2020 CVEs (page 106)
Page 106 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4638 | High | 7.2 | 2020-09-03 | IBM API Connect's API Manager 2018.4.1.0 through 2018.4.1.12 is vulnerable to privilege escalation. An invitee to an API Provider organization can escalate pri… |
CVE-2020-4337 | Medium | 6.5 | 2020-09-03 | IBM API Connect 2018.4.1.0 through 2018.4.1.12 could allow an attacker to launch phishing attacks by tricking the server to generate user registration emails t… |
CVE-2020-24949 | High | 8.8 | 2020-09-03 | Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform… |
CVE-2020-12058 | Medium | 6.1 | 2020-09-03 | Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can b… |
CVE-2020-7729 | High | 7.1 | 2020-09-03 | The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement saf… |
CVE-2020-25093 | Medium | 6.1 | 2020-09-03 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in blog.php. within application/views/templates/clothesshop, application/views/templates/onepage… |
CVE-2020-25092 | Medium | 6.1 | 2020-09-03 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in _parts/header.php, within application/views/templates/clothesshop, application/views/templates/… |
CVE-2020-25091 | Medium | 6.1 | 2020-09-03 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php. |
CVE-2020-25090 | Medium | 6.1 | 2020-09-03 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php. |
CVE-2020-25089 | Medium | 6.1 | 2020-09-03 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/discounts.php. |
CVE-2020-25088 | Medium | 6.1 | 2020-09-03 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/blog/blogpublish.php. |
CVE-2020-25087 | Medium | 6.1 | 2020-09-03 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/languages.php. |
CVE-2020-25086 | Medium | 6.1 | 2020-09-03 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/adminUsers.php. |
CVE-2020-5420 | High | 7.7 | 2020-09-03 | Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pu… |
CVE-2020-5418 | Medium | 4.3 | 2020-09-03 | Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spa… |
CVE-2020-5386 | High | 7.5 | 2020-09-02 | Dell EMC ECS, versions prior to 3.5, contains an Exposure of Resource vulnerability. A remote unauthenticated attacker can access the list of DT (Directory Tab… |
CVE-2020-5379 | Medium | 6.8 | 2020-09-02 | Dell Inspiron 7352 BIOS versions prior to A12 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attacker with access to system memory may expl… |
CVE-2020-5378 | Medium | 6.8 | 2020-09-02 | Dell G7 17 7790 BIOS versions prior to 1.13.2 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attacker with access to system memory may expl… |
CVE-2020-5376 | Medium | 6.8 | 2020-09-02 | Dell Inspiron 7347 BIOS versions prior to A13 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attacker with access to system memory may expl… |
CVE-2020-5369 | High | 8.8 | 2020-09-02 | Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability. An authenticated mal… |
CVE-2020-8576 | Medium | 5.4 | 2020-09-02 | Clustered Data ONTAP versions prior to 9.3P19, 9.5P14, 9.6P9 and 9.7 are susceptible to a vulnerability which when successfully exploited could lead to additio… |
CVE-2020-7830 | High | 7.8 | 2020-09-02 | RAONWIZ v2018.0.2.50 and earlier versions contains a vulnerability that could allow remote files to be downloaded by lack of validation. Vulnerabilities in dow… |
CVE-2020-5779 | High | 7.5 | 2020-09-02 | A flaw in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) relates to invalid parameter handling when calling strcpy_s() with an invalid parameter (i.e., a l… |
CVE-2020-5778 | High | 7.5 | 2020-09-02 | A flaw exists in Trading Technologies Messaging 7.1.28.3 (ttmd.exe) due to improper validation of user-supplied data when processing a type 8 message sent to d… |
CVE-2020-25045 | High | 7.8 | 2020-09-02 | Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack t… |
CVE-2020-25044 | High | 7.1 | 2020-09-02 | Kaspersky Virus Removal Tool (KVRT) prior to 15.0.23.0 was vulnerable to arbitrary file corruption that could provide an attacker with the opportunity to elimi… |
CVE-2020-25043 | High | 7.1 | 2020-09-02 | The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the… |
CVE-2020-4693 | Critical | 9.8 | 2020-09-02 | IBM Spectrum Protect Operations Center 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 may allow an attacker to execute arbitrary code on the system, caus… |
