2020 CVEs (page 111)
Page 111 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-24590 | Critical | 9.1 | 2020-08-21 | The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks. |
CVE-2020-24589 | Critical | 9.1 | 2020-08-21 | The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks. |
CVE-2020-14201 | Medium | 6.5 | 2020-08-21 | Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in w… |
CVE-2020-5775 | Medium | 5.8 | 2020-08-21 | Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to… |
CVE-2020-3975 | Medium | 5.4 | 2020-08-21 | VMware App Volumes 2.x prior to 2.18.6 and VMware App Volumes 4 prior to 2006 contain a Stored Cross-Site Scripting (XSS) vulnerability. A malicious actor with… |
CVE-2020-15147 | High | 8.5 | 2020-08-21 | Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specific… |
CVE-2020-15140 | High | 8.2 | 2020-08-21 | In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted u… |
CVE-2020-20633 | Medium | 5.4 | 2020-08-21 | ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) 1.8.2 and below pl… |
CVE-2020-7923 | Medium | 6.5 | 2020-08-21 | A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsyst… |
CVE-2020-24057 | High | 8.8 | 2020-08-21 | The management website of the Verint S5120FD Verint_FW_0_42 unit features a CGI endpoint ('ipfilter.cgi') that allows the user to manage network filtering on t… |
CVE-2020-24056 | High | 7.5 | 2020-08-21 | A hardcoded credentials vulnerability exists in Verint 5620PTZ Verint_FW_0_42, Verint 4320 V4320_FW_0_23, V4320_FW_0_31, and Verint S5120FD Verint_FW_0_42units… |
CVE-2020-24055 | Critical | 9.8 | 2020-08-21 | Verint 5620PTZ Verint_FW_0_42 and Verint 4320 V4320_FW_0_23, and V4320_FW_0_31 units feature an autodiscovery service implemented in the binary executable '/us… |
CVE-2020-24054 | Critical | 9.8 | 2020-08-21 | The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that can spawn a given process repeatedly a… |
CVE-2020-24053 | High | 7.5 | 2020-08-21 | Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability. This could cause a confidentiality issue when using the FTP, Telnet, o… |
CVE-2020-24052 | Critical | 9.1 | 2020-08-21 | Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary file… |
CVE-2020-24051 | Critical | 9.8 | 2020-08-21 | The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires authentication for some… |
CVE-2020-20634 | Medium | 6.5 | 2020-08-21 | Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins… |
CVE-2020-10290 | Medium | 6.8 | 2020-08-21 | Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents ma… |
CVE-2020-9246 | Medium | 6.5 | 2020-08-21 | FusionCompute 8.0.0 has an information leak vulnerability. A module does not launch strict access control and information protection. Attackers with low privil… |
CVE-2020-9104 | Medium | 4.3 | 2020-08-21 | HUAWEI P30 smartphones with Versions earlier than 10.1.0.123(C431E22R2P5),Versions earlier than 10.1.0.123(C432E22R2P5),Versions earlier than 10.1.0.126(C10E7R… |
CVE-2020-9096 | Medium | 5.5 | 2020-08-21 | HUAWEI P30 Pro smartphones with Versions earlier than 10.1.0.160(C00E160R2P8) have an out of bound read vulnerability. Some functions are lack of verification… |
CVE-2020-9095 | Medium | 5.5 | 2020-08-21 | HUAWEI P30 Pro smartphone with Versions earlier than 10.1.0.160(C00E160R2P8) has an integer overflow vulnerability. Some functions are lack of verification whe… |
CVE-2020-24585 | Medium | 5.3 | 2020-08-21 | An issue was discovered in the DTLS handshake implementation in wolfSSL before 4.5.0. Clear DTLS application_data messages in epoch 0 do not produce an out-of-… |
CVE-2020-15309 | High | 7.0 | 2020-08-21 | An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a cache-timing attack against public key op… |
CVE-2020-12457 | High | 7.5 | 2020-08-21 | An issue was discovered in wolfSSL before 4.5.0. It mishandles the change_cipher_spec (CCS) message processing logic for TLS 1.3. If an attacker sends ChangeCi… |
CVE-2020-5774 | High | 7.1 | 2020-08-21 | Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. The lack of proper session expiration… |
CVE-2020-3976 | Medium | 5.3 | 2020-08-21 | VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services. VMware has evaluated the severity… |
CVE-2020-16241 | Medium | 6.3 | 2020-08-21 | Philips SureSigns VS4, A.07.107 and prior does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
