2020 CVEs (page 103)
Page 103 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15166 | High | 7.5 | 2020-09-11 | In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacte… |
CVE-2020-9239 | Medium | 5.5 | 2020-09-11 | Huawei smartphones BLA-A09 versions 8.0.0.123(C212),versions earlier than 8.0.0.123(C567),versions earlier than 8.0.0.123(C797);BLA-TL00B versions earlier than… |
CVE-2020-16224 | Medium | 6.5 | 2020-09-11 | In Patient Information Center iX (PICiX) Versions C.02, C.03, the software parses a formatted message or structure but does not handle or incorrectly handles… |
CVE-2020-16220 | Medium | 4.3 | 2020-09-11 | In Patient Information Center iX (PICiX) Versions C.02, C.03, PerformanceBridge Focal Point Version A.01, the product receives input that is expected to be w… |
CVE-2020-16216 | Medium | 6.5 | 2020-09-11 | In IntelliVue patient monitors MX100, MX400-550, MX600, MX700, MX750, MX800, MX850, MP2-MP90, and IntelliVue X2 and X3 Versions N and prior, the product rece… |
CVE-2020-16212 | Medium | 6.8 | 2020-09-11 | In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unintended actors wit… |
CVE-2020-15802 | Medium | 5.9 | 2020-09-11 | Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2… |
CVE-2020-14100 | Critical | 9.8 | 2020-09-11 | In Xiaomi router R3600 ROM version<1.0.66, filters in the set_WAN6 interface can be bypassed, causing remote code execution. The router administrator can gain… |
CVE-2020-14096 | Critical | 9.8 | 2020-09-11 | Memory overflow in Xiaomi AI speaker Rom version <1.59.6 can happen when the speaker verifying a malicious firmware during OTA process. |
CVE-2020-11991 | High | 7.5 | 2020-09-11 | When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any fi… |
CVE-2020-16228 | Medium | 6.4 | 2020-09-11 | In Patient Information Center iX (PICiX) Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550… |
CVE-2020-16222 | High | 8.8 | 2020-09-11 | In Patient Information Center iX (PICiX) Version B.02, C.02, C.03, and PerformanceBridge Focal Point Version A.01, when an actor claims to have a given ident… |
CVE-2020-16218 | Low | 3.5 | 2020-09-11 | In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the software does not neutralize or incorrectly neutralizes user-controllable input befor… |
CVE-2020-16214 | Medium | 5.0 | 2020-09-11 | In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the software saves user-provided information into a comma-separated value (CSV) file, but… |
CVE-2020-24164 | High | 7.8 | 2020-09-11 | A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, wh… |
CVE-2020-25269 | Medium | 6.5 | 2020-09-11 | An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlaut… |
CVE-2020-25260 | Critical | 9.8 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |
CVE-2020-25259 | Critical | 9.8 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |
CVE-2020-25258 | Critical | 9.8 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |
CVE-2020-25257 | Critical | 9.8 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |
CVE-2020-25256 | Critical | 9.1 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. PKI… |
CVE-2020-25255 | High | 7.5 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |
CVE-2020-25254 | Critical | 9.8 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |
CVE-2020-25253 | Critical | 9.8 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It… |
CVE-2020-25252 | High | 8.8 | 2020-09-11 | An issue was discovered in Hyland OnBase through 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and be… |
CVE-2020-25251 | Critical | 9.1 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Cli… |
CVE-2020-25250 | High | 7.5 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Cli… |
CVE-2020-25249 | Medium | 5.3 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. The… |
CVE-2020-25248 | High | 7.5 | 2020-09-11 | An issue was discovered in Hyland OnBase through 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and be… |
CVE-2020-25247 | High | 7.5 | 2020-09-11 | An issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. Directory traversal exists for writing to files, as demonstrated by th… |
CVE-2020-15171 | Medium | 6.6 | 2020-09-10 | In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context… |
CVE-2020-9731 | High | 7.8 | 2020-09-10 | A memory corruption vulnerability exists in InDesign 15.1.1 (and earlier versions). Insecure handling of a malicious indd file could be abused to cause an out-… |
CVE-2020-9730 | High | 7.8 | 2020-09-10 | A memory corruption vulnerability exists in InDesign 15.1.1 (and earlier versions). Insecure handling of a malicious indd file could be abused to cause an out-… |