CVE-2020-4546 | Medium | 5.4 | 2020-09-02 | IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2020-4522 | Medium | 5.4 | 2020-09-02 | IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2020-4445 | Medium | 5.4 | 2020-09-02 | IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2020-15167 | High | 8.2 | 2020-09-02 | In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitr… |
CVE-2020-15094 | High | 8.0 | 2020-09-02 | In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests… |
CVE-2020-25026 | Medium | 4.3 | 2020-09-02 | The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data… |
CVE-2020-25025 | Medium | 4.3 | 2020-09-02 | The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fie… |
CVE-2020-24654 | Low | 3.3 | 2020-09-02 | In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a us… |
CVE-2020-24553 | Medium | 6.1 | 2020-09-02 | Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. |
CVE-2020-24030 | Critical | 9.8 | 2020-09-02 | ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access to sensitive data via token reuse. NOT… |
CVE-2020-24029 | Critical | 9.8 | 2020-09-02 | Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE… |
CVE-2020-24028 | High | 8.8 | 2020-09-02 | ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates… |
CVE-2020-23830 | High | 7.1 | 2020-09-02 | A Cross-Site Request Forgery (CSRF) vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future l… |
CVE-2020-15811 | Medium | 6.5 | 2020-09-02 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP an… |
CVE-2020-15810 | Medium | 6.5 | 2020-09-02 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP an… |
CVE-2020-14209 | High | 8.8 | 2020-09-02 | Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar f… |
CVE-2020-13802 | Critical | 9.8 | 2020-09-02 | Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification. |
CVE-2020-12621 | Medium | 6.1 | 2020-09-02 | The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component. |
CVE-2020-25079 | High | 8.8 | 2020-09-02 | An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injecti… |
CVE-2020-25078 | High | 7.5 | 2020-09-02 | An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for r… |
CVE-2020-16150 | Medium | 5.5 | 2020-09-02 | A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret… |
CVE-2020-24604 | Medium | 6.1 | 2020-09-02 | A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web s… |
CVE-2020-24602 | Medium | 6.1 | 2020-09-02 | Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerabl… |
CVE-2020-24601 | Medium | 6.1 | 2020-09-02 | In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter… |
CVE-2020-17458 | Medium | 5.4 | 2020-09-02 | A post-authenticated stored XSS was found in MultiUx v.3.1.12.0 via the /multiux/SaveMailbox LastName field. |
CVE-2020-16602 | High | 8.1 | 2020-09-02 | Razer Chroma SDK Rest Server through 3.12.17 allows remote attackers to execute arbitrary programs because there is a race condition in which a file created un… |
CVE-2020-24355 | Critical | 9.8 | 2020-09-02 | Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insecure permissions which allows regular an… |
CVE-2020-5622 | High | 7.5 | 2020-09-02 | Shadankun Server Security Type (excluding normal blocking method types) Ver.1.5.3 and earlier allows remote attackers to cause a denial of service which may re… |
CVE-2020-25073 | Medium | 5.3 | 2020-09-02 | FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, because a connection f… |
CVE-2020-8341 | Low | 2.4 | 2020-09-01 | In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protecti… |
CVE-2020-8335 | Medium | 6.1 | 2020-09-01 | The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wuj65w; T495 BIOS vers… |
CVE-2020-24955 | High | 7.8 | 2020-09-01 | SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivileged users to restore a malicious DLL from… |
CVE-2020-6874 | Critical | 9.1 | 2020-09-01 | A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so remote attackers could use this vulnerab… |
CVE-2020-6873 | Medium | 5.3 | 2020-09-01 | A ZTE product has a DoS vulnerability. Because the equipment couldn’t distinguish the attack packets and normal packets with valid http links, the remote attac… |
CVE-2020-6152 | High | 7.8 | 2020-09-01 | A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A specially crafted malformed file can cause… |
CVE-2020-6151 | Critical | 9.8 | 2020-09-01 | A memory corruption vulnerability exists in the TIFF handle_COMPRESSION_PACKBITS functionality of Accusoft ImageGear 19.7. A specially crafted malformed file c… |
CVE-2020-6144 | Critical | 9.8 | 2020-09-01 | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5… |
CVE-2020-6143 | Critical | 9.8 | 2020-09-01 | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5… |
