2020 CVEs (page 110)
Page 110 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-17396 | High | 8.8 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abili… |
CVE-2020-17395 | High | 8.2 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abili… |
CVE-2020-17394 | Medium | 6.0 | 2020-08-25 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtai… |
CVE-2020-17393 | Medium | 6.5 | 2020-08-25 | This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain th… |
CVE-2020-17392 | High | 8.8 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain the… |
CVE-2020-17391 | Medium | 6.5 | 2020-08-25 | This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain th… |
CVE-2020-17390 | High | 8.8 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the… |
CVE-2020-17389 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is… |
CVE-2020-17388 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is… |
CVE-2020-17387 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is… |
CVE-2020-15645 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is… |
CVE-2020-15644 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is… |
CVE-2020-15643 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is… |
CVE-2020-15642 | High | 8.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of installations of Marvell QConvergeConsole 5.5.0.64. Although… |
CVE-2020-15641 | High | 7.5 | 2020-08-25 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is… |
CVE-2020-15640 | High | 7.5 | 2020-08-25 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is… |
CVE-2020-15639 | Critical | 9.8 | 2020-08-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not requ… |
CVE-2020-7824 | Medium | 6.5 | 2020-08-25 | A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission. The vulnerability… |
CVE-2020-24622 | Medium | 4.9 | 2020-08-25 | In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user. |
CVE-2020-16245 | Critical | 9.8 | 2020-08-25 | Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download a… |
CVE-2020-16197 | Medium | 4.3 | 2020-08-25 | An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment… |
CVE-2020-24616 | High | 8.1 | 2020-08-25 | FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPD… |
CVE-2020-24609 | Medium | 6.1 | 2020-08-25 | TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration sec… |
CVE-2020-14042 | Medium | 6.1 | 2020-08-25 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of… |
CVE-2020-24614 | High | 8.8 | 2020-08-25 | Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-i… |
CVE-2020-24242 | Medium | 5.5 | 2020-08-25 | In Netwide Assembler (NASM) 2.15rc10, SEGV can be triggered in tok_text in asm/preproc.c by accessing READ memory. |
CVE-2020-24241 | Medium | 5.5 | 2020-08-25 | In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c. |
CVE-2020-24240 | Medium | 5.5 | 2020-08-25 | GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk onl… |
CVE-2020-14524 | Critical | 9.8 | 2020-08-25 | Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to a heap-based buffer overflow, whi… |
CVE-2020-14522 | High | 7.5 | 2020-08-25 | Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to uncontrolled resource consumption… |
CVE-2020-14512 | High | 8.1 | 2020-08-25 | GateManager versions prior to 9.2c, The affected product uses a weak hash type, which may allow an attacker to view user passwords. |
CVE-2020-14510 | Critical | 9.8 | 2020-08-25 | GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as… |
CVE-2020-14508 | High | 8.1 | 2020-08-25 | GateManager versions prior to 9.2c, The affected product is vulnerable to an off-by-one error, which may allow an attacker to remotely execute arbitrary code o… |
CVE-2020-14500 | Critical | 10.0 | 2020-08-25 | Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data. |
CVE-2020-17386 | Medium | 6.5 | 2020-08-25 | Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL para… |
CVE-2020-17385 | High | 7.5 | 2020-08-25 | Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly, which allows unauthorized user to launch Path Traversal attack and access ar… |
CVE-2020-17384 | High | 7.2 | 2020-08-25 | Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With the cookie of the system administrator, attackers can inject and remote… |
CVE-2020-5620 | Medium | 5.4 | 2020-08-25 | Cross-site scripting vulnerability in Exment prior to v3.6.0 allows remote authenticated attackers to inject arbitrary script or HTML via a specially crafted f… |
CVE-2020-5619 | Medium | 5.4 | 2020-08-25 | Cross-site scripting vulnerability in Exment prior to v3.6.0 allows remote authenticated attackers to inject arbitrary script or HTML via unspecified vectors. |
CVE-2020-5541 | Medium | 6.1 | 2020-08-25 | Open redirect vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to redirect users to arbitrary sites and conduct phishing attacks via a sp… |
CVE-2020-5540 | Medium | 6.1 | 2020-08-25 | Cross-site scripting vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to inject arbitrary script or HTML via a specially crafted URL. |
CVE-2020-24613 | Medium | 6.8 | 2020-08-24 | wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c. This is an incorrect implementa… |
CVE-2020-24612 | Medium | 6.7 | 2020-08-24 | An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Conseq… |
CVE-2020-24572 | High | 8.8 | 2020-08-24 | An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured (and virtually unrestricted) w… |
CVE-2020-7377 | High | 8.1 | 2020-08-24 | The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar meth… |
CVE-2020-7376 | High | 7.1 | 2020-08-24 | The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can… |
CVE-2020-6637 | Critical | 9.8 | 2020-08-24 | openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php. |
CVE-2020-24364 | High | 8.8 | 2020-08-24 | MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting. Could lead to RCE via meeting invite. |
CVE-2020-7705 | High | 7.1 | 2020-08-24 | This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app a… |
CVE-2020-24606 | High | 8.6 | 2020-08-24 | Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Ca… |
CVE-2020-10775 | Medium | 5.3 | 2020-08-24 | An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites an… |
CVE-2020-4598 | Medium | 6.1 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit… |
