2020 CVEs (page 113)
Page 113 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-1511 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations. An attacker who succes… |
CVE-2020-1510 | Medium | 5.5 | 2020-08-17 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vul… |
CVE-2020-1509 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists in the Local Security Authority Subsystem Service (LSASS) when an authenticated attacker sends a specially craft… |
CVE-2020-1505 | Medium | 5.5 | 2020-08-17 | An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory. An attacker who successfully exploi… |
CVE-2020-1504 | High | 8.8 | 2020-08-17 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successf… |
CVE-2020-1503 | Medium | 5.5 | 2020-08-17 | An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability… |
CVE-2020-1502 | Medium | 5.5 | 2020-08-17 | An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability… |
CVE-2020-1501 | Medium | 5.4 | 2020-08-17 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. A… |
CVE-2020-1500 | Medium | 5.4 | 2020-08-17 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. A… |
CVE-2020-1499 | Medium | 5.4 | 2020-08-17 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. A… |
CVE-2020-1498 | High | 8.8 | 2020-08-17 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successf… |
CVE-2020-1497 | Medium | 5.5 | 2020-08-17 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerabilit… |
CVE-2020-1496 | High | 8.8 | 2020-08-17 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successf… |
CVE-2020-1495 | High | 8.8 | 2020-08-17 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successf… |
CVE-2020-1494 | High | 8.8 | 2020-08-17 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successf… |
CVE-2020-1493 | Medium | 5.5 | 2020-08-17 | An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached fil… |
CVE-2020-1492 | High | 7.8 | 2020-08-17 | A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnera… |
CVE-2020-1490 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations. An attacker who successfully exploited this vulnera… |
CVE-2020-1489 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists when the Windows CSC Service improperly handles memory. To exploit this vulnerability, an attacker would first h… |
CVE-2020-1488 | High | 7.0 | 2020-08-17 | An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to sys… |
CVE-2020-1487 | High | 7.8 | 2020-08-17 | An information disclosure vulnerability exists when Media Foundation improperly handles objects in memory. An attacker who successfully exploited this vulnerab… |
CVE-2020-1486 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this… |
CVE-2020-1485 | Medium | 5.5 | 2020-08-17 | An information disclosure vulnerability exists when the Windows Image Acquisition (WIA) Service improperly discloses contents of its memory. An attacker who su… |
CVE-2020-1484 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists when the Windows Work Folders Service improperly handles memory. To exploit this vulnerability, an attacker woul… |
CVE-2020-1483 | Medium | 5.0 | 2020-08-17 | A remote code execution vulnerability exists in Microsoft Outlook when the software fails to properly handle objects in memory. An attacker who successfully ex… |
CVE-2020-1480 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. An attacker who successfu… |
CVE-2020-1479 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability cou… |
CVE-2020-1478 | High | 7.8 | 2020-08-17 | A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnera… |
CVE-2020-1477 | High | 7.0 | 2020-08-17 | A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnera… |
CVE-2020-1476 | Medium | 5.5 | 2020-08-17 | An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who su… |
CVE-2020-1475 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists in the way that the srmsvc.dll handles objects in memory. An attacker who successfully exploited the vulnerabili… |
CVE-2020-1474 | High | 7.8 | 2020-08-17 | An information disclosure vulnerability exists when the Windows Image Acquisition (WIA) Service improperly discloses contents of its memory. An attacker who su… |
CVE-2020-1473 | High | 7.0 | 2020-08-17 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2020-1472 | Medium | 5.5 | 2020-08-17 | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the N… |
CVE-2020-1470 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists when the Windows Work Folders Service improperly handles memory. To exploit this vulnerability, an attacker woul… |
CVE-2020-1467 | Critical | 10.0 | 2020-08-17 | An elevation of privilege vulnerability exists when Windows improperly handles hard links. An attacker who successfully exploited this vulnerability could over… |