CVE-2020-6142 | Critical | 9.8 | 2020-09-01 | A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can cause local file inclu… |
CVE-2020-6140 | Critical | 9.8 | 2020-09-01 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the password reset page /opens… |
CVE-2020-6139 | Critical | 9.8 | 2020-09-01 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email parameter in the password reset page /opens… |
CVE-2020-6138 | Critical | 9.8 | 2020-09-01 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the password reset page /opensis/ResetUserI… |
CVE-2020-6137 | Critical | 9.8 | 2020-09-01 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the password reset page /opens… |
CVE-2020-5777 | Critical | 9.8 | 2020-09-01 | MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection… |
CVE-2020-5776 | High | 8.8 | 2020-09-01 | Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is levera… |
CVE-2020-25070 | High | 8.8 | 2020-09-01 | USVN (aka User-friendly SVN) before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature. |
CVE-2020-25069 | Critical | 9.8 | 2020-09-01 | USVN (aka User-friendly SVN) before 1.0.10 allows attackers to execute arbitrary code in the commit view. |
CVE-2020-16210 | Critical | 9.0 | 2020-09-01 | The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perform actions in the… |
CVE-2020-16208 | High | 8.8 | 2020-09-01 | The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different configurations of a device by luring an authe… |
CVE-2020-16206 | Critical | 9.0 | 2020-09-01 | The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain access to sensitive d… |
CVE-2020-16204 | Critical | 9.8 | 2020-09-01 | The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device… |
CVE-2020-13946 | Medium | 5.9 | 2020-09-01 | In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassa… |
CVE-2020-24559 | High | 7.8 | 2020-09-01 | A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow an attacker to mani… |
CVE-2020-24558 | High | 7.1 | 2020-09-01 | A vulnerability in an Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services dll may allow an attacker to manipu… |
CVE-2020-24557 | High | 7.8 | 2020-09-01 | A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product… |
CVE-2020-24556 | High | 7.8 | 2020-09-01 | A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business Security Services on Microsoft Windows… |
CVE-2020-6141 | Critical | 9.8 | 2020-09-01 | An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection… |
CVE-2020-6136 | High | 8.8 | 2020-09-01 | An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQ… |
CVE-2020-24034 | High | 8.8 | 2020-09-01 | Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation t… |
CVE-2020-17405 | High | 8.8 | 2020-09-01 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Symphony 7.3.2.2. Authentication is not req… |
CVE-2020-6135 | High | 8.8 | 2020-09-01 | An exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL inj… |
CVE-2020-23839 | Medium | 6.1 | 2020-09-01 | A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute… |
CVE-2020-23836 | High | 8.8 | 2020-09-01 | A Cross-Site Request Forgery (CSRF) vulnerability in edit_user.php in OSWAPP Warehouse Inventory System (aka OSWA-INV) through 2020-08-10 allows remote attacke… |
CVE-2020-23835 | Medium | 6.4 | 2020-09-01 | A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Management System v1.0 allows remote attack… |
CVE-2020-23831 | Medium | 6.4 | 2020-09-01 | A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 allows remote attacke… |
CVE-2020-23829 | High | 8.8 | 2020-09-01 | interface/new/new_comprehensive_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote attackers to achieve… |
CVE-2020-15150 | Critical | 9.0 | 2020-09-01 | There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the pagina… |
CVE-2020-23971 | High | 7.5 | 2020-09-01 | gmapfp.org Joomla Component GMapFP J3.30pro is affected by Insecure Permissions. An attacker can access the upload function without authenticating to the appli… |
CVE-2020-23450 | Medium | 5.4 | 2020-09-01 | Spiceworks Version <= 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on http://127.0.0.1/… |
CVE-2020-6134 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page MassDropModal.php is vulnerable to SQL inject… |
CVE-2020-6133 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page CourseMoreInfo.php is vulnerable to SQL injec… |
CVE-2020-6132 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page ChooseCP.php is vulnerable to SQL injection. A… |