2020 CVEs (page 101)
Page 101 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13303 | High | 7.1 | 2020-09-15 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can acce… |
CVE-2020-8927 | Medium | 5.3 | 2020-09-15 | A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to… |
CVE-2020-15590 | High | 7.5 | 2020-09-14 | A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechan… |
CVE-2020-13315 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one co… |
CVE-2020-13310 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending m… |
CVE-2020-13309 | Medium | 5.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirror… |
CVE-2020-13306 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attack… |
CVE-2020-13305 | Low | 3.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user f… |
CVE-2020-13304 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an a… |
CVE-2020-13302 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions an… |
CVE-2020-13301 | Medium | 5.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page. |
CVE-2020-13298 | High | 7.2 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplie… |
CVE-2020-13297 | Low | 3.8 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user coul… |
CVE-2020-11881 | High | 7.5 | 2020-09-14 | An array index error in MikroTik RouterOS 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5, allows an unauthenticated remote attacker to crash the SMB server v… |
CVE-2020-13317 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the GraphQL api allowed a maintainer to delete a… |
CVE-2020-13314 | Low | 3.7 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be… |
CVE-2020-13313 | Medium | 4.3 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to t… |
CVE-2020-13312 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a spec… |
CVE-2020-13311 | Medium | 4.3 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Wiki was vulnerable to a parser attack that prohibits anyone from accessin… |
CVE-2020-10229 | High | 8.8 | 2020-09-14 | A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, adding users, and de… |
CVE-2020-10228 | High | 8.8 | 2020-09-14 | A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload files with a .pht extension, resulting in remote code execution. |
CVE-2020-10227 | Medium | 6.1 | 2020-09-14 | A cross-site scripting (XSS) vulnerability in the messages module of vtecrm vtenext 19 CE allows attackers to inject arbitrary JavaScript code via the From fie… |
CVE-2020-25576 | Critical | 9.8 | 2020-09-14 | An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints. |
CVE-2020-25575 | Critical | 9.8 | 2020-09-14 | An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has a type confusion fl… |
CVE-2020-25574 | High | 7.5 | 2020-09-14 | An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infin… |
CVE-2020-25573 | Critical | 9.8 | 2020-09-14 | An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust. It creates an uninitialized NonNull pointer, which violates a non-null constraint. |
CVE-2020-24457 | High | 7.6 | 2020-09-14 | Logic error in BIOS firmware for 8th, 9th and 10th Generation Intel(R) Core(TM) Processors may allow an unauthenticated user to potentially enable escalation o… |
CVE-2020-13318 | Medium | 6.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume… |
CVE-2020-13316 | Medium | 5.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository… |
CVE-2020-13300 | High | 8.0 | 2020-09-14 | GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow. |
CVE-2020-13299 | High | 8.1 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could r… |
CVE-2020-13289 | Medium | 5.4 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activat… |
CVE-2020-13287 | Medium | 4.3 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could see confidential EPIC attached to confid… |
CVE-2020-13284 | Medium | 6.5 | 2020-09-14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token |
CVE-2020-0570 | High | 7.3 | 2020-09-14 | Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via lo… |
CVE-2020-21845 | Medium | 6.1 | 2020-09-14 | Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.' |
CVE-2020-25380 | Medium | 5.4 | 2020-09-14 | Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An atta… |
CVE-2020-25379 | High | 8.8 | 2020-09-14 | Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attack… |
CVE-2020-25378 | Medium | 6.1 | 2020-09-14 | Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter. |
CVE-2020-25375 | Medium | 5.4 | 2020-09-14 | Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field… |
CVE-2020-22158 | Medium | 6.1 | 2020-09-14 | MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. An attacker has to inject JavaScript code directly in… |
CVE-2020-8817 | High | 8.1 | 2020-09-14 | Dataiku DSS before 6.0.5 allows attackers write access to the project to modify the "Created by" metadata. |
CVE-2020-12789 | High | 7.5 | 2020-09-14 | The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets. |
CVE-2020-12788 | High | 7.5 | 2020-09-14 | CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks. |
CVE-2020-12787 | High | 7.5 | 2020-09-14 | Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling. |
CVE-2020-11684 | Critical | 9.1 | 2020-09-14 | AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component… |
CVE-2020-11683 | Medium | 6.8 | 2020-09-14 | A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical access to forge CMAC values and subsequently… |
CVE-2020-25540 | High | 7.5 | 2020-09-14 | ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode… |
CVE-2020-24660 | Critical | 9.8 | 2020-09-14 | An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submi… |
CVE-2020-7807 | Medium | 5.6 | 2020-09-14 | A vulnerability that can hijack a DLL file that is loaded during products(LGPCSuite_Setup, IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) installation into a… |
CVE-2020-21733 | Medium | 6.1 | 2020-09-14 | Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp. |
CVE-2020-21732 | Medium | 6.1 | 2020-09-14 | Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). An attacker can add JavaScript code to the filename. |
CVE-2020-21731 | Medium | 6.1 | 2020-09-14 | Gazie 7.29 is affected by: Cross Site Scripting (XSS) via http://192.168.100.7/gazie/modules/config/admin_utente.php?user_name=amministratore&Update. An attack… |
CVE-2020-25291 | High | 7.8 | 2020-09-13 | GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap corruption via a crafted PLTE chunk in PNG data within a Word document. This i… |