CVE-2020-1466 | High | 7.8 | 2020-08-17 | A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to the target system using RDP and sends spec… |
CVE-2020-1464 | High | 7.8 | 2020-08-17 | A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass secu… |
CVE-2020-1459 | High | 7.5 | 2020-08-17 | An information disclosure vulnerability exists on ARM implementations that use speculative execution in control flow via a side-channel analysis, aka "str… |
CVE-2020-1455 | Medium | 5.3 | 2020-08-17 | A denial of service vulnerability exists when Microsoft SQL Server Management Studio (SSMS) improperly handles files. An attacker could exploit the vulnerabili… |
CVE-2020-1417 | Medium | 5.5 | 2020-08-17 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this… |
CVE-2020-1383 | Medium | 5.5 | 2020-08-17 | An information disclosure vulnerability exists in RPC if the server has Routing and Remote Access enabled. An attacker who successfully exploited this vulnerab… |
CVE-2020-1380 | High | 7.8 | 2020-08-17 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corru… |
CVE-2020-1379 | Medium | 5.5 | 2020-08-17 | A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnera… |
CVE-2020-1378 | High | 7.5 | 2020-08-17 | An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory. An attacker who successfully exploite… |
CVE-2020-1377 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory. An attacker who successfully exploite… |
CVE-2020-1339 | High | 7.8 | 2020-08-17 | A remote code execution vulnerability exists when Windows Media Audio Codec improperly handles objects. An attacker who successfully exploited the vulnerabilit… |
CVE-2020-1337 | High | 7.8 | 2020-08-17 | An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who s… |
CVE-2020-1182 | High | 7.3 | 2020-08-17 | A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11. An attacker who successfully e… |
CVE-2020-1046 | High | 7.8 | 2020-08-17 | A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this vulnerability could tak… |
CVE-2020-0604 | High | 7.8 | 2020-08-17 | A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully… |
CVE-2020-3502 | Medium | 4.1 | 2020-08-17 | Multiple vulnerabilities in the user interface of Cisco Webex Meetings Desktop App could allow an authenticated, remote attacker to obtain restricted informati… |
CVE-2020-3501 | Medium | 4.1 | 2020-08-17 | Multiple vulnerabilities in the user interface of Cisco Webex Meetings Desktop App could allow an authenticated, remote attacker to obtain restricted informati… |
CVE-2020-3500 | Medium | 6.8 | 2020-08-17 | A vulnerability in the IPv6 implementation of Cisco StarOS could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an a… |
CVE-2020-3472 | Medium | 5.0 | 2020-08-17 | A vulnerability in the contacts feature of Cisco Webex Meetings could allow an authenticated, remote attacker with a legitimate user account to access sensitiv… |
CVE-2020-3464 | Medium | 4.8 | 2020-08-17 | A vulnerability in the web-based management interface of Cisco UCS Director could allow an authenticated, remote attacker with administrative credentials to co… |
CVE-2020-3463 | Medium | 6.1 | 2020-08-17 | A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting… |
CVE-2020-3449 | Medium | 4.3 | 2020-08-17 | A vulnerability in the Border Gateway Protocol (BGP) additional paths feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to preve… |
CVE-2020-3448 | Medium | 5.8 | 2020-08-17 | A vulnerability in an access control mechanism of Cisco Cyber Vision Center Software could allow an unauthenticated, remote attacker to bypass authentication a… |
CVE-2020-3447 | Medium | 5.5 | 2020-08-17 | A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) co… |
CVE-2020-3435 | Medium | 5.5 | 2020-08-17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2020-3434 | Medium | 5.5 | 2020-08-17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2020-3433 | High | 7.8 | 2020-08-17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2020-3413 | Medium | 4.3 | 2020-08-17 | A vulnerability in the scheduled meeting template feature of Cisco Webex Meetings could allow an authenticated, remote attacker to delete a scheduled meeting t… |
CVE-2020-3412 | Medium | 4.3 | 2020-08-17 | A vulnerability in the scheduled meeting template feature of Cisco Webex Meetings could allow an authenticated, remote attacker to create a scheduled meeting t… |
CVE-2020-3411 | High | 7.5 | 2020-08-17 | A vulnerability in Cisco DNA Center software could allow an unauthenticated remote attacker access to sensitive information on an affected system. The vulnerab… |