CVE-2020-16239 | Medium | 4.9 | 2020-08-21 | When an actor claims to have a given identity, Philips SureSigns VS4, A.07.107 and prior does not prove or insufficiently proves the claim is correct. |
CVE-2020-16237 | Low | 2.1 | 2020-08-21 | Philips SureSigns VS4, A.07.107 and prior receives input or data, but it does not validate or incorrectly validates that the input has the properties required… |
CVE-2020-14518 | Medium | 5.3 | 2020-08-21 | Philips DreamMapper, Version 2.24 and prior. Information written to log files can give guidance to a potential attacker. |
CVE-2020-7710 | High | 8.1 | 2020-08-21 | This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine. |
CVE-2020-7310 | Medium | 6.9 | 2020-08-21 | Privilege Escalation vulnerability in the installer in McAfee McAfee Total Protection (MTP) trial prior to 4.0.161.1 allows local users to change files that ar… |
CVE-2020-15070 | High | 8.8 | 2020-08-21 | Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted… |
CVE-2020-14215 | High | 7.5 | 2020-08-21 | Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations. |
CVE-2020-14194 | Medium | 5.4 | 2020-08-21 | Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link. |
CVE-2020-12759 | Medium | 6.1 | 2020-08-21 | Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook. |
CVE-2020-24574 | High | 7.8 | 2020-08-21 | The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation from any authenticate… |
CVE-2020-24571 | High | 7.5 | 2020-08-21 | NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal. |
CVE-2020-24567 | High | 7.8 | 2020-08-21 | voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via a Trojan horse urlmon.dll file in the installation directory. NOTE: t… |
CVE-2020-12619 | Medium | 5.9 | 2020-08-20 | MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtai… |
CVE-2020-12618 | Medium | 4.8 | 2020-08-20 | eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker… |
CVE-2020-24359 | High | 7.5 | 2020-08-20 | HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was… |
CVE-2020-4687 | Medium | 4.3 | 2020-08-20 | IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force… |
CVE-2020-4548 | Low | 2.7 | 2020-08-20 | IBM Content Navigator 3.0.7 and 3.0.8 is vulnerable to improper input validation. A malicious administrator could bypass the user interface and send requests t… |
CVE-2020-16282 | High | 8.8 | 2020-08-20 | In the default configuration of Rangee GmbH RangeeOS 8.0.4, all components are executed in the context of the privileged root user. This may allow a local atta… |
CVE-2020-16281 | High | 7.8 | 2020-08-20 | The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restricted environment and execute arbitrary… |
CVE-2020-16280 | Medium | 5.5 | 2020-08-20 | Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several external facing administrative services… |
CVE-2020-16279 | Critical | 9.8 | 2020-08-20 | The Kommbox component in Rangee GmbH RangeeOS 8.0.4 is vulnerable to Remote Code Execution due to untrusted user supplied input being passed to the command lin… |
CVE-2020-23935 | Critical | 9.8 | 2020-08-20 | Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something)". |
CVE-2020-23936 | Critical | 9.8 | 2020-08-20 | PHPGurukul Vehicle Parking Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something)". |
CVE-2020-10283 | Critical | 9.8 | 2020-08-20 | The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintai… |
CVE-2020-10289 | High | 8.8 | 2020-08-20 | Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an act… |
CVE-2020-8870 | High | 7.8 | 2020-08-20 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to… |
CVE-2020-8869 | High | 7.8 | 2020-08-20 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to… |
CVE-2020-17456 | Critical | 9.8 | 2020-08-20 | SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page. |
CVE-2020-15862 | High | 7.8 | 2020-08-20 | Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root. |
CVE-2020-15861 | High | 7.8 | 2020-08-20 | Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following. |
CVE-2020-15638 | High | 7.8 | 2020-08-20 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.2.29539. User interaction is required to… |
CVE-2020-15637 | Low | 3.3 | 2020-08-20 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is req… |
CVE-2020-15636 | Critical | 9.8 | 2020-08-20 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R6400, R6700, R7000, R7850, R7900, R8000, RS400, and… |