CVE-2020-25289 | Medium | 5.5 | 2020-09-13 | The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link from the log directo… |
CVE-2020-25287 | High | 7.2 | 2020-09-13 | Pligg 2.0.3 allows remote authenticated users to execute arbitrary commands because the template editor can edit any file, as demonstrated by an admin/admin_ed… |
CVE-2020-25286 | Medium | 5.3 | 2020-09-13 | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or… |
CVE-2020-25285 | Medium | 6.4 | 2020-09-13 | A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a N… |
CVE-2020-25284 | Medium | 4.1 | 2020-09-13 | The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could… |
CVE-2020-25283 | Critical | 9.8 | 2020-09-11 | An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. BT manager allows attackers to bypass intended access restrictions… |
CVE-2020-25282 | Critical | 9.8 | 2020-09-11 | An issue was discovered on LG mobile devices with Android OS 10 software. The lguicc software (for the LG Universal Integrated Circuit Card) allows attackers t… |
CVE-2020-25281 | High | 7.5 | 2020-09-11 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. Applications with sensitive security settings (such as the p… |
CVE-2020-25280 | Medium | 6.8 | 2020-09-11 | An issue was discovered on Samsung mobile devices with Q(10.0) (Exynos and MediaTek chipsets) software. Unauthenticated attackers can execute LTE/5G commands b… |
CVE-2020-25279 | Critical | 9.8 | 2020-09-11 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. The baseband component has a buffer overflow via… |
CVE-2020-25278 | Critical | 9.8 | 2020-09-11 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The Quram image codec library allows attackers to overwrite memory… |
CVE-2020-23824 | High | 8.8 | 2020-09-11 | ArGo Soft Mail Server 1.8.8.9 is affected by Cross Site Request Forgery (CSRF) for perform remote arbitrary code execution. The component is the Administration… |
CVE-2020-14363 | High | 7.8 | 2020-09-11 | An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an application compiled w… |
CVE-2020-14332 | Medium | 5.5 | 2020-09-11 | A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed… |
CVE-2020-14330 | Medium | 5.0 | 2020-09-11 | An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. Thi… |
CVE-2020-1598 | Medium | 6.1 | 2020-09-11 | <p>An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly handles objects in memory. An attacker who… |
CVE-2020-1596 | Medium | 5.4 | 2020-09-11 | <p>A information disclosure vulnerability exists when TLS components use weak hash algorithms. An attacker who successfully exploited this vulnerability could… |
CVE-2020-1595 | Critical | 9.9 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input. An attacker who successful… |
CVE-2020-1594 | High | 7.8 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who succe… |
CVE-2020-1593 | High | 7.6 | 2020-09-11 | <p>A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles objects. An attacker who successfully exploited the vulnera… |
CVE-2020-1592 | Medium | 4.4 | 2020-09-11 | <p>An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.</p> <p>To exploit this vulnerability, an au… |
CVE-2020-1590 | Medium | 6.6 | 2020-09-11 | <p>An elevation of privilege vulnerability exists when the Connected User Experiences and Telemetry Service improperly handles file operations. An attacker who… |
CVE-2020-1589 | Medium | 4.4 | 2020-09-11 | <p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vul… |
CVE-2020-1576 | High | 8.5 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-1575 | Medium | 5.4 | 2020-09-11 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected… |
CVE-2020-1559 | High | 7.8 | 2020-09-11 | <p>An elevation of privilege vulnerability exists when the Windows Storage Services improperly handle file operations. An attacker who successfully exploited t… |
CVE-2020-1532 | High | 7.8 | 2020-09-11 | <p>An elevation of privilege vulnerability exists when the Windows InstallService improperly handles memory.</p> <p>To exploit this vulnerability, an attacker… |
CVE-2020-1523 | High | 8.9 | 2020-09-11 | <p>A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exploited this vulnera… |
CVE-2020-1514 | Medium | 5.4 | 2020-09-11 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected… |
CVE-2020-1508 | High | 7.6 | 2020-09-11 | <p>A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles objects. An attacker who successfully exploited the vulnera… |
CVE-2020-1507 | High | 7.9 | 2020-09-11 | <p>An elevation of privilege vulnerability exists in the way that Microsoft COM for Windows handles objects in memory. An attacker who successfully exploited t… |
CVE-2020-1506 | Medium | 6.1 | 2020-09-11 | <p>An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory. An attacker who successfully exploited the vulnera… |
CVE-2020-1491 | High | 7.8 | 2020-09-11 | <p>An elevation of privilege vulnerability exists in the way that the Windows Function Discovery Service handles objects in memory. An attacker who successfull… |
CVE-2020-1482 | Medium | 6.3 | 2020-09-11 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected… |
CVE-2020-1471 | High | 7.3 | 2020-09-11 | <p>An elevation of privilege vulnerability exists when Microsoft Windows CloudExperienceHost fails to check COM objects. An attacker who successfully exploited… |
CVE-2020-1460 | High | 8.6 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An au… |
CVE-2020-1453 | High | 8.6 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-1452 | High | 8.6 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attack… |
CVE-2020-1440 | Medium | 6.3 | 2020-09-11 | <p>A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exploited this vulnera… |
CVE-2020-1376 | High | 7.8 | 2020-09-11 | <p>An elevation of privilege vulnerability exists in the way that fdSSDP.dll handles objects in memory. An attacker who successfully exploited the vulnerabilit… |
CVE-2020-1345 | High | 7.4 | 2020-09-11 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected… |
CVE-2020-1338 | High | 7.8 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exp… |
CVE-2020-1335 | High | 7.8 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who succe… |
CVE-2020-1332 | High | 7.8 | 2020-09-11 | <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who succe… |
CVE-2020-1319 | High | 7.3 | 2020-09-11 | <p>A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploi… |
CVE-2020-1308 | High | 7.0 | 2020-09-11 | <p>An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability… |