2020 CVEs (page 108)
Page 108 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13467 | Medium | 4.6 | 2020-08-31 | The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmware via the debug int… |
CVE-2020-13466 | Medium | 6.8 | 2020-08-31 | STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/breakp… |
CVE-2020-13465 | Medium | 6.8 | 2020-08-31 | The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execute arbitrary code via the debug interfac… |
CVE-2020-13464 | Medium | 4.2 | 2020-08-31 | The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmware via the debug int… |
CVE-2020-13463 | Medium | 4.6 | 2020-08-31 | The flash memory readout protection in Apex Microelectronics APM32F103 devices allows physical attackers to extract firmware via the debug interface and except… |
CVE-2020-5419 | Medium | 6.7 | 2020-08-31 | RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An atta… |
CVE-2020-24786 | Critical | 9.8 | 2020-08-31 | An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build n… |
CVE-2020-13655 | Medium | 6.1 | 2020-08-31 | An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is set to movefile and the id parameter cor… |
CVE-2020-13595 | Medium | 6.5 | 2020-08-31 | The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number of completed BLE pac… |
CVE-2020-13594 | Medium | 6.5 | 2020-08-31 | The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does not properly restrict the channel map fi… |
CVE-2020-13593 | High | 8.8 | 2020-08-31 | The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R2-SDK through 2.2.3 allows the Diffie-H… |
CVE-2020-12829 | Low | 3.8 | 2020-08-31 | In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO wr… |
CVE-2020-12646 | Medium | 5.4 | 2020-08-31 | OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document. |
CVE-2020-12645 | Critical | 9.8 | 2020-08-31 | OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory c… |
CVE-2020-12644 | Medium | 5.0 | 2020-08-31 | OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API. |
CVE-2020-12643 | Medium | 4.3 | 2020-08-31 | OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address. |
CVE-2020-11618 | High | 7.8 | 2020-08-31 | THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes have their TELNET service hardcoded to start on boot, which allows an attacker on th… |
CVE-2020-11617 | Medium | 5.9 | 2020-08-31 | The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the SSL certificates of RSS servers, which a… |
CVE-2020-24115 | Critical | 9.8 | 2020-08-31 | In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access. |
CVE-2020-4492 | Medium | 5.5 | 2020-08-31 | IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a denial of service crashing the kernel by se… |
CVE-2020-15020 | Medium | 5.4 | 2020-08-31 | An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field. |
CVE-2020-25033 | Medium | 6.1 | 2020-08-31 | The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS. |
CVE-2020-25032 | High | 7.5 | 2020-08-31 | An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resou… |
CVE-2020-25031 | High | 7.8 | 2020-08-31 | checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 executable file. |
CVE-2020-24104 | Medium | 6.1 | 2020-08-30 | XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials without being connected to the network. Th… |
CVE-2020-8097 | High | 8.1 | 2020-08-30 | An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local… |
CVE-2020-24223 | Medium | 6.1 | 2020-08-30 | Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters. |
CVE-2020-24917 | Medium | 6.1 | 2020-08-30 | osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php. |
CVE-2020-8244 | Medium | 6.5 | 2020-08-30 | A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it end… |
CVE-2020-14352 | High | 8.0 | 2020-08-30 | A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository met… |
CVE-2020-7712 | High | 7.2 | 2020-08-30 | This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function. |
CVE-2020-24972 | High | 8.8 | 2020-08-29 | The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported… |
CVE-2020-24928 | Medium | 5.3 | 2020-08-29 | managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server (port 3020) open to all origins, which allows attackers to obtain se… |
