2020 CVEs (page 109)
Page 109 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4169 | High | 7.5 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4167 | Medium | 6.5 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 could allow an attacker to obtain sensitive information or perform unauthorized actions due to improper authenciation mech… |
CVE-2020-4166 | Medium | 5.3 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2020-23980 | Critical | 9.8 | 2020-08-27 | DesignMasterEvents Conference management 1.0.0 allows SQL Injection via the username field on the administrator login page. |
CVE-2020-14729 | Medium | 5.4 | 2020-08-27 | Vulnerability in SuiteCommerce Advanced (SCA) Sites component of Oracle NetSuite service. Supported versions that are affected are prior to 2020.1.4. Difficult… |
CVE-2020-14728 | Medium | 5.4 | 2020-08-27 | Vulnerability in the SuiteCommerce Advanced (SCA) component of Oracle NetSuite service. Supported versions that are affected are Montblanc, Vinson, Elbrus, Kil… |
CVE-2020-24599 | Medium | 6.1 | 2020-08-26 | An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks. |
CVE-2020-24598 | Medium | 6.1 | 2020-08-26 | An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect. |
CVE-2020-15485 | Medium | 5.5 | 2020-08-26 | An issue was discovered on Nescomed Multipara Monitor M1000 devices. The onboard Flash memory stores data in cleartext, without integrity protection against ta… |
CVE-2020-24548 | Medium | 5.3 | 2020-08-26 | Ericom Access Server 9.2.0 (for AccessNow and Ericom Blaze) allows SSRF to make outbound WebSocket connection requests on arbitrary TCP ports, and provides "Ca… |
CVE-2020-17376 | High | 8.3 | 2020-08-26 | An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot… |
CVE-2020-15156 | Medium | 6.8 | 2020-08-26 | In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on… |
CVE-2020-12855 | High | 8.8 | 2020-08-26 | A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11. Authenticated remote adversaries can poison this header resulting in an… |
CVE-2020-12456 | High | 8.8 | 2020-08-26 | A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notif… |
CVE-2020-11797 | High | 7.5 | 2020-08-26 | An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could… |
CVE-2020-11497 | High | 7.5 | 2020-08-26 | An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marke… |
CVE-2020-23660 | Medium | 5.4 | 2020-08-26 | webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search." |
CVE-2020-23659 | Medium | 5.4 | 2020-08-26 | WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature. |
CVE-2020-23658 | Medium | 5.4 | 2020-08-26 | PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php. |
CVE-2020-15158 | High | 7.7 | 2020-08-26 | In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap… |
CVE-2020-13863 | High | 8.1 | 2020-08-26 | The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improp… |
CVE-2020-13767 | Medium | 5.9 | 2020-08-26 | The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access contro… |
CVE-2020-13617 | High | 7.5 | 2020-08-26 | The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker to expose sensitiv… |
CVE-2020-3523 | Medium | 6.5 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to con… |
CVE-2020-3522 | Medium | 6.3 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to byp… |
CVE-2020-3521 | Medium | 5.3 | 2020-08-26 | A vulnerability in a specific REST API of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct directory… |
CVE-2020-3520 | Medium | 5.5 | 2020-08-26 | A vulnerability in Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, local attacker to obtain confidential information from an af… |
CVE-2020-3519 | High | 8.1 | 2020-08-26 | A vulnerability in a specific REST API method of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct a p… |
CVE-2020-3518 | Medium | 6.5 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to con… |
CVE-2020-3507 | High | 8.8 | 2020-08-26 | Multiple vulnerabilities in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adj… |
CVE-2020-3506 | High | 8.8 | 2020-08-26 | Multiple vulnerabilities in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adj… |
CVE-2020-3505 | Medium | 6.5 | 2020-08-26 | A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a… |
CVE-2020-3496 | Medium | 5.3 | 2020-08-26 | A vulnerability in the IPv6 packet processing engine of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to caus… |
CVE-2020-3491 | Medium | 5.5 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrativ… |
