Low-severity CVEs (page 96)
Page 96 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2249 | Low | 3.3 | 2020-09-01 | Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where… |
CVE-2020-12829 | Low | 3.8 | 2020-08-31 | In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO wr… |
CVE-2020-4591 | Low | 3.3 | 2020-08-28 | IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the sec… |
CVE-2020-3504 | Low | 3.3 | 2020-08-27 | A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of servic… |
CVE-2020-16142 | Low | 3.5 | 2020-08-27 | On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMA… |
CVE-2020-14415 | Low | 3.3 | 2020-08-27 | oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position. |
CVE-2019-4695 | Low | 3.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 1719… |
CVE-2019-4699 | Low | 2.7 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated… |
CVE-2020-5928 | Low | 3.1 | 2020-08-26 | In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM Configuration utility CSRF pro… |
CVE-2020-7309 | Low | 3.9 | 2020-08-26 | Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or… |
CVE-2019-11856 | Low | 3.3 | 2020-08-21 | A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView ser… |
CVE-2019-11853 | Low | 3.9 | 2020-08-21 | Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4. |
CVE-2019-11852 | Low | 3.7 | 2020-08-21 | An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9. Sensitive information may be disclosed via the ACE… |
CVE-2020-16237 | Low | 2.1 | 2020-08-21 | Philips SureSigns VS4, A.07.107 and prior receives input or data, but it does not validate or incorrectly validates that the input has the properties required… |
CVE-2020-4548 | Low | 2.7 | 2020-08-20 | IBM Content Navigator 3.0.7 and 3.0.8 is vulnerable to improper input validation. A malicious administrator could bypass the user interface and send requests t… |
CVE-2020-15637 | Low | 3.3 | 2020-08-20 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is req… |
CVE-2020-9710 | Low | 3.3 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9707 | Low | 3.3 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9706 | Low | 3.3 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-15141 | Low | 3.0 | 2020-08-14 | In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI docume… |
CVE-2020-13282 | Low | 3.1 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to imprope… |
CVE-2020-8905 | Low | 2.8 | 2020-08-12 | A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_re… |
CVE-2020-6653 | Low | 3.8 | 2020-08-12 | Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A… |
CVE-2020-2035 | Low | 3.0 | 2020-08-12 | When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL… |
CVE-2020-8912 | Low | 2.5 | 2020-08-11 | A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted b… |
CVE-2020-16092 | Low | 3.8 | 2020-08-11 | In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious… |
CVE-2020-4243 | Low | 3.7 | 2020-08-05 | IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information using man in the middle… |
CVE-2020-16201 | Low | 3.3 | 2020-08-04 | Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specia… |
CVE-2020-13523 | Low | 3.3 | 2020-08-04 | An exploitable information disclosure vulnerability exists in SoftPerfect’s RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can cau… |
CVE-2020-16116 | Low | 3.3 | 2020-08-03 | In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal. |
CVE-2020-16166 | Low | 3.7 | 2020-07-30 | The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network… |
CVE-2020-15408 | Low | 3.7 | 2020-07-28 | An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web int… |
CVE-2020-15103 | Low | 3.5 | 2020-07-27 | In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The in… |
CVE-2020-9251 | Low | 2.4 | 2020-07-27 | HUAWEI Mate 20 smartphones with versions earlier than 10.1.0.160(C00E160R2P11) have an improper authorization vulnerability. The software does not properly res… |
CVE-2020-9077 | Low | 3.3 | 2020-07-27 | HUAWEI P30 smart phones with versions earlier than 10.1.0.160(C00E160R2P11) have an information exposure vulnerability. The system does not properly authentica… |
CVE-2020-7694 | Low | 3.7 | 2020-07-27 | This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP req… |
CVE-2020-4371 | Low | 3.3 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against t… |
CVE-2020-15859 | Low | 3.3 | 2020-07-21 | QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO a… |
CVE-2020-1776 | Low | 3.5 | 2020-07-20 | When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the cas… |
CVE-2020-9252 | Low | 2.3 | 2020-07-17 | HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8), HUAWEI Mate 20 X versions earlier than 10.1.0.135(C00E135R2P8), HUAWEI Mate 20 RS versions earlie… |
CVE-2020-9102 | Low | 3.3 | 2020-07-17 | There is a information leak vulnerability in some Huawei products, and it could allow a local attacker to get information. The vulnerability is due to the impr… |
CVE-2020-14634 | Low | 2.7 | 2020-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vu… |
CVE-2020-14633 | Low | 2.7 | 2020-07-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vu… |
CVE-2020-14616 | Low | 2.7 | 2020-07-15 | Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). The supported version… |
CVE-2020-14590 | Low | 2.7 | 2020-07-15 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Page Request). Supported versions that are affected are 12.1… |
CVE-2020-14581 | Low | 3.7 | 2020-07-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 1… |
CVE-2020-14579 | Low | 3.7 | 2020-07-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u… |
CVE-2020-14578 | Low | 3.7 | 2020-07-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u… |
CVE-2020-14577 | Low | 3.7 | 2020-07-15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11… |
