2020 CVEs (page 114)
Page 114 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15693 | Medium | 6.5 | 2020-08-14 | In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part… |
CVE-2020-15692 | Critical | 9.8 | 2020-08-14 | In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be ope… |
CVE-2020-9767 | High | 7.8 | 2020-08-14 | A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which… |
CVE-2020-9708 | Medium | 5.9 | 2020-08-14 | The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. Thi… |
CVE-2020-15145 | Medium | 6.7 | 2020-08-14 | In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the followi… |
CVE-2020-15142 | High | 8.0 | 2020-08-14 | In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent exe… |
CVE-2020-15141 | Low | 3.0 | 2020-08-14 | In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI docume… |
CVE-2020-7583 | High | 7.8 | 2020-08-14 | A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0.8). The application does… |
CVE-2020-22722 | High | 7.8 | 2020-08-14 | Rapid Software LLC Rapid SCADA 5.8.0 is affected by a local privilege escalation vulnerability in the ScadaAgentSvc.exe executable file. An attacker can obtain… |
CVE-2020-22721 | High | 7.8 | 2020-08-14 | A File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker to execute arbitrary code via the Miscellaneous " External Pr… |
CVE-2020-15781 | Critical | 9.6 | 2020-08-14 | A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficiently sanitize input… |
CVE-2020-10055 | Critical | 9.8 | 2020-08-14 | A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (V3.x). Affected applications are delive… |
CVE-2020-9229 | Medium | 4.4 | 2020-08-14 | FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information, attackers may exploit this vulnerabilit… |
CVE-2020-9228 | High | 7.5 | 2020-08-14 | FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information, attackers may exploit this vulnerabilit… |
CVE-2020-7701 | Critical | 9.8 | 2020-08-14 | madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue. |
CVE-2020-7700 | Critical | 9.8 | 2020-08-14 | All versions of phpjs are vulnerable to Prototype Pollution via parse_str. |
CVE-2020-17462 | High | 7.8 | 2020-08-14 | CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798. |
CVE-2020-16205 | High | 7.2 | 2020-08-14 | Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior… |
CVE-2020-12648 | Medium | 6.1 | 2020-08-14 | A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editi… |
CVE-2020-4662 | High | 8.8 | 2020-08-14 | IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication validation. IBM X-Force ID: 186233. |
CVE-2020-7360 | High | 7.4 | 2020-08-13 | An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticat… |
CVE-2020-24349 | Medium | 5.5 | 2020-08-13 | njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to be "fluff" in the NG… |
CVE-2020-24348 | Medium | 5.5 | 2020-08-13 | njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c. |
CVE-2020-24347 | Medium | 5.5 | 2020-08-13 | njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_lvlhsh_level_find in njs_lvlhsh.c. |
CVE-2020-24346 | High | 7.8 | 2020-08-13 | njs through 0.4.3, used in NGINX, has a use-after-free in njs_json_parse_iterator_call in njs_json.c. |
CVE-2020-24345 | High | 7.8 | 2020-08-13 | JerryScript through 2.3.0 allows stack consumption via function a(){new new Proxy(a,{})}JSON.parse("[]",a). NOTE: the vendor states that the problem is the lac… |
CVE-2020-24344 | High | 7.1 | 2020-08-13 | JerryScript through 2.3.0 has a (function({a=arguments}){const arguments}) buffer over-read. |
CVE-2020-24343 | High | 7.8 | 2020-08-13 | Artifex MuJS through 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c. |
CVE-2020-24342 | High | 7.8 | 2020-08-13 | Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row. |
CVE-2020-24332 | Medium | 5.5 | 2020-08-13 | An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlin… |
CVE-2020-24331 | High | 7.8 | 2020-08-13 | An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /et… |
CVE-2020-24330 | High | 7.8 | 2020-08-13 | An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gi… |
CVE-2020-17498 | Medium | 6.5 | 2020-08-13 | In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash. This was addressed in epan/dissectors/packet-kafka.c by avoiding a double free during LZ… |
CVE-2020-0261 | High | 7.8 | 2020-08-13 | In C2 flame devices, there is a possible bypass of seccomp due to a missing configuration file. This could lead to local escalation of privilege with no additi… |
CVE-2020-14483 | Medium | 4.3 | 2020-08-13 | A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread hanging and requires a manual restart o… |
CVE-2020-15947 | High | 8.8 | 2020-08-13 | A SQL injection vulnerability in the qm_adm/qm_export_stats_run.do endpoint of Loway QueueMetrics before 19.10.21 allows remote authenticated users to execute… |
