The supported version that is affected is 11. Difficult to ex… |
CVE-2020-2748 | Low | 3.2 | 2020-04-15 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior t… |
CVE-2020-2734 | Low | 2.4 | 2020-04-15 | Vulnerability in the RDBMS/Optimizer component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily expl… |
CVE-2020-7255 | Low | 3.9 | 2020-04-15 | Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allo… |
CVE-2020-11767 | Low | 3.1 | 2020-04-15 | Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection (negotiated with SNI over HTTPS) to *.example.com, a request… |
CVE-2020-11736 | Low | 3.9 | 2020-04-13 | fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is… |
CVE-2020-3126 | Low | 3.0 | 2020-04-13 | vulnerability within the Multimedia Viewer feature of Cisco Webex Meetings could allow an authenticated, remote attacker to bypass security protections. The vu… |
CVE-2019-1866 | Low | 3.1 | 2020-04-13 | Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the applicati… |
CVE-2020-9056 | Low | 3.9 | 2020-04-10 | Periscope BuySpeed version 14.5 is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to store arbitrary JavaScript w… |
CVE-2020-5303 | Low | 3.1 | 2020-04-10 | Tendermint before versions 0.33.3, 0.32.10, and 0.31.12 has a denial-of-service vulnerability. Tendermint does not limit the number of P2P connection requests… |
CVE-2020-1987 | Low | 3.9 | 2020-04-08 | An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie… |
CVE-2018-21077 | Low | 2.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.x) software. There is a Clipboard content disclosure in the locked state because… |
CVE-2018-21074 | Low | 3.3 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.x) (Exynos or Qualcomm chipsets) software. There is information disclosure from a Trustlet via the d… |
CVE-2018-21073 | Low | 2.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.0) (Galaxy S9+, Galaxy S9, Galaxy S8+, Galaxy S8, Note 8). There is access to Clipboard c… |
CVE-2018-21046 | Low | 2.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) software. There is clipboard Data Exposure via the Emergency Dialer upon connecting a USB device… |
CVE-2018-21043 | Low | 3.3 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 9810 chipsets) software. There is information disclosure about a kernel pointe… |
CVE-2020-11606 | Low | 2.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with Q(10.0) software. Information about application preview (in the Secure Folder) leaks on a locked device… |
CVE-2020-11602 | Low | 2.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Google Assistant leaks clipboard contents on a locked device. The Samsung I… |
CVE-2020-4164 | Low | 2.7 | 2020-04-08 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could expose sensitive information from applicatino errors which could be us… |
CVE-2017-18673 | Low | 2.4 | 2020-04-07 | An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can disable the Location service on a locked device, making it impossible f… |
CVE-2016-11027 | Low | 2.4 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) software. In the Shade Locked state, a physically proximate attacker can read notifications on th… |
CVE-2020-5283 | Low | 3.1 | 2020-04-03 | ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need f… |
CVE-2019-19092 | Low | 3.5 | 2020-04-02 | ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed. |
CVE-2019-19090 | Low | 3.5 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus… |
CVE-2020-11470 | Low | 3.3 | 2020-04-01 | Zoom Client for Meetings through 4.6.8 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to ob… |
CVE-2020-9780 | Low | 3.3 | 2020-04-01 | The issue was resolved by clearing application previews when content is deleted. This issue is fixed in iOS 13.4 and iPadOS 13.4. A local user may be able to v… |
CVE-2020-9776 | Low | 3.3 | 2020-04-01 | This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to access a user's call his… |
CVE-2020-9773 | Low | 3.3 | 2020-04-01 | The issue was addressed with improved handling of icon caches. This issue is fixed in iOS 14.0 and iPadOS 14.0. A malicious application may be able to identify… |
CVE-2020-3894 | Low | 3.1 | 2020-04-01 | A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5… |
CVE-2020-3891 | Low | 2.4 | 2020-04-01 | A logic issue was addressed with improved state management. This issue is fixed in iOS 13.4 and iPadOS 13.4, watchOS 6.2. A person with physical access to a lo… |
CVE-2019-10180 | Low | 2.4 | 2020-03-31 | A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the… |
CVE-2020-9055 | Low | 3.9 | 2020-03-30 | Versiant LYNX Customer Service Portal (CSP), version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to… |
CVE-2019-20634 | Low | 3.7 | 2020-03-30 | An issue was discovered in Proofpoint Email Protection through 2019-09-08. By collecting scores from Proofpoint email headers, it is possible to build a copy-c… |
CVE-2020-5255 | Low | 2.6 | 2020-03-30 | In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format… |
CVE-2020-1770 | Low | 2.4 | 2020-03-27 | Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0… |
CVE-2020-1769 | Low | 3.5 | 2020-03-27 | In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue… |
CVE-2019-20625 | Low | 3.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) (Exynos chipsets) software. The ion debugfs driver allows information disclosure. The… |
CVE-2019-20623 | Low | 3.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) software. Gallery has uninitialized memory disclosure. The Samsung ID is SVE-… |
CVE-2019-20598 | Low | 2.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x) software. Bixby leaks the keyboard's learned words, and the clipboard contents, via the lock scre… |
CVE-2019-20595 | Low | 2.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Quick Panel allows enabling or disabling the Bluetooth stack without authentication. Th… |
CVE-2019-20579 | Low | 2.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Gallery allows attackers to enable Location information sharing fro… |
CVE-2019-20559 | Low | 2.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Gallery allows viewing of photos on the lock screen. The Samsung ID is SVE-2019-15055 (… |
CVE-2020-10830 | Low | 2.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Attackers can view notifications by entering many PINs in Lockdown mode. Th… |
CVE-2019-20534 | Low | 2.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can view home-screen wallpaper by adjusting the brightness of a locked screen… |
CVE-2019-20533 | Low | 3.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (released in China or India) software. The S Secure app can launch masked app… |