CVE-2020-4593 | Medium | 4.4 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184747. |
CVE-2020-4587 | High | 7.8 | 2020-08-24 | IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, 6.0.0, and 6.1.0 is vulnerable to a stack based buffer ovreflow, caused by improper bounds checking. A local… |
CVE-2020-4383 | Medium | 6.5 | 2020-08-24 | IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment while co… |
CVE-2020-4382 | Medium | 5.5 | 2020-08-24 | IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment or upgra… |
CVE-2020-4170 | Medium | 4.3 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tr… |
CVE-2020-4165 | Medium | 5.4 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web… |
CVE-2020-14044 | High | 7.2 | 2020-08-24 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges… |
CVE-2020-14043 | High | 8.8 | 2020-08-24 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later. The request to download a plu… |
CVE-2020-7831 | High | 8.8 | 2020-08-24 | A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. The attacker is able… |
CVE-2020-19891 | High | 7.2 | 2020-08-24 | DBHcms v1.2.0 has an Arbitrary file write vulnerability in dbhcms\mod\mod.editor.php $_POST['updatefile'] is filename and $_POST['tinymce_content'] is file con… |
CVE-2020-19890 | Medium | 4.9 | 2020-08-24 | DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $_GET['file'] is filename,and as there is no filter function for security… |
CVE-2020-19889 | High | 8.8 | 2020-08-24 | DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcms_pid=-70 can add a user. |
CVE-2020-19888 | Medium | 5.9 | 2020-08-24 | DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vuln… |
CVE-2020-19887 | Medium | 4.8 | 2020-08-24 | DBHcms v1.2.0 has a stored XSS vulnerability as there is no htmlspecialchars function for '$_POST['pageparam_insert_description']' variable in dbhcms\mod\mod.p… |
CVE-2020-19886 | High | 8.1 | 2020-08-24 | DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for an /index.php?dbhcms_pid=-80&deletemenu=9 can delete any menu. |
CVE-2020-19885 | Medium | 4.8 | 2020-08-24 | DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$_POST['pageparam_insert_name']' variable in dbhcms\mod\mod.page.edi… |
CVE-2020-19884 | Medium | 4.8 | 2020-08-24 | DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function in dbhcms\mod\mod.domain.edit.php line 119. |
CVE-2020-19883 | Medium | 4.8 | 2020-08-24 | DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter in dbhcms\mod\mod.users.view.php line 57 for user_login, A remote authenticated wit… |
CVE-2020-19882 | Medium | 4.8 | 2020-08-24 | DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for 'menu_description' variable in dbhcms\mod\mod.menus.edit.php line 83… |
CVE-2020-19881 | Medium | 4.8 | 2020-08-24 | DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\mod\mod.selector.php line 108 for $_GET['return_name'] parameter, A re… |
CVE-2020-19880 | Medium | 6.1 | 2020-08-24 | DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthenticated attacker can ex… |
CVE-2020-19879 | Medium | 6.1 | 2020-08-24 | DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $_GET['dbhcms_pid'] variable in dbhcms\page.php line 107, |
CVE-2020-19878 | High | 7.5 | 2020-08-24 | DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthentica… |
CVE-2020-14367 | Medium | 6.0 | 2020-08-24 | A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while… |
CVE-2020-24186 | Critical | 10.0 | 2020-08-24 | A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any… |
CVE-2020-19877 | Medium | 5.3 | 2020-08-24 | DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can ex… |
CVE-2020-14350 | High | 7.3 | 2020-08-24 | It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this… |
CVE-2020-14349 | High | 7.1 | 2020-08-24 | It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authen… |
CVE-2020-13101 | High | 7.5 | 2020-08-24 | In OASIS Digital Signature Services (DSS) 1.0, an attacker can control the validation outcome (i.e., trigger either a valid or invalid outcome for a valid or i… |
CVE-2020-7711 | High | 7.5 | 2020-08-23 | This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signature… |
CVE-2020-5417 | High | 8.8 | 2020-08-21 | Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the… |
CVE-2020-5416 | Medium | 6.5 | 2020-08-21 | Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vul… |
CVE-2020-9063 | High | 7.6 | 2020-08-21 | NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do not authenticate or protect the integrity of USB HID communications between the currency dispenser a… |
CVE-2020-9062 | Medium | 5.3 | 2020-08-21 | Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCD… |
CVE-2020-8624 | Medium | 4.3 | 2020-08-21 | In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1… |
CVE-2020-8623 | High | 7.5 | 2020-08-21 | In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that c… |
CVE-2020-8622 | Medium | 6.5 | 2020-08-21 | In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the n… |
CVE-2020-8621 | High | 7.5 | 2020-08-21 | In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to… |
CVE-2020-8620 | High | 7.5 | 2020-08-21 | In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to… |
CVE-2020-8234 | Critical | 9.8 | 2020-08-21 | A vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cookie for admin can be guessed, enabling th… |
CVE-2020-8227 | Medium | 6.8 | 2020-08-21 | Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedica… |
CVE-2020-8189 | Medium | 5.4 | 2020-08-21 | A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the log… |
CVE-2020-15858 | Medium | 6.2 | 2020-08-21 | Some devices of Thales DIS (formerly Gemalto, formerly Cinterion) allow Directory Traversal by physically proximate attackers. The directory path access check… |
CVE-2020-10126 | High | 7.6 | 2020-08-21 | NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacker with physical acc… |
CVE-2020-10125 | High | 7.6 | 2020-08-21 | NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can… |
CVE-2020-10124 | High | 7.1 | 2020-08-21 | NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which cou… |
CVE-2020-10123 | Medium | 5.3 | 2020-08-21 | The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host… |
CVE-2020-24591 | Medium | 6.5 | 2020-08-21 | The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics… |