2020 CVEs (page 11)
Page 11 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-36563 | Medium | 5.3 | 2022-12-28 | XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending… |
CVE-2020-36562 | High | 7.5 | 2022-12-28 | Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector. |
CVE-2020-36636 | Low | 3.5 | 2022-12-27 | A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x. Affected is the function sendErrorMessage of the file omod/src… |
CVE-2020-36635 | Low | 3.5 | 2022-12-27 | A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x. It has been classified as problematic. This affects the function validateField… |
CVE-2020-36569 | Critical | 9.1 | 2022-12-27 | Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896… |
CVE-2020-36568 | High | 7.5 | 2022-12-27 | Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation. |
CVE-2020-36566 | Critical | 9.1 | 2022-12-27 | Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory. |
CVE-2020-36564 | High | 7.5 | 2022-12-27 | Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be… |
CVE-2020-36561 | Critical | 9.1 | 2022-12-27 | Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory. |
CVE-2020-36560 | Critical | 9.1 | 2022-12-27 | Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory. |
CVE-2020-36559 | High | 7.5 | 2022-12-27 | Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target director… |
CVE-2020-36567 | High | 7.5 | 2022-12-27 | Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines. |
CVE-2020-36626 | Medium | 5.5 | 2022-12-27 | A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of… |
CVE-2020-36634 | Low | 2.6 | 2022-12-27 | A vulnerability classified as problematic has been found in Indeed Engineering util up to 1.0.33. Affected is the function visit/appendTo of the file varexport… |
CVE-2020-36633 | Medium | 4.3 | 2022-12-27 | A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews… |
CVE-2020-28191 | High | 8.8 | 2022-12-26 | The console in Togglz before 2.9.4 allows CSRF. |
CVE-2020-24600 | Critical | 9.8 | 2022-12-26 | Shilpi CAPExWeb 1.1 allows SQL injection via a servlet/capexweb.cap_sendMail GET request. |
CVE-2020-11101 | Critical | 9.8 | 2022-12-26 | Sierra Wireless AirLink Mobility Manager (AMM) before 2.17 mishandles sessions and thus an unauthenticated attacker can obtain a login session with administrat… |
CVE-2020-10650 | High | 8.1 | 2022-12-26 | A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or… |
CVE-2020-12069 | High | 7.8 | 2022-12-26 | In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords… |
CVE-2020-12067 | High | 7.5 | 2022-12-26 | In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker without knowledge of the… |
CVE-2020-36632 | Medium | 6.3 | 2022-12-25 | A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipula… |
CVE-2020-36631 | Medium | 6.3 | 2022-12-25 | A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerability affects the function update_profil… |
CVE-2020-36630 | Medium | 5.5 | 2022-12-25 | A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The man… |
CVE-2020-36629 | Medium | 5.5 | 2022-12-25 | A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The… |
CVE-2020-36628 | Medium | 5.5 | 2022-12-25 | A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/a… |
CVE-2020-36627 | Medium | 5.5 | 2022-12-25 | A vulnerability was found in Macaron i18n. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file i18n.go… |
CVE-2020-26302 | High | 7.5 | 2022-12-22 | is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of… |
CVE-2020-15685 | High | 8.8 | 2022-12-22 | During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulner… |
CVE-2020-15679 | High | 7.6 | 2022-12-22 | An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that… |
CVE-2020-36625 | Medium | 4.3 | 2022-12-22 | A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The man… |
CVE-2020-36624 | Medium | 6.3 | 2022-12-22 | A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_h… |
CVE-2020-36623 | Medium | 4.3 | 2022-12-21 | A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The ma… |
CVE-2020-36622 | Medium | 4.3 | 2022-12-21 | A vulnerability was found in sah-comp bienlein and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site… |
CVE-2020-36621 | Low | 3.5 | 2022-12-21 | A vulnerability, which was classified as problematic, has been found in chedabob whatismyudid. Affected by this issue is the function exports.enrollment of the… |
CVE-2020-36620 | Low | 3.5 | 2022-12-21 | A vulnerability was found in Brondahl EnumStringValues up to 4.0.0. It has been declared as problematic. This vulnerability affects the function GetStringValue… |
CVE-2020-36619 | Medium | 5.5 | 2022-12-19 | A vulnerability was found in multimon-ng. It has been rated as critical. This issue affects the function add_ch of the file demod_flex.c. The manipulation of t… |
CVE-2020-36618 | Medium | 6.3 | 2022-12-19 | A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to… |
CVE-2020-36617 | Medium | 4.6 | 2022-12-18 | A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file… |
CVE-2020-36607 | Medium | 6.1 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag. |
CVE-2020-24855 | Medium | 5.3 | 2022-12-15 | Directory Traversal vulnerability in easywebpack-cli before 4.5.2 allows attackers to obtain sensitive information via crafted GET request. |
CVE-2020-21219 | Medium | 6.1 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code v… |
CVE-2020-20589 | Medium | 6.1 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag. |
CVE-2020-20588 | High | 8.8 | 2022-12-15 | File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code via avatar upload t… |
CVE-2020-4497 | Medium | 6.8 | 2022-12-14 | IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum… |
CVE-2020-9420 | Medium | 6.5 | 2022-12-14 | The login password of the web administrative dashboard in Arcadyan Wifi routers VRV9506JAC23 is sent in cleartext, allowing an attacker to sniff and intercept… |
CVE-2020-9419 | Medium | 5.4 | 2022-12-14 | Multiple stored cross-site scripting (XSS) vulnerabilities in Arcadyan Wifi routers VRV9506JAC23 allow remote attackers to inject arbitrary web script or HTML… |
CVE-2020-36610 | Medium | 4.3 | 2022-12-08 | A vulnerability was found in annyshow DuxCMS 2.1. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross… |
CVE-2020-36609 | Low | 2.4 | 2022-12-08 | A vulnerability was found in annyshow DuxCMS 2.1. It has been classified as problematic. This affects an unknown part of the file admin.php&r=article/AdminCont… |