CVE-2020-15635 | High | 8.8 | 2020-08-20 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers with firmwa… |
CVE-2020-15634 | Medium | 6.3 | 2020-08-20 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmware 1.0.4.84_10.0.5… |
CVE-2020-15630 | High | 7.8 | 2020-08-20 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-15629 | High | 7.8 | 2020-08-20 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-15532 | Medium | 6.5 | 2020-08-20 | Silicon Labs Bluetooth Low Energy SDK before 2.13.3 has a buffer overflow via packet data. This is an over-the-air denial of service vulnerability in Bluetooth… |
CVE-2020-15531 | High | 8.8 | 2020-08-20 | Silicon Labs Bluetooth Low Energy SDK before 2.13.3 has a buffer overflow via packet data. This is an over-the-air remote code execution vulnerability in Bluet… |
CVE-2020-15151 | High | 8.0 | 2020-08-20 | OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface… |
CVE-2020-15149 | Critical | 9.9 | 2020-08-20 | NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a runn… |
CVE-2020-15146 | Critical | 9.6 | 2020-08-20 | In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-langu… |
CVE-2020-15143 | High | 7.7 | 2020-08-20 | In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-lang… |
CVE-2020-15119 | Medium | 6.4 | 2020-08-20 | In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application a… |
CVE-2020-13826 | High | 8.8 | 2020-08-20 | A CSV injection (aka Excel Macro Injection or Formula Injection) issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter… |
CVE-2020-13825 | Medium | 6.1 | 2020-08-20 | A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 allows remote attackers to inject arbitrary web script or HTML via the viewMode, tvMode, tvType, ob… |
CVE-2020-23574 | Medium | 6.5 | 2020-08-19 | When uploading a file in Sysax Multi Server 6.90, an authenticated user can modify the filename="" parameter in the uploadfile_name1.htm form to a length of 36… |
CVE-2020-9724 | High | 7.8 | 2020-08-19 | Adobe Lightroom versions 9.2.0.10 and earlier have an insecure library loading vulnerability. Successful exploitation could lead to privilege escalation. |
CVE-2020-9723 | High | 7.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9722 | High | 7.8 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free… |
CVE-2020-9721 | High | 7.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9720 | High | 7.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9719 | High | 7.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9718 | High | 7.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9717 | High | 7.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9716 | High | 7.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-24368 | High | 7.5 | 2020-08-19 | Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are rea… |
CVE-2020-14356 | High | 7.8 | 2020-08-19 | A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user coul… |
CVE-2020-11848 | High | 7.5 | 2020-08-19 | Denial of service vulnerability on Micro Focus ArcSight Management Center. Affecting all versions prior to version 2.9.5. The vulnerability could cause the ser… |
CVE-2020-9715 | High | 7.8 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free… |
CVE-2020-9714 | High | 7.8 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a security bypass… |
CVE-2020-9712 | Medium | 5.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a security bypass… |
CVE-2020-9710 | Low | 3.3 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9707 | Low | 3.3 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9706 | Low | 3.3 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9705 | High | 7.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |
CVE-2020-9704 | High | 7.8 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a buffer error vu… |
CVE-2020-9703 | Medium | 5.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a stack exhaustio… |
CVE-2020-9702 | Medium | 5.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a stack exhaustio… |
CVE-2020-9697 | Medium | 5.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a disclosure of s… |
CVE-2020-9696 | Medium | 5.5 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a security bypass… |
CVE-2020-9694 | High | 7.8 | 2020-08-19 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds… |