2020 CVEs (page 107)
Page 107 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6128 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. The meet… |
CVE-2020-6127 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. The id parameter in the page CoursePeriodModal.php is vulnerable to… |
CVE-2020-6126 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. The course_period_id parameter in the page CoursePeriodModal.php is… |
CVE-2020-6125 | High | 8.8 | 2020-09-01 | An exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL inj… |
CVE-2020-6124 | High | 8.8 | 2020-09-01 | An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3. The email parameter in the page EmailCheckOthers.p… |
CVE-2020-7669 | High | 7.5 | 2020-09-01 | This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in… |
CVE-2020-7666 | High | 7.5 | 2020-09-01 | This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink ba… |
CVE-2020-7665 | High | 7.5 | 2020-09-01 | This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip… |
CVE-2020-6131 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages. The course_period_id parameter in the page MassSchedule… |
CVE-2020-6130 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages. The course_period_id parameter in the page MassDropSess… |
CVE-2020-6129 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the course_period_id parameters used in OS4Ed openSIS 7.3 pages. The course_period_id parameter in the page CpSessionSet… |
CVE-2020-6123 | High | 8.8 | 2020-09-01 | An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3. The email parameter in the page EmailCheck.php is… |
CVE-2020-6122 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The mn parameter in the page CheckDuplicateStudent.php is vulner… |
CVE-2020-6121 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The ln parameter in the page CheckDuplicateStudent.php is vulne… |
CVE-2020-6120 | High | 8.8 | 2020-09-01 | SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The fn parameter in the page CheckDuplicateStudent.php is vulner… |
CVE-2020-6119 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The byear parameter in the page CheckDuplicateStudent.php is vu… |
CVE-2020-6118 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The bmonth parameter in the page CheckDuplicateStudent.php is v… |
CVE-2020-6117 | High | 8.8 | 2020-09-01 | SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The bday parameter in the page CheckDuplicateStudent.php is vul… |
CVE-2020-2251 | Medium | 4.3 | 2020-09-01 | Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms… |
CVE-2020-2250 | Medium | 6.5 | 2020-09-01 | Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they… |
CVE-2020-2249 | Low | 3.3 | 2020-09-01 | Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where… |
CVE-2020-2248 | Medium | 6.1 | 2020-09-01 | Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability. |
CVE-2020-2247 | Medium | 6.5 | 2020-09-01 | Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2246 | Medium | 5.4 | 2020-09-01 | Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploi… |
CVE-2020-2245 | High | 7.1 | 2020-09-01 | Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2244 | Medium | 5.4 | 2020-09-01 | Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS)… |
CVE-2020-2243 | Medium | 5.4 | 2020-09-01 | Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerabilit… |
CVE-2020-2242 | Medium | 6.5 | 2020-09-01 | A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified… |
CVE-2020-2241 | High | 8.8 | 2020-09-01 | A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specified database serv… |
CVE-2020-2240 | High | 8.8 | 2020-09-01 | A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to execute arbitrary SQL scripts. |
CVE-2020-2239 | Medium | 4.3 | 2020-09-01 | Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it c… |
CVE-2020-2238 | Medium | 5.4 | 2020-09-01 | Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scri… |
CVE-2020-24554 | High | 7.5 | 2020-09-01 | The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows remote attackers t… |
CVE-2020-14514 | Medium | 4.3 | 2020-09-01 | All trailer Power Line Communications are affected. PLC bus traffic can be sniffed reliably via an active antenna up to 6 feet away. Further distances are also… |
CVE-2020-24584 | High | 7.5 | 2020-09-01 | An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of… |
CVE-2020-24583 | High | 7.5 | 2020-09-01 | An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode… |
CVE-2020-8023 | High | 7.7 | 2020-09-01 | A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise… |