CVE-2020-36565 | Medium | 5.3 | 2022-12-07 | Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of th… |
CVE-2020-6627 | Critical | 9.8 | 2022-12-06 | The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in ci… |
CVE-2020-23592 | High | 8.8 | 2022-11-23 | A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cro… |
CVE-2020-23591 | Critical | 9.8 | 2022-11-23 | A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker to upload arbitrary files through " /mgm… |
CVE-2020-23590 | Medium | 6.5 | 2022-11-23 | A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated remote attacker to conduct a cros… |
CVE-2020-23589 | Medium | 6.5 | 2022-11-23 | A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cro… |
CVE-2020-23588 | Medium | 4.3 | 2022-11-23 | A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cro… |
CVE-2020-23587 | Low | 3.1 | 2022-11-23 | A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to con… |
CVE-2020-23586 | Medium | 4.3 | 2022-11-23 | A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct… |
CVE-2020-23584 | Critical | 9.8 | 2022-11-23 | Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using… |
CVE-2020-23593 | Medium | 6.5 | 2022-11-23 | A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cros… |
CVE-2020-23585 | High | 8.8 | 2022-11-23 | A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028. T… |
CVE-2020-23583 | Critical | 9.8 | 2022-11-23 | OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "Ping… |
CVE-2020-23582 | Medium | 6.5 | 2022-11-21 | A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, remote attacker to conduct a cross-site… |
CVE-2020-12508 | High | 7.5 | 2022-11-15 | In s::can moni::tools in versions below 4.2 an unauthenticated attacker could get any file from the device by path traversal in the image-relocator module. |
CVE-2020-12507 | High | 8.8 | 2022-11-15 | In s::can moni::tools before version 4.2 an authenticated attacker could get full access to the database through SQL injection. This may result in loss of conf… |
CVE-2020-12931 | High | 7.8 | 2022-11-09 | Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentially leading to loss o… |
CVE-2020-12930 | High | 7.8 | 2022-11-09 | Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially leading to loss of i… |
CVE-2020-35473 | Medium | 4.3 | 2022-11-08 | An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended sca… |
CVE-2020-12509 | High | 7.5 | 2022-11-07 | In s::can moni::tools in versions below 4.2 an unauthenticated attacker could get any file from the device by path traversal in the camera-file module. |
CVE-2020-22820 | Critical | 9.8 | 2022-11-03 | MKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter. |
CVE-2020-22819 | Critical | 9.8 | 2022-11-03 | MKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter. |
CVE-2020-22818 | Critical | 9.8 | 2022-11-03 | MKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter. |
CVE-2020-36608 | Low | 3.5 | 2022-11-02 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS. Affected by this issue is some unknown functionality of the… |
CVE-2020-4099 | Medium | 5.9 | 2022-11-01 | The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could… |
CVE-2020-36605 | Medium | 6.6 | 2022-11-01 | Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Li… |
CVE-2020-21016 | Critical | 9.8 | 2022-10-31 | D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.php. |
CVE-2020-5355 | Medium | 4.3 | 2022-10-21 | The Dell Isilon OneFS versions 8.2.2 and earlier SSHD process improperly allows Transmission Control Protocol (TCP) and stream forwarding. This provides the re… |
CVE-2020-9285 | Medium | 6.8 | 2022-10-20 | Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attached to the Mini-PCI E… |
CVE-2020-12744 | High | 7.8 | 2022-10-20 | The MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair. |
CVE-2020-23648 | High | 7.5 | 2022-10-19 | Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / start_apply.htm, an attacker can change the administrator… |
CVE-2020-15853 | Medium | 5.3 | 2022-10-18 | supybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS. This takes quite a while to run, and zodbot stops responding t… |
CVE-2020-8976 | Critical | 9.6 | 2022-10-17 | The integrated server of the ZGR TPS200 NG on its 2.00 firmware version and 1.01 hardware version, allows a remote attacker to perform actions with the permiss… |
CVE-2020-8975 | High | 7.5 | 2022-10-17 | ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, allows a remote attacker with access to the web application and knowledge of the routes (… |
CVE-2020-8974 | Critical | 10.0 | 2022-10-17 | In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker… |
CVE-2020-8973 | Critical | 9.3 | 2022-10-17 | ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, does not properly accept specially constructed requests. This allows an attacker with acc… |
CVE-2020-14131 | Critical | 9.8 | 2022-10-11 | The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security expe… |
CVE-2020-14129 | Critical | 9.8 | 2022-10-11 | A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who ca… |
CVE-2020-15855 | Medium | 6.1 | 2022-10-07 | Two cross-site scripting vulnerabilities were fixed in Bodhi 5.6.1. |
CVE-2020-35675 | High | 8.8 | 2022-09-29 | BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable end… |
CVE-2020-35674 | Critical | 9.8 | 2022-09-29 | BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsib… |
CVE-2020-27602 | Critical | 9.8 | 2022-09-29 | BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken. |
CVE-2020-27601 | Low | 3.5 | 2022-09-29 | In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/compo… |
CVE-2020-15347 | Critical | 9.8 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account. |
CVE-2020-15346 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key. |
CVE-2020-15345 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_instances_for_update API. |
CVE-2020-15344 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_user_id_and_key API. |
CVE-2020-15343 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user_key API. |
CVE-2020-15342 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user API. |
CVE-2020-15341 | High | 7.5 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated update_all_realm_license API. |
CVE-2020-15340 | High | 7.5 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa SSH key. |