CVE-2020-3490 | Medium | 4.9 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrativ… |
CVE-2020-3485 | Medium | 6.3 | 2020-08-26 | A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an au… |
CVE-2020-3484 | Medium | 5.3 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to view potentia… |
CVE-2020-3466 | Medium | 6.1 | 2020-08-26 | Multiple vulnerabilities in the web-based management interface of Cisco DNA Center software could allow an unauthenticated, remote attacker to conduct a cross-… |
CVE-2020-3446 | Critical | 9.8 | 2020-08-26 | A vulnerability in Cisco Virtual Wide Area Application Services (vWAAS) with Cisco Enterprise NFV Infrastructure Software (NFVIS)-bundled images for Cisco ENCS… |
CVE-2020-3443 | High | 8.8 | 2020-08-26 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and execute commands… |
CVE-2020-3440 | Medium | 6.5 | 2020-08-26 | A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an unauthenticated, remote attacker to overwrite arbitrary files on an end-user sys… |
CVE-2020-3439 | Medium | 4.8 | 2020-08-26 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to con… |
CVE-2020-3389 | Medium | 4.4 | 2020-08-26 | A vulnerability in the installation component of Cisco Hyperflex HX-Series Software could allow an authenticated, local attacker to retrieve the password that… |
CVE-2020-3152 | Medium | 6.7 | 2020-08-26 | A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to execute arbitrary c… |
CVE-2020-3151 | Medium | 6.7 | 2020-08-26 | A vulnerability in the CLI of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to bypass r… |
CVE-2020-23657 | Medium | 5.4 | 2020-08-26 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration." |
CVE-2020-23656 | Medium | 5.4 | 2020-08-26 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content." |
CVE-2020-23655 | Medium | 5.4 | 2020-08-26 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration." |
CVE-2020-23654 | Medium | 5.4 | 2020-08-26 | NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) via the module "Shop." |
CVE-2020-5928 | Low | 3.1 | 2020-08-26 | In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM Configuration utility CSRF pro… |
CVE-2020-5927 | Medium | 6.1 | 2020-08-26 | In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, BIG-IP ASM Configuration utility Stored-Cross Site Scripting. |
CVE-2020-5926 | High | 7.5 | 2020-08-26 | In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server with a Session Initiation Protocol (SIP) ALG profile, parsing… |
CVE-2020-5925 | High | 7.5 | 2020-08-26 | In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed internally generated U… |
CVE-2020-5921 | High | 7.5 | 2020-08-26 | in BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, Syn flood causes large number of M… |
CVE-2020-24661 | Medium | 5.9 | 2020-08-26 | GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certifica… |
CVE-2020-15486 | Medium | 6.5 | 2020-08-26 | An issue was discovered on Dr Trust ECG Pen 2.00.08 devices. Because the Bluetooth LE support is implemented without a requirement for pairing or security, any… |
CVE-2020-15483 | Medium | 6.8 | 2020-08-26 | An issue was discovered on Nescomed Multipara Monitor M1000 devices. The physical UART debug port provides a shell, without requiring a password, with complete… |
CVE-2020-15482 | High | 7.8 | 2020-08-26 | An issue was discovered on Nescomed Multipara Monitor M1000 devices. The device enables an unencrypted TELNET service by default, with a blank password for the… |
CVE-2020-13821 | Medium | 5.4 | 2020-08-26 | An issue was discovered in HiveMQ Broker Control Center 4.3.2. A crafted clientid parameter in an MQTT packet (sent to the Broker) is reflected in the client s… |
CVE-2020-5924 | Medium | 5.3 | 2020-08-26 | In BIG-IP APM versions 12.1.0-12.1.5.1 and 11.6.1-11.6.5.2, RADIUS authentication leaks memory when the username for authentication is not set. |
CVE-2020-5923 | Medium | 5.4 | 2020-08-26 | In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 and BIG-IQ versions 5.4.0-7.0.0, Self-IP port-lockdo… |
CVE-2020-5922 | High | 8.8 | 2020-08-26 | In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request… |
CVE-2020-5920 | Medium | 4.3 | 2020-08-26 | In versions 15.0.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a vulnerability in the BIG-IP AFM Configuration utility ma… |
CVE-2020-5919 | High | 7.5 | 2020-08-26 | In versions 15.1.0-15.1.0.4, rendering of certain session variables by BIG-IP APM UI-based agents in an access profile configured with Modern customization, ma… |