CVE-2020-15925 | High | 8.8 | 2020-08-13 | A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.10.21 allows remote authenticated attackers to execute arbitrary SQL commands via th… |
CVE-2020-13286 | Medium | 6.4 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 user controlled git configuration settings can be modified to result in Server Side Request Forgery. |
CVE-2020-13281 | Medium | 6.5 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a denial of service exists in the project import feature |
CVE-2020-11733 | Medium | 6.7 | 2020-08-13 | An issue was discovered on Spirent TestCenter and Avalanche appliance admin interface firmware. An attacker, who already has access to an SSH restricted shell… |
CVE-2020-17463 | Critical | 9.8 | 2020-08-13 | FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. |
CVE-2020-16087 | High | 8.6 | 2020-08-13 | An issue was discovered in Zalo.exe in VNG Zalo Desktop 19.8.1.0. An attacker can run arbitrary commands on a remote Windows machine running the Zalo client by… |
CVE-2020-13285 | High | 7.3 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip. |
CVE-2020-13283 | High | 7.3 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title. |
CVE-2020-13282 | Low | 3.1 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access level on the subgroup leading to imprope… |
CVE-2020-13280 | Medium | 6.5 | 2020-08-13 | For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message. |
CVE-2020-4589 | Critical | 9.8 | 2020-08-13 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence… |
CVE-2020-8720 | Medium | 5.5 | 2020-08-13 | Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potential… |
CVE-2020-8689 | Medium | 6.5 | 2020-08-13 | Improper buffer restrictions in the Intel(R) Wireless for Open Source before version 1.5 may allow an unauthenticated user to potentially enable denial of serv… |
CVE-2020-8688 | High | 7.5 | 2020-08-13 | Improper input validation in the Intel(R) RAID Web Console 3 for Windows* may allow an unauthenticated user to potentially enable denial of service via network… |
CVE-2020-8687 | High | 7.8 | 2020-08-13 | Uncontrolled search path in the installer for Intel(R) RSTe Software RAID Driver for the Intel(R) Server Board M10JNP2SB before version 4.7.0.1119 may allow an… |
CVE-2020-8685 | Medium | 4.4 | 2020-08-13 | Improper authentication in subsystem for Intel (R) LED Manager for NUC before version 1.2.3 may allow privileged user to potentially enable denial of service v… |
CVE-2020-8684 | Medium | 6.7 | 2020-08-13 | Improper access control in firmware for Intel(R) PAC with Arria(R) 10 GX FPGA before Intel Acceleration Stack version 1.2.1 may allow a privileged user to pote… |
CVE-2020-8683 | Medium | 5.5 | 2020-08-13 | Improper buffer restrictions in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially en… |
CVE-2020-8682 | Medium | 5.5 | 2020-08-13 | Out of bounds read in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable denia… |
CVE-2020-8681 | High | 7.8 | 2020-08-13 | Out of bounds write in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable esca… |
CVE-2020-8680 | High | 7.0 | 2020-08-13 | Race condition in some Intel(R) Graphics Drivers before version 15.40.45.5126 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2020-8679 | Medium | 5.5 | 2020-08-13 | Out-of-bounds write in Kernel Mode Driver for some Intel(R) Graphics Drivers before version 26.20.100.7755 may allow an authenticated user to potentially enabl… |
CVE-2020-7307 | Medium | 5.2 | 2020-08-13 | Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB u… |
CVE-2020-12301 | High | 8.2 | 2020-08-13 | Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable esca… |
CVE-2020-12300 | High | 8.2 | 2020-08-13 | Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially ena… |
CVE-2020-12299 | High | 8.2 | 2020-08-13 | Improper input validation in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable es… |
CVE-2020-0559 | High | 7.8 | 2020-08-13 | Insecure inherited permissions in some Intel(R) PROSet/Wireless WiFi products on Windows* 7 and 8.1 before version 21.40.5.1 may allow an authenticated user to… |
CVE-2020-0555 | High | 7.8 | 2020-08-13 | Improper input validation for some Intel(R) Wireless Bluetooth(R) products may allow an authenticated user to potentially enable escalation of privilege via lo… |
CVE-2020-0554 | High | 7.0 | 2020-08-13 | Race condition in software installer for some Intel(R) Wireless Bluetooth(R) products on Windows* 7, 8.1 and 10 may allow an unprivileged user to potentially e… |
CVE-2020-0553 | Medium | 4.4 | 2020-08-13 | Out-of-bounds read in kernel mode driver for some Intel(R) Wireless Bluetooth(R) products on Windows* 10, may allow a privileged user to potentially enable inf… |
CVE-2020-0513 | High | 7.8 | 2020-08-13 | Out of bounds write for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable escalation of privile… |