CVE-2020-9729 | High | 7.8 | 2020-09-10 | A memory corruption vulnerability exists in InDesign 15.1.1 (and earlier versions). Insecure handling of a malicious indd file could be abused to cause an out-… |
CVE-2020-9728 | High | 7.8 | 2020-09-10 | A memory corruption vulnerability exists in InDesign 15.1.1 (and earlier versions). Insecure handling of a malicious indd file could be abused to cause an out-… |
CVE-2020-9727 | High | 7.8 | 2020-09-10 | A memory corruption vulnerability exists in InDesign 15.1.1 (and earlier versions). Insecure handling of a malicious indd file could be abused to cause an out-… |
CVE-2020-9726 | Medium | 6.1 | 2020-09-10 | Adobe FrameMaker version 2019.0.6 (and earlier versions) has an out-of-bounds read vulnerability that could be exploited to read past the end of an allocated b… |
CVE-2020-9725 | High | 7.8 | 2020-09-10 | Adobe FrameMaker version 2019.0.6 (and earlier versions) lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stac… |
CVE-2020-15170 | High | 7.0 | 2020-09-10 | apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there a… |
CVE-2020-15168 | Low | 2.6 | 2020-09-10 | node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the l… |
CVE-2020-13920 | Medium | 5.9 | 2020-09-10 | Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to th… |
CVE-2020-11998 | Critical | 9.8 | 2020-09-10 | A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that conta… |
CVE-2020-15024 | Medium | 5.5 | 2020-09-10 | An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered password continues to be s… |
CVE-2020-9743 | Medium | 5.3 | 2020-09-10 | AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the… |
CVE-2020-9742 | Critical | 9.0 | 2020-09-10 | AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below) and 6.3.3.8 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privil… |
CVE-2020-9741 | Critical | 9.0 | 2020-09-10 | The AEM forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) is affected by a stored XSS vulnerability that allows users with 'Author' privile… |
CVE-2020-9740 | Critical | 9.0 | 2020-09-10 | AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows… |
CVE-2020-9738 | Medium | 6.8 | 2020-09-10 | AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows… |
CVE-2020-9737 | Medium | 6.8 | 2020-09-10 | AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows… |
CVE-2020-9736 | Medium | 6.8 | 2020-09-10 | AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows… |
CVE-2020-9735 | Medium | 6.8 | 2020-09-10 | AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows… |
CVE-2020-9734 | Critical | 9.0 | 2020-09-10 | The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.1 (and below) is affected by a stored XSS vulnerability that allows users with 'Author' privile… |
CVE-2020-9733 | High | 7.5 | 2020-09-10 | An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited… |
CVE-2020-9732 | Critical | 9.0 | 2020-09-10 | The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privil… |
CVE-2020-4578 | Medium | 5.4 | 2020-09-10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript co… |
CVE-2020-24582 | Medium | 6.1 | 2020-09-10 | Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface. |
CVE-2020-17408 | High | 7.5 | 2020-09-10 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. Authentication is not require… |
CVE-2020-14198 | High | 7.5 | 2020-09-10 | Bitcoin Core 0.20.0 allows remote denial of service. |
CVE-2020-10773 | Medium | 4.4 | 2020-09-10 | A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the /proc/sys/vm/cmm_t… |
CVE-2020-8758 | Critical | 9.8 | 2020-09-10 | Improper buffer restrictions in network subsystem in provisioned Intel(R) AMT and Intel(R) ISM versions before 11.8.79, 11.12.79, 11.22.79, 12.0.68 and 14.0.39… |
CVE-2020-6097 | High | 7.5 | 2020-09-10 | An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1. A specially crafted sequence of RRQ-M… |
CVE-2020-5780 | Medium | 5.3 | 2020-09-10 | Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenti… |
CVE-2020-25221 | High | 7.8 | 2020-09-10 | get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate… |
CVE-2020-24739 | Medium | 6.5 | 2020-09-10 | A CSRF vulnerability was found in iCMS v7.0.0 in the background deletion administrator account. When missing the CSRF_TOKEN and can still request normally, all… |
CVE-2020-7315 | Medium | 6.0 | 2020-09-10 | DLL Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to execute arbitrary code via careful placement of a malicious D… |
CVE-2020-7314 | High | 8.2 | 2020-09-10 | Privilege Escalation Vulnerability in the installer in McAfee Data Exchange Layer (DXL) Client for Mac shipped with McAfee Agent (MA) for Mac prior to MA 5.6.6… |