CVE-2020-5918 | High | 7.5 | 2020-08-26 | In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management Microkernel… |
CVE-2020-5917 | Medium | 5.9 | 2020-08-26 | In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2 and BIG-IQ versions 5.2.0-7.0.0, th… |
CVE-2020-5916 | Medium | 6.8 | 2020-08-26 | In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads out… |
CVE-2020-5915 | Medium | 6.1 | 2020-08-26 | In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an undisclosed TMUI page contains… |
CVE-2020-5914 | High | 7.5 | 2020-08-26 | In BIG-IP ASM versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, undisclosed server cookie scen… |
CVE-2020-5913 | High | 7.4 | 2020-08-26 | In versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, the BIG-IP Client or Server SSL profile ignores revoked ce… |
CVE-2020-5912 | High | 7.1 | 2020-08-26 | In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump comma… |
CVE-2020-16251 | High | 8.2 | 2020-08-26 | HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed… |
CVE-2020-16250 | High | 8.2 | 2020-08-26 | HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed… |
CVE-2020-15484 | High | 7.5 | 2020-08-26 | An issue was discovered on Nescomed Multipara Monitor M1000 devices. The internal storage of the underlying Linux system stores data in cleartext, without inte… |
CVE-2020-13410 | High | 7.5 | 2020-08-26 | An issue was discovered in MoscaJS Aedes 0.42.0. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream. |
CVE-2020-24316 | Medium | 6.1 | 2020-08-26 | WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a… |
CVE-2020-24315 | High | 7.5 | 2020-08-26 | Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This all… |
CVE-2020-24008 | Medium | 5.3 | 2020-08-26 | Umanni RH 1.0 has a user enumeration vulnerability. This issue occurs during password recovery, where a difference in messages could allow an attacker to deter… |
CVE-2020-24007 | Critical | 9.8 | 2020-08-26 | Umanni RH 1.0 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authenticati… |
CVE-2020-19007 | Medium | 5.4 | 2020-08-26 | Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute i… |
CVE-2020-14498 | Critical | 9.6 | 2020-08-26 | HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute… |
CVE-2020-24314 | Medium | 6.1 | 2020-08-26 | Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This… |
CVE-2020-24313 | Medium | 6.1 | 2020-08-26 | Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointment_ID" GET parameter… |
CVE-2020-24312 | High | 7.5 | 2020-08-26 | mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This results in the ability fo… |
CVE-2020-15499 | Medium | 6.1 | 2020-08-26 | An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253. They allow XSS via spoofed Release Notes on the Firmware Upgrade page. |
CVE-2020-15498 | Medium | 5.9 | 2020-08-26 | An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253. The router accepts an arbitrary server certificate for a firmware update. The culp… |
CVE-2020-16193 | Medium | 5.4 | 2020-08-26 | osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call. |
CVE-2020-7309 | Low | 3.9 | 2020-08-26 | Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or… |
CVE-2020-24656 | Medium | 6.5 | 2020-08-26 | Maltego before 4.2.12 allows XXE attacks. |
CVE-2020-24653 | Critical | 9.8 | 2020-08-26 | secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used. |
CVE-2020-19005 | Medium | 5.7 | 2020-08-25 | zrlog v2.1.0 has a vulnerability with the permission check. If admin account is logged in, other unauthorized users can download the database backup file direc… |
CVE-2020-15777 | High | 7.8 | 2020-08-25 | An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects… |
CVE-2020-17404 | High | 7.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-17403 | High | 7.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-17402 | Medium | 6.5 | 2020-08-25 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4 (47270). An attacker must fir… |
CVE-2020-17401 | Medium | 6.0 | 2020-08-25 | This vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Desktop 15.1.4. An attacker must first obta… |
CVE-2020-17400 | High | 8.8 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abili… |
CVE-2020-17399 | High | 8.8 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abili… |
CVE-2020-17398 | Medium | 6.5 | 2020-08-25 | This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abil… |
CVE-2020-17397 | High | 8.2 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abili… |