CVE-2020-3363 | High | 8.6 | 2020-08-17 | A vulnerability in the IPv6 packet processing engine of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to caus… |
CVE-2020-3346 | Medium | 6.1 | 2020-08-17 | A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified… |
CVE-2020-7704 | Critical | 9.8 | 2020-08-17 | The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor. |
CVE-2020-24372 | High | 7.5 | 2020-08-17 | LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c. |
CVE-2020-24371 | Medium | 5.3 | 2020-08-17 | lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage. |
CVE-2020-24370 | Medium | 5.3 | 2020-08-17 | ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31). |
CVE-2020-24369 | High | 7.5 | 2020-08-17 | ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference. |
CVE-2020-24220 | High | 8.8 | 2020-08-17 | ShopXO v1.8.1 has a command execution vulnerability. Attackers can use this vulnerability to execute arbitrary commands and gain control of the server. |
CVE-2020-24208 | Critical | 9.8 | 2020-08-17 | A SQL injection vulnerability in SourceCodester Online Shopping Alphaware 1.0 allows remote unauthenticated attackers to bypass the authentication process via… |
CVE-2020-9241 | High | 7.0 | 2020-08-17 | Huawei 5G Mobile WiFi E6878-370 with versions of 10.0.3.1(H563SP1C00),10.0.3.1(H563SP21C233) have an improper authorization vulnerability. The device does not… |
CVE-2020-9237 | Medium | 6.7 | 2020-08-17 | Huawei smartphone Taurus-AL00B with versions earlier than 10.1.0.126(C00E125R5P3) have a user after free vulnerability. A module is lack of lock protection. At… |
CVE-2020-9233 | Critical | 9.1 | 2020-08-17 | FusionCompute 8.0.0 have an insufficient authentication vulnerability. An attacker may exploit the vulnerability to delete some files and cause some services a… |
CVE-2020-8233 | High | 8.8 | 2020-08-17 | A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over t… |
CVE-2020-8232 | Medium | 6.5 | 2020-08-17 | An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through… |
CVE-2020-8230 | Medium | 5.5 | 2020-08-17 | A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in for windows allowed to corrupt memory. |
CVE-2020-8226 | Medium | 5.8 | 2020-08-17 | A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF. |
CVE-2020-8212 | Critical | 9.8 | 2020-08-17 | Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix Xen… |
CVE-2020-8211 | Critical | 9.8 | 2020-08-17 | Improper input validation in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix X… |
CVE-2020-8210 | High | 7.5 | 2020-08-17 | Insufficient protection of secrets in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and… |
CVE-2020-8209 | High | 7.5 | 2020-08-17 | Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Cit… |
CVE-2020-8208 | Medium | 6.1 | 2020-08-17 | Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.11 before RP6 and C… |
CVE-2020-13122 | High | 8.8 | 2020-08-17 | The novish command-line interface, included in NoviFlow NoviWare before NW500.2.12 and deployed on NoviSwitch devices, is vulnerable to command injection in th… |
CVE-2020-9242 | High | 8.8 | 2020-08-17 | FusionCompute 8.0.0 have a command injection vulnerability. The software does not sufficiently validate certain parameters post from user, successful exploit c… |
CVE-2020-9103 | Medium | 4.6 | 2020-08-17 | HUAWEI Mate 20 smartphones with 9.0.0.205(C00E205R2P1) have a logic error vulnerability. In a special scenario, the system does not properly process. As a resu… |
CVE-2020-7703 | Critical | 9.8 | 2020-08-17 | All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function. |
CVE-2020-7702 | Critical | 9.8 | 2020-08-17 | All versions of package templ8 are vulnerable to Prototype Pollution via the parse function. |
CVE-2020-12606 | Critical | 9.8 | 2020-08-17 | An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows… |
CVE-2020-4686 | High | 8.1 | 2020-08-17 | IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to… |
CVE-2020-13941 | High | 8.8 | 2020-08-17 | Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guid… |
CVE-2020-24361 | Critical | 9.8 | 2020-08-16 | SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec. |
CVE-2020-17475 | High | 7.5 | 2020-08-14 | Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP p… |
CVE-2020-17474 | Critical | 9.8 | 2020-08-14 | A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to create arbitrary new users, elevate us… |
CVE-2020-17473 | Medium | 5.9 | 2020-08-14 | Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by imper… |
CVE-2020-15694 | High | 7.5 | 2020-08-14 | In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() does not raise any… |