CVE-2020-7727 | Critical | 9.8 | 2020-09-01 | All versions of package gedi are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7726 | Critical | 9.8 | 2020-09-01 | All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function. |
CVE-2020-7725 | Critical | 9.8 | 2020-09-01 | All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function. |
CVE-2020-7724 | Critical | 9.8 | 2020-09-01 | All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7723 | Critical | 9.8 | 2020-09-01 | All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function. |
CVE-2020-7722 | Critical | 9.8 | 2020-09-01 | All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function. |
CVE-2020-7721 | Critical | 9.8 | 2020-09-01 | All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function. |
CVE-2020-7720 | Critical | 9.8 | 2020-09-01 | The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the… |
CVE-2020-7719 | Critical | 9.8 | 2020-09-01 | Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function. |
CVE-2020-7718 | Critical | 9.8 | 2020-09-01 | All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions. |
CVE-2020-7717 | Critical | 9.8 | 2020-09-01 | All versions of package dot-notes are vulnerable to Prototype Pollution via the create function. |
CVE-2020-7716 | Critical | 9.8 | 2020-09-01 | All versions of package deeps are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7715 | Critical | 9.8 | 2020-09-01 | All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function. |
CVE-2020-7714 | Critical | 9.8 | 2020-09-01 | All versions of package confucious are vulnerable to Prototype Pollution via the set function. |
CVE-2020-7713 | Critical | 9.8 | 2020-09-01 | All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor. |
CVE-2020-12776 | Medium | 6.6 | 2020-09-01 | Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator acc… |
CVE-2020-14178 | High | 7.5 | 2020-09-01 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the… |
CVE-2020-25067 | Critical | 9.6 | 2020-09-01 | NETGEAR R8300 devices before 1.0.2.134 are affected by command injection by an unauthenticated attacker. |
CVE-2020-15704 | Medium | 5.5 | 2020-09-01 | The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-root attacker could ex… |
CVE-2020-25065 | High | 7.5 | 2020-08-31 | An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software. Key logging may occur because of an… |
CVE-2020-25064 | High | 7.5 | 2020-08-31 | An issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8.1, 9.0, and 10 software. Certain automated testing is mishand… |
CVE-2020-25063 | High | 7.5 | 2020-08-31 | An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. An application crash can occur because of incorrect application… |
CVE-2020-25062 | Critical | 9.8 | 2020-08-31 | An issue was discovered on LG mobile devices with Android OS 9 and 10 software. LGTelephonyProvider allows a bypass of intended privilege restrictions. The LG… |
CVE-2020-25061 | Critical | 9.8 | 2020-08-31 | An issue was discovered on LG mobile devices with Android OS 9 and 10 software on the VZW network. lge_property allows property overwrites. The LG ID is LVE-SM… |
CVE-2020-25060 | High | 7.8 | 2020-08-31 | An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Local users can gain privileges because of LAF and SBL1 flaws… |
CVE-2020-25059 | High | 7.5 | 2020-08-31 | An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A service crash may occur because of incorrect input validation… |
CVE-2020-25058 | Critical | 9.8 | 2020-08-31 | An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. The network_management service does not properly restrict configurat… |
CVE-2020-25057 | Critical | 9.8 | 2020-08-31 | An issue was discovered on LG mobile devices with Android OS 10 software. MDMService does not properly restrict APK installations. The LG ID is LVE-SMP-200011… |
CVE-2020-25056 | High | 7.5 | 2020-08-31 | An issue was discovered on Samsung mobile devices with Q(10.0) (Galaxy S20) software. Because HAL improperly checks versions, bootloading by the S.LSI NFC chip… |
CVE-2020-25055 | Critical | 9.8 | 2020-08-31 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The persona service allows attackers (who control an unprivileged… |
CVE-2020-25054 | Critical | 9.1 | 2020-08-31 | An issue was discovered on Samsung mobile devices with software through 2020-04-02 (Exynos modem chipsets). There is a heap-based buffer over-read in the Shann… |
CVE-2020-25053 | Critical | 9.8 | 2020-08-31 | An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. RKP allows arbitrary code execution. The Samsung ID is SVE-2020-… |
