Low-severity CVEs (page 95)
Page 95 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-24426 | Low | 3.3 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vu… |
CVE-2018-1725 | Low | 2.3 | 2020-11-05 | IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440. |
CVE-2019-4349 | Low | 3.5 | 2020-11-03 | IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 applications can be installed on a deprecated operating system version that could compromised the co… |
CVE-2020-8173 | Low | 2.2 | 2020-11-02 | A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended. |
CVE-2020-25374 | Low | 2.6 | 2020-10-28 | CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle t… |
CVE-2020-9786 | Low | 3.3 | 2020-10-27 | This issue was addressed with improved checks This issue is fixed in macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-002 High Sie… |
CVE-2019-8857 | Low | 3.3 | 2020-10-27 | The issue was addressed with improved validation when an iCloud Link is created. This issue is fixed in iOS 13.3 and iPadOS 13.3. Live Photo audio and video da… |
CVE-2019-8856 | Low | 3.3 | 2020-10-27 | An API issue existed in the handling of outgoing phone calls initiated with Siri. This issue was addressed with improved state handling. This issue is fixed in… |
CVE-2019-8842 | Low | 3.3 | 2020-10-27 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Upd… |
CVE-2019-8809 | Low | 3.3 | 2020-10-27 | A validation issue was addressed with improved logic. This issue is fixed in macOS Catalina 10.15, iOS 13.1 and iPadOS 13.1, tvOS 13, watchOS 6, iOS 13. A loca… |
CVE-2019-8799 | Low | 2.4 | 2020-10-27 | This issue was resolved by replacing device names with a random identifier. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15, watchOS 6, t… |
CVE-2019-8777 | Low | 2.4 | 2020-10-27 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in macOS Mojave… |
CVE-2019-8732 | Low | 2.4 | 2020-10-27 | The issue was addressed with improved data deletion. This issue is fixed in iOS 13. Deleted calls remained visible on the device. |
CVE-2019-8642 | Low | 3.3 | 2020-10-27 | An issue existed in the handling of S-MIME certificates. This issue was addressed with improved validation of S-MIME certificates. This issue is fixed in macOS… |
CVE-2020-8956 | Low | 3.3 | 2020-10-27 | Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled. |
CVE-2020-9986 | Low | 3.3 | 2020-10-22 | A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.7… |
CVE-2020-7020 | Low | 3.1 | 2020-10-22 | Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly… |
CVE-2020-27560 | Low | 3.3 | 2020-10-22 | ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service. |
CVE-2020-15266 | Low | 3.7 | 2020-10-21 | In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it a… |
CVE-2020-14860 | Low | 2.7 | 2020-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that are affected are 8.0.21 and prior. Easi… |
CVE-2020-14847 | Low | 2.7 | 2020-10-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected are 8.56, 8.57 and… |
CVE-2020-14818 | Low | 3.0 | 2020-10-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Difficult to exploit vulnerab… |
CVE-2020-14798 | Low | 3.1 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14797 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14796 | Low | 3.1 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14791 | Low | 2.2 | 2020-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.21 and prior. Difficult to exploit… |
CVE-2020-14782 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261… |
CVE-2020-14781 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11… |
CVE-2020-14779 | Low | 3.7 | 2020-10-21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8… |
CVE-2020-14771 | Low | 2.2 | 2020-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions that are affected are 5.7.31 and prior a… |
CVE-2020-14770 | Low | 2.0 | 2020-10-21 | Vulnerability in the Hyperion BI+ product of Oracle Hyperion (component: IQR-Foundation service). The supported version that is affected is 11.1.2.4. Difficult… |
CVE-2020-14759 | Low | 2.5 | 2020-10-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Difficult to exploit vulnerabi… |
CVE-2020-14743 | Low | 3.1 | 2020-10-21 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult… |
CVE-2020-14742 | Low | 2.7 | 2020-10-21 | Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Easily… |
CVE-2020-14740 | Low | 2.8 | 2020-10-21 | Vulnerability in the SQL Developer Install component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c… |
CVE-2020-14736 | Low | 3.8 | 2020-10-21 | Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily explo… |
CVE-2020-14732 | Low | 3.1 | 2020-10-21 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Promotions). The supported… |
CVE-2020-14731 | Low | 3.1 | 2020-10-21 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment). Supported versio… |
CVE-2020-15262 | Low | 3.7 | 2020-10-19 | In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and ther… |
CVE-2020-9959 | Low | 2.4 | 2020-10-16 | A lock screen issue allowed access to messages on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 14.0 and… |
CVE-2020-9933 | Low | 3.3 | 2020-10-16 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8. A malicious a… |
CVE-2020-9912 | Low | 3.3 | 2020-10-16 | A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1.2. A malicious attacker may be able to change the origin of a frame… |
CVE-2020-25824 | Low | 2.4 | 2020-10-14 | Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim… |
CVE-2020-0422 | Low | 3.3 | 2020-10-14 | In constructImportFailureNotification of NotificationImportExportListener.java, there is a possible permissions bypass due to an unsafe PendingIntent. This cou… |
CVE-2020-0412 | Low | 3.3 | 2020-10-14 | In setProcessMemoryTrimLevel of ActivityManagerService.java, there is a missing permission check. This could lead to local information disclosure of foreground… |
CVE-2020-17411 | Low | 3.3 | 2020-10-13 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is re… |
CVE-2020-25779 | Low | 3.3 | 2020-10-13 | Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in which a Internationalized Domain Name homograph attack (Puny-code) could be used to add a… |
