2020 CVEs (page 115)
Page 115 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7302 | Medium | 5.4 | 2020-08-13 | Unrestricted Upload of File with Dangerous Type in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to upload mal… |
CVE-2020-17538 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to… |
CVE-2020-16310 | Medium | 5.5 | 2020-08-13 | A division by zero vulnerability in dot24_print_page() in devices/gdevdm24.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial o… |
CVE-2020-16309 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in lxm5700m_print_page() in devices/gdevlxm.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial… |
CVE-2020-16308 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in p_print_image() in devices/gdevcdj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of ser… |
CVE-2020-16307 | Medium | 5.5 | 2020-08-13 | A null pointer dereference vulnerability in devices/vector/gdevtxtw.c and psi/zbfont.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause… |
CVE-2020-16306 | Medium | 5.5 | 2020-08-13 | A null pointer dereference vulnerability in devices/gdevtsep.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via… |
CVE-2020-16305 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in pcx_write_rle() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a deni… |
CVE-2020-16304 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in image_render_color_thresh() in base/gxicolor.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to es… |
CVE-2020-16303 | High | 7.8 | 2020-08-13 | A use-after-free vulnerability in xps_finish_image_path() in devices/vector/gdevxps.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalat… |
CVE-2020-16302 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privi… |
CVE-2020-16301 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in okiibm_print_page1() in devices/gdevokii.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial… |
CVE-2020-16300 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in tiff12_print_page() in devices/gdevtfnx.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial o… |
CVE-2020-16299 | Medium | 5.5 | 2020-08-13 | A Division by Zero vulnerability in bj10v_print_page() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a… |
CVE-2020-16298 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in mj_color_correct() in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a d… |
CVE-2020-16297 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in FloydSteinbergDitheringC() in contrib/gdevbjca.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to… |
CVE-2020-16296 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in GetNumWrongData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker t… |
CVE-2020-16295 | Medium | 5.5 | 2020-08-13 | A null pointer dereference vulnerability in clj_media_size() in devices/gdevclj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a den… |
CVE-2020-16294 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in epsc_print_page() in devices/gdevepsc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of… |
CVE-2020-16293 | Medium | 5.5 | 2020-08-13 | A null pointer dereference vulnerability in compose_group_nonknockout_nonblend_isolated_allmask_common() in base/gxblend.c of Artifex Software GhostScript v9.5… |
CVE-2020-16292 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in mj_raster_cmd() in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a deni… |
CVE-2020-16291 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in contrib/gdevdj9.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to cause a denial of service via a… |
CVE-2020-16290 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial… |
CVE-2020-16289 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of se… |
CVE-2020-16288 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in pj_common_print_page() in devices/gdevpjet.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denia… |
CVE-2020-16287 | Medium | 5.5 | 2020-08-13 | A buffer overflow vulnerability in lprn_is_black() in contrib/lips4/gdevlprn.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial… |
CVE-2020-12287 | High | 7.8 | 2020-08-13 | Incorrect permissions in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2020.2 may allow an authenticated user to potentially enable escalati… |
CVE-2020-7301 | Medium | 4.1 | 2020-08-12 | Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the… |
CVE-2020-7300 | Medium | 4.6 | 2020-08-12 | Improper Authorization vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attackers to change the con… |
CVE-2020-17450 | Medium | 6.1 | 2020-08-12 | PHP-Fusion 9.03 allows XSS on the preview page. |
CVE-2020-17449 | Medium | 5.4 | 2020-08-12 | PHP-Fusion 9.03 allows XSS via the error_log file. |
CVE-2020-17362 | Medium | 6.1 | 2020-08-12 | search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. |
CVE-2020-15868 | High | 7.5 | 2020-08-12 | Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control. |
CVE-2020-15596 | Medium | 6.7 | 2020-08-12 | The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks vi… |
CVE-2020-16139 | High | 7.5 | 2020-08-12 | A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the device remotely through sending specially… |
CVE-2020-16138 | High | 7.5 | 2020-08-12 | A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is powe… |
CVE-2020-16137 | Critical | 9.8 | 2020-08-12 | A privilege escalation issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to reset the credentials for the SSH adminis… |
CVE-2020-8905 | Low | 2.8 | 2020-08-12 | A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_re… |
CVE-2020-8904 | Medium | 6.4 | 2020-08-12 | An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate t… |
CVE-2020-12107 | Critical | 9.8 | 2020-08-12 | The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows command injection via a text field, which allow full control over this module's Operating System. |