CVE-2020-14573 | Low | 3.7 | 2020-07-15 | Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to… |
CVE-2020-14564 | Low | 2.7 | 2020-07-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Environment Mgmt Console). Supported versions that are affected… |
CVE-2020-14548 | Low | 3.4 | 2020-07-15 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions… |
CVE-2020-14542 | Low | 3.3 | 2020-07-15 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: libsuri). The supported version that is affected is 11. Easily exploitable vulnerabil… |
CVE-2020-14541 | Low | 2.0 | 2020-07-15 | Vulnerability in the Hyperion Financial Close Management product of Oracle Hyperion (component: Close Manager). The supported version that is affected is 11.1… |
CVE-2020-14533 | Low | 3.5 | 2020-07-15 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that are affected are 11… |
CVE-2020-15101 | Low | 2.8 | 2020-07-14 | In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk()… |
CVE-2020-11083 | Low | 3.5 | 2020-07-14 | In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS… |
CVE-2020-15100 | Low | 2.8 | 2020-07-14 | In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1. |
CVE-2020-6280 | Low | 2.7 | 2020-07-14 | SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise… |
CVE-2020-12025 | Low | 3.3 | 2020-07-14 | Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may allow an at… |
CVE-2020-15469 | Low | 2.3 | 2020-07-02 | In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. |
CVE-2020-4061 | Low | 3.7 | 2020-07-02 | In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a success… |
CVE-2020-2218 | Low | 3.3 | 2020-07-02 | Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewe… |
CVE-2019-4706 | Low | 2.7 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable guidance to an attac… |
CVE-2019-4705 | Low | 2.7 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attac… |
CVE-2020-12039 | Low | 2.4 | 2020-06-29 | Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hard… |
CVE-2020-9558 | Low | 3.3 | 2020-06-26 | Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2020-9553 | Low | 3.3 | 2020-06-26 | Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2020-9626 | Low | 3.3 | 2020-06-26 | Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have an out-of-bounds read vulnerability. Successful exploitation could lead to information d… |
CVE-2020-14477 | Low | 3.6 | 2020-06-26 | In Philips Ultrasound ClearVue Versions 3.2 and prior, Ultrasound CX Versions 5.0.2 and prior, Ultrasound EPIQ/Affiniti Versions VM5.0 and prior, Ultrasound Sp… |
CVE-2020-3970 | Low | 3.8 | 2020-06-25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and F… |
CVE-2020-15005 | Low | 3.1 | 2020-06-24 | In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image autho… |
CVE-2020-4071 | Low | 2.2 | 2020-06-24 | In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASIC_A… |
CVE-2020-4033 | Low | 3.1 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. T… |
CVE-2020-4032 | Low | 3.1 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks ar… |
CVE-2020-4031 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affec… |
CVE-2020-4030 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fix… |
CVE-2020-11099 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of… |
CVE-2020-11098 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is… |
CVE-2020-11097 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PR… |
CVE-2020-11096 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-ca… |
CVE-2020-11095 | Low | 3.5 | 2020-06-22 | In FreeRDP before version 2.1.2, an out of bound reads occurs resulting in accessing a memory location that is outside of the boundaries of the static array PR… |
CVE-2020-4066 | Low | 3.8 | 2020-06-22 | In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they mig… |
CVE-2016-11077 | Low | 2.7 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of… |
CVE-2020-3972 | Low | 3.3 | 2020-06-19 | VMware Tools for macOS (11.x.x and prior before 11.1.1) contains a denial-of-service vulnerability in the Host-Guest File System (HGFS) implementation. Success… |
CVE-2018-21260 | Low | 2.7 | 2020-06-19 | An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations… |
CVE-2018-21249 | Low | 3.7 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing. |
CVE-2019-13033 | Low | 3.3 | 2020-06-18 | In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be us… |
CVE-2020-6752 | Low | 3.8 | 2020-06-17 | In OMERO before 5.6.1, group owners can access members' data in other groups. |
CVE-2020-4053 | Low | 3.7 | 2020-06-16 | In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It i… |
CVE-2020-4051 | Low | 3.7 | 2020-06-15 | In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and great… |
CVE-2017-18869 | Low | 2.5 | 2020-06-15 | A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via sy… |
CVE-2020-4050 | Low | 3.5 | 2020-06-12 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an ad… |
CVE-2020-4049 | Low | 2.4 | 2020-06-12 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-a… |
CVE-2020-10732 | Low | 3.3 | 2020-06-12 | A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and… |
CVE-2020-12023 | Low | 2.0 | 2020-06-11 | Philips IntelliBridge Enterprise (IBE), Versions B.12 and prior, IntelliBridge Enterprise system integration with SureSigns (VS4), EarlyVue (VS30) and IntelliV… |
CVE-2020-2023 | Low | 3.8 | 2020-06-10 | Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on… |
CVE-2020-9848 | Low | 2.4 | 2020-06-09 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5. A person with physical access to an iOS d… |
CVE-2020-1775 | Low | 3.5 | 2020-06-08 | BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior… |
CVE-2020-13838 | Low | 3.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The DeX Lockscreen feature does not block access to Quick Panel and notific… |