CVE-2020-7312 | High | 7.8 | 2020-09-10 | DLL Search Order Hijacking Vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to execute arbitrary code and esca… |
CVE-2020-7311 | High | 7.8 | 2020-09-10 | Privilege Escalation vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to assume SYSTEM rights during the insta… |
CVE-2020-24552 | Medium | 5.5 | 2020-09-10 | Atop Technology industrial 3G/4G gateway contains Command Injection vulnerability. Due to insufficient input validation, the device's web management interface… |
CVE-2020-25220 | High | 7.8 | 2020-09-10 | The Linux kernel 4.9.x before 4.9.233, 4.14.x before 4.14.194, and 4.19.x before 4.19.140 has a use-after-free because skcd->no_refcnt was not considered durin… |
CVE-2020-24655 | Medium | 5.1 | 2020-09-10 | A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny an access request… |
CVE-2020-15173 | High | 8.2 | 2020-09-09 | In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string an… |
CVE-2020-25219 | High | 7.5 | 2020-09-09 | url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite… |
CVE-2020-15903 | Critical | 9.8 | 2020-09-09 | An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were… |
CVE-2020-24916 | Critical | 9.8 | 2020-09-09 | CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection. |
CVE-2020-24379 | Critical | 9.8 | 2020-09-09 | WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. |
CVE-2020-1913 | High | 8.1 | 2020-09-09 | An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause… |
CVE-2020-1912 | High | 8.1 | 2020-09-09 | An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87… |
CVE-2020-15791 | Medium | 6.5 | 2020-09-09 | A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 CPU family (incl… |
CVE-2020-15790 | Medium | 5.3 | 2020-09-09 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). If configured in an insecure manner, the web server might be susceptible to… |
CVE-2020-15789 | High | 8.1 | 2020-09-09 | A vulnerability has been identified in Polarion Subversion Webclient (All versions). The web interface could allow a Cross-Site Request Forgery (CSRF) attack i… |
CVE-2020-15788 | Medium | 6.1 | 2020-09-09 | A vulnerability has been identified in Polarion Subversion Webclient (All versions). The Polarion subversion web application does not filter user input in a wa… |
CVE-2020-15787 | Critical | 9.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attemp… |
CVE-2020-15786 | Critical | 9.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl… |
CVE-2020-15785 | Medium | 5.3 | 2020-09-09 | A vulnerability has been identified in Siveillance Video Client (All versions). In environments where Windows NTLM authentication is enabled the affected clien… |
CVE-2020-15784 | Medium | 5.3 | 2020-09-09 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). Insecure storage of sensitive information in the configuration files could… |
CVE-2020-10056 | High | 7.8 | 2020-09-09 | A vulnerability has been identified in License Management Utility (LMU) (All versions < V2.4). The lmgrd service of the affected application is executed with l… |
CVE-2020-10051 | High | 7.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). Multiple services of the affected application are executed with… |
CVE-2020-10050 | High | 7.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application… |
CVE-2020-10049 | High | 7.3 | 2020-09-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The start-stop scripts for the services of the affected applicat… |
CVE-2020-7068 | Medium | 4.8 | 2020-09-09 | In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tri… |
CVE-2020-15163 | High | 8.7 | 2020-09-09 | Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which faile… |
CVE-2020-13127 | High | 8.8 | 2020-09-09 | A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.04.1 allows remote authenticated attackers to execute arbitrary SQL commands via the… |
CVE-2020-2044 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using… |
CVE-2020-2043 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-O… |
CVE-2020-2042 | High | 7.2 | 2020-09-09 | A buffer overflow vulnerability in the PAN-OS management web interface allows authenticated administrators to disrupt system processes and potentially execute… |
CVE-2020-2041 | High | 7.5 | 2020-09-09 | An insecure configuration of the appweb daemon of Palo Alto Networks PAN-OS 8.1 allows a remote unauthenticated user to send a specifically crafted request to… |
CVE-2020-2040 | Critical | 9.8 | 2020-09-09 | A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privi… |
CVE-2020-2039 | Medium | 5.3 | 2020-09-09 | An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the… |
CVE-2020-2038 | High | 7.2 | 2020-09-09 | An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root pr… |