CVE-2020-24898 | High | 7.6 | 2020-08-29 | The Table Filter and Charts for Confluence Server app before 5.3.26 (for Atlassian Confluence) allows SSRF via the "Table from CSV" macro (URL parameter). |
CVE-2020-24897 | High | 8.9 | 2020-08-29 | The Table Filter and Charts for Confluence Server app before 5.3.25 (for Atlassian Confluence) allow remote attackers to inject arbitrary HTML or JavaScript vi… |
CVE-2020-25020 | Critical | 9.8 | 2020-08-29 | MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components. |
CVE-2020-25019 | High | 7.5 | 2020-08-29 | jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or http… |
CVE-2020-3566 | High | 8.6 | 2020-08-29 | A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to e… |
CVE-2020-25016 | Critical | 9.1 | 2020-08-29 | A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninit… |
CVE-2020-15159 | High | 7.6 | 2020-08-28 | baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administra… |
CVE-2020-15155 | High | 7.3 | 2020-08-28 | baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. Th… |
CVE-2020-15154 | High | 7.3 | 2020-08-28 | baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. Th… |
CVE-2020-15165 | Critical | 9.3 | 2020-08-28 | Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official ma… |
CVE-2020-16610 | Medium | 4.3 | 2020-08-28 | Hoosk Codeigniter CMS before 1.7.2 is affected by a Cross Site Request Forgery (CSRF). When an attacker induces authenticated admin user to a malicious web pag… |
CVE-2020-15164 | Critical | 10.0 | 2020-08-28 | in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated unders… |
CVE-2020-9298 | High | 7.5 | 2020-08-28 | The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spi… |
CVE-2020-4591 | Low | 3.3 | 2020-08-28 | IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the sec… |
CVE-2020-4559 | High | 7.5 | 2020-08-28 | IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. IBM X-Force ID: 183613. |
CVE-2020-5625 | Medium | 6.1 | 2020-08-28 | Cross-site scripting vulnerability in XooNIps 3.48 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors. |
CVE-2020-5624 | Critical | 9.8 | 2020-08-28 | SQL injection vulnerability in the XooNIps 3.48 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
CVE-2020-5623 | Medium | 6.1 | 2020-08-28 | NITORI App for Android versions 6.0.4 and earlier and NITORI App for iOS versions 6.0.2 and earlier allow remote attackers to lead a user to access an arbitrar… |
CVE-2020-5621 | Medium | 4.3 | 2020-08-28 | Cross-site request forgery (CSRF) vulnerability in NETGEAR switching hubs (GS716Tv2 Firmware version 5.4.2.30 and earlier, and GS724Tv3 Firmware version 5.4.2… |
CVE-2020-24715 | Critical | 9.8 | 2020-08-27 | The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the… |
CVE-2020-24714 | Critical | 9.8 | 2020-08-27 | The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verify_hostname… |
CVE-2020-10518 | High | 8.8 | 2020-08-27 | A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled con… |
CVE-2020-10517 | Medium | 4.3 | 2020-08-27 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of… |
CVE-2020-8602 | High | 7.2 | 2020-08-27 | A vulnerability in the management consoles of Trend Micro Deep Security 10.0-12.0 and Trend Micro Vulnerability Protection 2.0 SP2 may allow an authenticated a… |
CVE-2020-15605 | High | 8.1 | 2020-08-27 | If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection 2.0 SP2 could allow an unauthenticated a… |
CVE-2020-15601 | High | 8.1 | 2020-08-27 | If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Deep Security 10.x-12.x could allow an unauthenticated attacker w… |
CVE-2020-24618 | Medium | 6.5 | 2020-08-27 | In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can retrieve an issue… |
CVE-2020-5383 | Medium | 5.3 | 2020-08-27 | Dell EMC Isilon OneFS version 8.2.2 and Dell EMC PowerScale OneFS version 9.0.0 contains a buffer overflow vulnerability in the Likewise component. A remote un… |
CVE-2020-24717 | High | 7.8 | 2020-08-27 | OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777. |
CVE-2020-24716 | High | 7.8 | 2020-08-27 | OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories. |
CVE-2020-24203 | Critical | 9.8 | 2020-08-27 | Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows… |
