2020 CVEs (page 100)
Page 100 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7531 | High | 7.8 | 2020-09-16 | A CWE-284 Improper Access Control vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows an attacker to place executables in a… |
CVE-2020-7530 | High | 8.8 | 2020-09-16 | A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows improper access to executable code fol… |
CVE-2020-7529 | Medium | 5.5 | 2020-09-16 | A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Transversal') vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and p… |
CVE-2020-7528 | High | 7.8 | 2020-09-16 | A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which could allow arbitrary code executi… |
CVE-2020-4708 | Medium | 5.3 | 2020-09-16 | IBM Security Trusteer Pinpoint Detect 11.6.5 could disclose some information due to using a wildcard in the Access-Control-Allow-Origin header. IBM X-Force ID… |
CVE-2020-4409 | High | 8.2 | 2020-09-16 | IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to vis… |
CVE-2020-1748 | High | 7.5 | 2020-09-16 | A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using cu… |
CVE-2020-10758 | High | 7.5 | 2020-09-16 | A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, al… |
CVE-2020-25614 | Critical | 9.8 | 2020-09-16 | xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlqu… |
CVE-2020-24890 | Medium | 5.5 | 2020-09-16 | libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execu… |
CVE-2020-24889 | High | 7.8 | 2020-09-16 | A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary… |
CVE-2020-1710 | Medium | 5.3 | 2020-09-16 | The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400. |
CVE-2020-14382 | High | 7.8 | 2020-09-16 | A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every devic… |
CVE-2020-10733 | High | 7.3 | 2020-09-16 | The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where th… |
CVE-2020-7733 | High | 7.5 | 2020-09-16 | The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA. |
CVE-2020-2278 | Medium | 6.5 | 2020-09-16 | Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any… |
CVE-2020-2277 | Medium | 6.5 | 2020-09-16 | Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller. |
CVE-2020-2276 | High | 8.8 | 2020-09-16 | Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to… |
CVE-2020-2275 | Medium | 6.5 | 2020-09-16 | Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing at… |
CVE-2020-2274 | Medium | 5.5 | 2020-09-16 | Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be vie… |
CVE-2020-2273 | Medium | 4.3 | 2020-09-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-specified URL using a… |
CVE-2020-2272 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL u… |
CVE-2020-2271 | Medium | 5.4 | 2020-09-16 | Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scripting (XSS) vulnerabil… |
CVE-2020-2270 | Medium | 5.4 | 2020-09-16 | Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site scripting (XSS) vuln… |
CVE-2020-2269 | Medium | 5.4 | 2020-09-16 | Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-site scripting (XSS)… |
CVE-2020-2268 | High | 8.8 | 2020-09-16 | A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary f… |
CVE-2020-2267 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbit… |
CVE-2020-2266 | Medium | 5.4 | 2020-09-16 | Jenkins Description Column Plugin 1.3 and earlier does not escape the job description in the column tooltip, resulting in a stored cross-site scripting (XSS) v… |
CVE-2020-2265 | Medium | 5.4 | 2020-09-16 | Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a stored cross-site scriptin… |
CVE-2020-2264 | Medium | 5.4 | 2020-09-16 | Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2020-2263 | Medium | 5.4 | 2020-09-16 | Jenkins Radiator View Plugin 1.29 and earlier does not escape the full name of the jobs in tooltips, resulting in a stored cross-site scripting (XSS) vulnerabi… |
CVE-2020-2262 | Medium | 5.4 | 2020-09-16 | Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2020-2261 | High | 8.8 | 2020-09-16 | Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary comman… |
CVE-2020-2260 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins Perfecto Plugin 1.17 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP U… |
CVE-2020-2259 | Medium | 5.4 | 2020-09-16 | Jenkins computer-queue-plugin Plugin 1.5 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2020-2258 | Medium | 4.3 | 2020-09-16 | Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall… |
CVE-2020-2257 | Medium | 5.4 | 2020-09-16 | Jenkins Validating String Parameter Plugin 2.4 and earlier does not escape various user-controlled fields, resulting in a stored cross-site scripting (XSS) vul… |
CVE-2020-2256 | Medium | 5.4 | 2020-09-16 | Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stor… |
CVE-2020-2255 | Medium | 4.3 | 2020-09-16 | A missing permission check in Jenkins Blue Ocean Plugin 1.23.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified UR… |
CVE-2020-2254 | Medium | 6.5 | 2020-09-16 | Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create perm… |
CVE-2020-2253 | Medium | 4.8 | 2020-09-16 | Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. |
CVE-2020-2252 | Medium | 4.8 | 2020-09-16 | Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server. |
CVE-2020-25412 | Critical | 9.8 | 2020-09-16 | com_line() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution. |
CVE-2020-14393 | High | 7.1 | 2020-09-16 | A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string longer than 300 characters could cause an out-of-bou… |
CVE-2020-14315 | Critical | 9.8 | 2020-09-16 | A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3. Insufficient checks when handling external inp… |
CVE-2020-25559 | High | 7.8 | 2020-09-16 | gnuplot 5.5 is affected by double free when executing print_set_output. This may result in context-dependent arbitrary code execution. |
CVE-2020-14392 | Medium | 5.5 | 2020-09-16 | An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory… |
CVE-2020-14386 | Medium | 6.7 | 2020-09-16 | A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat… |
CVE-2020-10781 | Medium | 5.5 | 2020-09-16 | A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-co… |
CVE-2020-7268 | Medium | 4.3 | 2020-09-16 | Path Traversal vulnerability in McAfee McAfee Email Gateway (MEG) prior to 7.6.406 allows remote attackers to traverse the file system to access files or direc… |