CVE-2020-25052 | Critical | 9.8 | 2020-08-31 | An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. H-Arx allows attackers to execute arbitrary code or cause a deni… |
CVE-2020-25051 | High | 7.5 | 2020-08-31 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via AppInfo. The Samsun… |
CVE-2020-25050 | High | 7.5 | 2020-08-31 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The CMC service allows attackers to obtain sensitive information. The Samsu… |
CVE-2020-25049 | Critical | 9.8 | 2020-08-31 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. StatusBarService has insufficient DEX access control. The Samsung ID is SVE… |
CVE-2020-25048 | Medium | 4.6 | 2020-08-31 | An issue was discovered on Samsung mobile devices with Q(10.0) (with ONEUI 2.1) software. In the Lockscreen state, the Quick Share feature allows unauthenticat… |
CVE-2020-25047 | Medium | 5.5 | 2020-08-31 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (released in China and India) software. The S Secure application does not enforce the… |
CVE-2020-25046 | Medium | 5.5 | 2020-08-31 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The USB driver leaks address information via kernel logging. The S… |
CVE-2020-2075 | High | 7.5 | 2020-08-31 | Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulkscan LMS111, Bulkscan LMS511, CLV62x – CLV… |
CVE-2020-24354 | High | 8.8 | 2020-08-31 | Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by shell injection. |
CVE-2020-14364 | Medium | 5.0 | 2020-08-31 | An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from… |
CVE-2020-7527 | High | 7.8 | 2020-08-31 | Incorrect Default Permission vulnerability exists in SoMove (V2.8.1) and prior which could cause elevation of privilege and provide full access control to loca… |
CVE-2020-7526 | High | 8.8 | 2020-08-31 | Improper Input Validation vulnerability exists in PowerChute Business Edition (software V9.0.x and earlier) which could cause remote code execution when a scri… |
CVE-2020-7525 | High | 7.5 | 2020-08-31 | Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (formerly homeLYnk) whic… |
CVE-2020-7524 | High | 7.5 | 2020-08-31 | Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (V5.0.0.7 and prior) which could cause Denial of Service when sending specific crafte… |
CVE-2020-7523 | High | 7.8 | 2020-08-31 | Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification for versions) which could cause local… |
CVE-2020-7522 | Critical | 9.8 | 2020-08-31 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earl… |
CVE-2020-7521 | Critical | 9.8 | 2020-08-31 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earl… |
CVE-2020-20628 | Medium | 6.1 | 2020-08-31 | controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS. |
CVE-2020-24699 | Medium | 6.1 | 2020-08-31 | The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS. |
CVE-2020-24363 | High | 8.8 | 2020-08-31 | TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset… |
CVE-2020-20627 | Medium | 5.3 | 2020-08-31 | The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change. |
CVE-2020-20626 | Medium | 5.4 | 2020-08-31 | lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS. |
CVE-2020-20625 | High | 7.5 | 2020-08-31 | Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php. |
CVE-2020-17465 | Medium | 6.1 | 2020-08-31 | Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects versions 6.5.0.4, 6.0… |
CVE-2020-15687 | High | 7.5 | 2020-08-31 | Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious entity, with root access in the Service… |
CVE-2020-13828 | Medium | 5.4 | 2020-08-31 | Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary w… |
CVE-2020-13472 | Medium | 4.6 | 2020-08-31 | The flash memory readout protection in Gigadevice GD32F103 devices allows physical attackers to extract firmware via the debug interface by utilizing the DMA m… |
CVE-2020-13471 | Medium | 6.8 | 2020-08-31 | Apex Microelectronics APM32F103 devices allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/breakpoint unit config… |
CVE-2020-13470 | Medium | 4.6 | 2020-08-31 | Gigadevice GD32F103 and GD32F130 devices allow physical attackers to extract data via the probing of easily accessible bonding wires and de-obfuscation of the… |
CVE-2020-13469 | Medium | 4.6 | 2020-08-31 | The flash memory readout protection in Gigadevice GD32VF103 devices allows physical attackers to extract firmware via the debug interface by utilizing the CPU. |
CVE-2020-13468 | Medium | 6.8 | 2020-08-31 | Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection into inter-IC bonding wires (which have… |