CVE-2020-26930 | Low | 3.3 | 2020-10-09 | NETGEAR EX7700 devices before 1.0.0.210 are affected by incorrect configuration of security settings. |
CVE-2020-26925 | Low | 3.2 | 2020-10-09 | NETGEAR GS808E devices before 1.7.1.0 are affected by denial of service. |
CVE-2020-26924 | Low | 3.1 | 2020-10-09 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects WAC720 before 3.9.1.13 and WAC730 before 3.9.1.13. |
CVE-2020-2297 | Low | 3.3 | 2020-10-08 | Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be v… |
CVE-2020-2291 | Low | 3.3 | 2020-10-08 | Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it ca… |
CVE-2020-13342 | Low | 2.7 | 2020-10-07 | An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email |
CVE-2020-15239 | Low | 3.5 | 2020-10-06 | In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a… |
CVE-2020-1905 | Low | 3.3 | 2020-10-06 | Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have all… |
CVE-2020-25743 | Low | 3.2 | 2020-10-06 | hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call. |
CVE-2020-25742 | Low | 3.2 | 2020-10-06 | pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer. |
CVE-2020-25741 | Low | 3.2 | 2020-10-02 | fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive. |
CVE-2020-5387 | Low | 2.3 | 2020-10-01 | Dell XPS 13 9370 BIOS versions prior to 1.13.1 contains an Improper Exception Handling vulnerability. A local attacker with physical access could exploit this… |
CVE-2020-15671 | Low | 3.1 | 2020-10-01 | When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting i… |
CVE-2020-15228 | Low | 3.5 | 2020-10-01 | In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a… |
CVE-2020-14378 | Low | 3.3 | 2020-09-30 | An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large amounts of CPU cycles being eaten up in… |
CVE-2020-4629 | Low | 3.3 | 2020-09-30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed techni… |
CVE-2019-17098 | Low | 3.5 | 2020-09-30 | Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload con… |
CVE-2020-15731 | Low | 3.2 | 2020-09-30 | An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file… |
CVE-2020-25084 | Low | 3.2 | 2020-09-25 | QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. |
CVE-2020-16230 | Low | 2.3 | 2020-09-18 | All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high pr… |
CVE-2020-14525 | Low | 3.5 | 2020-09-18 | Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not neutralize or incorrectly neutralizes user-controllable input before it is placed… |
CVE-2020-14506 | Low | 3.4 | 2020-09-18 | Philips Clinical Collaboration Platform, Versions 12.2.1 and prior. The product receives input or data, but it does not validate or incorrectly validates that… |
CVE-2020-15187 | Low | 3.0 | 2020-09-17 | In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, t… |
CVE-2020-15186 | Low | 3.4 | 2020-09-17 | In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name… |
CVE-2020-15185 | Low | 2.2 | 2020-09-17 | In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compro… |
CVE-2020-15184 | Low | 3.7 | 2020-09-17 | In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injecti… |
CVE-2020-0382 | Low | 2.3 | 2020-09-17 | In RunInternal of dumpstate.cpp, there is a possible user consent bypass due to an uncaught exception. This could lead to local information disclosure of bug r… |
CVE-2020-3989 | Low | 3.3 | 2020-09-16 | VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain a denial of service vulnerability due to an out-of-bounds write issue in Co… |
CVE-2020-7295 | Low | 3.5 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data… |
CVE-2020-4344 | Low | 3.3 | 2020-09-15 | IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force I… |
CVE-2020-13308 | Low | 2.7 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from ac… |
CVE-2020-13307 | Low | 3.8 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication… |
CVE-2020-13315 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one co… |
CVE-2020-13306 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attack… |
CVE-2020-13305 | Low | 3.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user f… |
CVE-2020-13304 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an a… |
CVE-2020-13302 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions an… |
CVE-2020-13297 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user coul… |
CVE-2020-13314 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be… |
CVE-2018-19948 | Low | 2.0 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerability could allow att… |
CVE-2020-16218 | Low | 3.5 | 2020-09-11 | In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the software does not neutralize or incorrectly neutralizes user-controllable input befor… |
CVE-2014-1420 | Low | 3.8 | 2020-09-11 | On desktop, Ubuntu UI Toolkit's StateSaver would serialise data on tmp/ files which an attacker could use to expose potentially sensitive data. StateSaver woul… |
CVE-2020-15168 | Low | 2.6 | 2020-09-10 | node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the l… |
CVE-2020-2044 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using… |
CVE-2020-2043 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-O… |
CVE-2020-1968 | Low | 3.7 | 2020-09-09 | The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have… |
CVE-2020-9083 | Low | 2.4 | 2020-09-03 | HUAWEI Mate 20 smart phones with Versions earlier than 10.1.0.163(C00E160R3P8) have a denial of service (DoS) vulnerability. The attacker can enter a large amo… |
CVE-2020-24654 | Low | 3.3 | 2020-09-02 | In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a us… |
CVE-2020-8341 | Low | 2.4 | 2020-09-01 | In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protecti… |
CVE-2020-2249 | Low | 3.3 | 2020-09-01 | Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where… |
CVE-2020-12829 | Low | 3.8 | 2020-08-31 | In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO wr… |
CVE-2020-4591 | Low | 3.3 | 2020-08-28 | IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the sec… |
CVE-2020-3504 | Low | 3.3 | 2020-08-27 | A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of servic… |