CVE-2020-7297 | Medium | 5.7 | 2020-09-16 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via i… |
CVE-2020-10768 | Medium | 5.5 | 2020-09-16 | A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disab… |
CVE-2020-7296 | Medium | 5.7 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected configuration files… |
CVE-2020-7295 | Low | 3.5 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data… |
CVE-2020-7294 | Medium | 4.6 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected files vi… |
CVE-2020-7293 | Critical | 9.0 | 2020-09-15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user with low permissions to change the syste… |
CVE-2020-10767 | Medium | 5.5 | 2020-09-15 | A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will b… |
CVE-2020-10766 | Medium | 5.5 | 2020-09-15 | A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to… |
CVE-2020-25453 | High | 8.8 | 2020-09-15 | An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability (bypass csrf_token) that allows remote arbitrary code execution. |
CVE-2020-23833 | Critical | 9.8 | 2020-09-15 | Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers to execute arbitrary code on the hosting… |
CVE-2020-23828 | Critical | 9.8 | 2020-09-15 | A File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote attackers to achieve Remote Code Execution (RCE) on the hosting web… |
CVE-2020-14385 | Medium | 5.5 | 2020-09-15 | A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable ext… |
CVE-2020-24561 | Critical | 9.1 | 2020-09-15 | A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affected system. An attack… |
CVE-2020-14314 | Medium | 5.5 | 2020-09-15 | A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken in… |
CVE-2020-14304 | Medium | 4.4 | 2020-09-15 | A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device. This flaw allows a local user… |
CVE-2020-11977 | High | 7.2 | 2020-09-15 | In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Task… |
CVE-2020-9416 | High | 8.2 | 2020-09-15 | The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, a… |
CVE-2020-15172 | High | 8.7 | 2020-09-15 | The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit, Discord users can use specially crafted me… |
CVE-2020-15148 | High | 8.9 | 2020-09-15 | Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fix… |
CVE-2020-14362 | High | 7.8 | 2020-09-15 | A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnera… |
CVE-2020-14361 | High | 7.8 | 2020-09-15 | A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnera… |
CVE-2020-14346 | High | 7.8 | 2020-09-15 | A flaw was found in xorg-x11-server before 1.20.9. An integer underflow in the X input extension protocol decoding in the X server may lead to arbitrary access… |
CVE-2020-14331 | Medium | 6.6 | 2020-09-15 | A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an… |
CVE-2020-10759 | Medium | 6.0 | 2020-09-15 | A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass i… |
CVE-2020-25071 | Medium | 5.4 | 2020-09-15 | Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visit. Note: It has been argued that this is… |
CVE-2020-15179 | High | 8.0 | 2020-09-15 | The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using <script> tag inside <scratchsig> tag, attackers with edit… |
CVE-2020-15178 | High | 8.0 | 2020-09-15 | In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The `mes… |
CVE-2020-8346 | Medium | 5.5 | 2020-09-15 | A denial of service vulnerability was reported in the Lenovo Vantage component called Lenovo System Interface Foundation prior to version 1.1.19.5 that could a… |
CVE-2020-8342 | High | 7.3 | 2020-09-15 | A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege. |
CVE-2020-8340 | Medium | 6.3 | 2020-09-15 | A cross-site scripting (XSS) vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 (Integrated Management Module 2), prior to version 5.60, e… |
CVE-2020-8339 | Medium | 4.3 | 2020-09-15 | A cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module (AMM) web interface prior to versio… |
CVE-2020-4711 | Medium | 6.5 | 2020-09-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted… |
CVE-2020-4703 | High | 8.0 | 2020-09-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute a… |
CVE-2020-4530 | Medium | 5.4 | 2020-09-15 | IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulnerability allows use… |
CVE-2020-4526 | Medium | 4.3 | 2020-09-15 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized act… |
CVE-2020-4521 | High | 8.8 | 2020-09-15 | IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserializ… |
CVE-2020-4344 | Low | 3.3 | 2020-09-15 | IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force I… |
CVE-2020-23512 | Critical | 9.8 | 2020-09-15 | VR CAM P1 Model P1 v1 has an incorrect access control vulnerability where an attacker can obtain complete access of the device from web (remote) without authen… |
CVE-2020-23451 | High | 8.8 | 2020-09-15 | Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function. |
CVE-2020-16101 | High | 7.5 | 2020-09-15 | It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected vers… |
CVE-2020-16100 | High | 7.5 | 2020-09-15 | It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of… |
CVE-2020-16099 | Medium | 4.3 | 2020-09-15 | In Gallagher Command Centre v8.20 prior to v8.20.1093(MR2) it is possible to create Guard Tour events that when accessed via things like reporting cause client… |
CVE-2020-16098 | Critical | 9.8 | 2020-09-15 | It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20… |
CVE-2020-16097 | High | 7.3 | 2020-09-15 | On controllers running versions of v8.20 prior to vCR8.20.200221b (distributed in v8.20.1093(MR2)), v8.10 prior to vGR8.10.179 (distributed in v8.10.1211(MR5))… |
CVE-2020-16096 | Critical | 9.9 | 2020-09-15 | In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior to 7.80.960(MR2), 7.70… |
CVE-2020-14345 | High | 7.8 | 2020-09-15 | A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerabilit… |
CVE-2020-24925 | High | 7.5 | 2020-09-15 | A Sensitive Source Code Path Disclosure vulnerability is found in ElkarBackup v1.3.3. An attacker is able to view the path of the source code jobs/sort where e… |
CVE-2020-24924 | Medium | 5.4 | 2020-09-15 | A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability pr… |
CVE-2020-13308 | Low | 2.7 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from ac… |
CVE-2020-13307 | Low | 3.8 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication… |