CVE-2020-0512 | Medium | 5.5 | 2020-08-13 | Uncaught exception in the system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable d… |
CVE-2020-0510 | High | 7.8 | 2020-08-13 | Out of bounds read in some Intel(R) Graphics Drivers before versions 15.45.31.5127 and 15.40.45.5126 may allow an authenticated user to potentially enable esca… |
CVE-2020-8763 | High | 7.8 | 2020-08-13 | Improper permissions in the installer for the Intel(R) RealSense(TM) D400 Series UWP driver for Windows* 10 may allow an authenticated user to potentially enab… |
CVE-2020-8759 | Medium | 6.7 | 2020-08-13 | Improper access control in the installer for Intel(R) SSD DCT versions before 3.0.23 may allow a privileged user to potentially enable escalation of privilege… |
CVE-2020-8743 | High | 7.8 | 2020-08-13 | Improper permissions in the installer for the Intel(R) Mailbox Interface driver, all versions, may allow an authenticated user to potentially enable escalation… |
CVE-2020-8742 | Medium | 6.7 | 2020-08-13 | Improper input validation in the firmware for Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2020-8736 | High | 7.8 | 2020-08-13 | Improper access control in subsystem for the Intel(R) Computing Improvement Program before version 2.4.5718 may allow an authenticated user to potentially enab… |
CVE-2020-8733 | Medium | 6.7 | 2020-08-13 | Improper buffer restrictions in the firmware for Intel(R) Server Board M10JNP2SB before version 7.210 may allow a privileged user to potentially enable escalat… |
CVE-2020-8732 | High | 8.8 | 2020-08-13 | Heap-based buffer overflow in the firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated… |
CVE-2020-8731 | High | 8.8 | 2020-08-13 | Incorrect execution-assigned permissions in the file system for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a… |
CVE-2020-8730 | High | 8.8 | 2020-08-13 | Heap-based overflow for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enab… |
CVE-2020-8729 | High | 7.8 | 2020-08-13 | Buffer copy without checking size of input for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated u… |
CVE-2020-8723 | Medium | 6.3 | 2020-08-13 | Cross-site scripting for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially e… |
CVE-2020-8722 | High | 8.2 | 2020-08-13 | Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potential… |
CVE-2020-8721 | High | 8.2 | 2020-08-13 | Improper input validation for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially en… |
CVE-2020-8719 | High | 8.2 | 2020-08-13 | Buffer overflow in subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially… |
CVE-2020-8718 | High | 8.8 | 2020-08-13 | Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to poten… |
CVE-2020-8717 | Medium | 5.5 | 2020-08-13 | Improper input validation in a subsystem for some Intel Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user t… |
CVE-2020-8716 | Medium | 5.5 | 2020-08-13 | Improper access control for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially… |
CVE-2020-8715 | Medium | 5.5 | 2020-08-13 | Invalid pointer for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable… |
CVE-2020-8714 | High | 7.8 | 2020-08-13 | Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially… |
CVE-2020-8713 | High | 8.8 | 2020-08-13 | Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentiall… |
CVE-2020-8712 | High | 7.8 | 2020-08-13 | Buffer overflow in a verification process for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an authenticated us… |
CVE-2020-8711 | Medium | 6.7 | 2020-08-13 | Improper access control in the bootloader for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow a privileged user t… |
CVE-2020-8710 | Medium | 6.7 | 2020-08-13 | Buffer overflow in the bootloader for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow a privileged user to potent… |
CVE-2020-8709 | High | 8.8 | 2020-08-13 | Improper authentication in socket services for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an unauthenticated… |
CVE-2020-8708 | High | 8.8 | 2020-08-13 | Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentiall… |
CVE-2020-8707 | High | 8.8 | 2020-08-13 | Buffer overflow in daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentia… |
CVE-2020-8706 | High | 8.8 | 2020-08-13 | Buffer overflow in a daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potent… |
CVE-2020-7306 | Medium | 5.2 | 2020-08-13 | Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the ADRMS us… |
CVE-2020-7305 | Medium | 6.7 | 2020-08-13 | Privilege escalation vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows a low privileged remote attacker to create new rul… |
CVE-2020-7304 | High | 7.6 | 2020-08-13 | Cross site request forgery vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attacker to embed a CRS… |
CVE-2020-7303 | Medium | 4.1 | 2020-08-13 | Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote user to trigger scripts to ru… |