CVE-2020-24202 | Critical | 9.8 | 2020-08-27 | File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regular users, which allows remote attackers… |
CVE-2020-24196 | High | 7.2 | 2020-08-27 | An Arbitrary File Upload in Vehicle Image Upload in Online Bike Rental v1.0 allows authenticated admin to conduct remote code execution. |
CVE-2020-3517 | High | 8.6 | 2020-08-27 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to cause process… |
CVE-2020-3504 | Low | 3.3 | 2020-08-27 | A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of servic… |
CVE-2020-3454 | High | 7.2 | 2020-08-27 | A vulnerability in the Call Home feature of Cisco NX-OS Software could allow an authenticated, remote attacker to inject arbitrary commands that could be execu… |
CVE-2020-3415 | High | 8.8 | 2020-08-27 | A vulnerability in the Data Management Engine (DME) of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with ad… |
CVE-2020-3398 | High | 8.6 | 2020-08-27 | A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacke… |
CVE-2020-3397 | High | 8.6 | 2020-08-27 | A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacke… |
CVE-2020-3394 | High | 7.8 | 2020-08-27 | A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an a… |
CVE-2020-3338 | High | 7.5 | 2020-08-27 | A vulnerability in the Protocol Independent Multicast (PIM) feature for IPv6 networks (PIM6) of Cisco NX-OS Software could allow an unauthenticated, remote att… |
CVE-2020-24706 | Medium | 6.1 | 2020-08-27 | An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS… |
CVE-2020-24705 | High | 8.8 | 2020-08-27 | An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim s… |
CVE-2020-24704 | Medium | 6.1 | 2020-08-27 | An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microg… |
CVE-2020-24703 | High | 8.8 | 2020-08-27 | An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim s… |
CVE-2020-24390 | Medium | 6.1 | 2020-08-27 | eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS duri… |
CVE-2020-23576 | Medium | 5.4 | 2020-08-27 | Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab. |
CVE-2020-16142 | Low | 3.5 | 2020-08-27 | On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMA… |
CVE-2020-14415 | Low | 3.3 | 2020-08-27 | oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position. |
CVE-2020-23984 | Medium | 5.4 | 2020-08-27 | Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags. |
CVE-2020-23983 | Medium | 5.4 | 2020-08-27 | Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags. |
CVE-2020-23982 | Medium | 6.1 | 2020-08-27 | DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php' |
CVE-2020-23981 | Medium | 6.1 | 2020-08-27 | 13enforme CMS 1.0 has Cross Site Scripting via the "content.php" id parameter. |
CVE-2020-23979 | Critical | 9.8 | 2020-08-27 | 13enforme CMS 1.0 has SQL Injection via the 'content.php' id parameter. |
CVE-2020-23978 | Critical | 9.8 | 2020-08-27 | SQL injection can occur in Soluzione Globale Ecommerce CMS v1 via the parameter " offerta.php" |
CVE-2020-23977 | Medium | 6.1 | 2020-08-27 | KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the 'team.php,player.php,club.php' id parameter. |
CVE-2020-23976 | Critical | 9.8 | 2020-08-27 | Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has SQL Injection via the 'content.php' id parameter. |
CVE-2020-23975 | Medium | 6.1 | 2020-08-27 | Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter. |
CVE-2020-23974 | Medium | 5.4 | 2020-08-27 | Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), Add new client (al… |
CVE-2020-23973 | Critical | 9.8 | 2020-08-27 | KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter. |
CVE-2020-23972 | High | 7.5 | 2020-08-27 | In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload… |
CVE-2020-4603 | High | 7.2 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or… |
CVE-2020-4575 | Medium | 6.1 | 2020-08-27 | IBM WebSphere Application Server ND 8.5 and 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting when High Availability… |
CVE-2020-4175 | Medium | 5.9 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transp… |
CVE-2020-4174 | High | 7.5 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4172 | Medium | 5.3 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have acces… |
CVE-2020-4171 | Medium | 4.3 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174407. |