CVE-2020-12106 | Critical | 9.8 | 2020-08-12 | The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows unauthenticated users to send HTTP POST request to several critical Administrative functions suc… |
CVE-2020-7374 | Medium | 5.3 | 2020-08-12 | Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained… |
CVE-2020-17507 | Medium | 5.3 | 2020-08-12 | An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read. |
CVE-2020-17361 | Medium | 5.5 | 2020-08-12 | An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h returns silently when a negative length is provided (i… |
CVE-2020-17360 | High | 7.8 | 2020-08-12 | An issue was discovered in ReadyTalk Avian 1.2.0. The vm::arrayCopy method defined in classpath-common.h contains multiple boundary checks that are performed t… |
CVE-2020-6653 | Low | 3.8 | 2020-08-12 | Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A… |
CVE-2020-5415 | Critical | 10.0 | 2020-08-12 | Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a… |
CVE-2020-2035 | Low | 3.0 | 2020-08-12 | When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL… |
CVE-2020-17506 | Critical | 9.8 | 2020-08-12 | Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the… |
CVE-2020-17505 | High | 8.8 | 2020-08-12 | Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are execute… |
CVE-2020-15137 | Medium | 5.5 | 2020-08-12 | All versions of HoRNDIS are affected by an integer overflow in the RNDIS packet parsing routines. A malicious USB device can trigger disclosure of unrelated ke… |
CVE-2020-17497 | High | 8.1 | 2020-08-12 | eapol.c in iNet wireless daemon (IWD) through 1.8 allows attackers to trigger a PTK reinstallation by retransmitting EAPOL Msg4/4. |
CVE-2020-17446 | Critical | 9.8 | 2020-08-12 | asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, b… |
CVE-2020-12674 | High | 7.5 | 2020-08-12 | In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. |
CVE-2020-12673 | High | 7.5 | 2020-08-12 | In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. |
CVE-2020-12100 | High | 7.5 | 2020-08-12 | In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via… |
CVE-2020-13291 | High | 8.1 | 2020-08-12 | In GitLab before 13.2.3, project sharing could temporarily allow too permissive access. |
CVE-2020-13290 | High | 7.5 | 2020-08-12 | In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page |
CVE-2020-13288 | Medium | 5.5 | 2020-08-12 | In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page |
CVE-2020-6310 | Medium | 4.3 | 2020-08-12 | Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any a… |
CVE-2020-6309 | High | 7.5 | 2020-08-12 | SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform any authentication ch… |
CVE-2020-6301 | High | 8.1 | 2020-08-12 | SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to read, modify and settl… |
CVE-2020-6300 | Medium | 4.8 | 2020-08-12 | SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator rights can use the… |
CVE-2020-6299 | Medium | 4.3 | 2020-08-12 | SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of users in the given sy… |
CVE-2020-6298 | High | 8.1 | 2020-08-12 | SAP Banking Services (Generic Market Data), versions - 400, 450, 500, allows an unauthorized user to display protected Business Partner Generic Market Data (GM… |
CVE-2020-6297 | Medium | 4.4 | 2020-08-12 | Under certain conditions the upgrade of SAP Data Hub 2.7 to SAP Data Intelligence, version - 3.0, allows an attacker to access confidential system configuratio… |
CVE-2020-6296 | High | 8.8 | 2020-08-12 | SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that ca… |
CVE-2020-6295 | High | 7.8 | 2020-08-12 | Under certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to access encrypted sensitive and confidential information throug… |
CVE-2020-6294 | Critical | 9.1 | 2020-08-12 | Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionaliti… |
CVE-2020-6293 | Medium | 6.5 | 2020-08-12 | SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modi… |
CVE-2020-6284 | Critical | 9.0 | 2020-08-12 | SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate fi… |
CVE-2020-6273 | Medium | 4.3 | 2020-08-12 | SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization checks for an authenticated user working wit… |
CVE-2020-2237 | Medium | 4.3 | 2020-08-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Flaky Test Handler Plugin 1.0.4 and earlier allows attackers to rebuild a project at a previous gi… |
CVE-2020-2236 | Medium | 5.4 | 2020-08-12 | Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XSS) vulnerability ex… |
CVE-2020-2235 | Medium | 6.5 | 2020-08-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-spe… |
CVE-2020-2234 | Medium | 6.5 | 2020-08-12 | A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-speci… |
CVE-2020-2233 | Medium | 6.5 | 2020-08-12 | A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of… |
CVE-2020-2232 | High | 7.5 | 2020-08-12 | Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potential… |
CVE-2020-2231 | Medium | 5.4 | 2020-08-12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in… |
CVE-2020-2230 | Medium | 5.4 | 2020-08-12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vu… |
CVE-2020-2229 | Medium | 5.4 | 2020-08-12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerab… |
CVE-2020-17496 | Critical | 9.8 | 2020-08-12 | vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: thi… |
CVE-2020-13278 | Medium | 6.1 | 2020-08-12 | Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web s… |
CVE-2020-6932 | Critical | 10.0 | 2020-08-12 | An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0… |
CVE-2020-17373 | Medium | 5.3 | 2020-08-12 | SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection. |
CVE-2020-17372 | Medium | 5.4 | 2020-08-12 | SugarCRM before 10.1.0 (Q3 2020) allows XSS. |
CVE-2020-16266 | Medium | 5.4 | 2020-08-12 | An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitrary HTML into the pa… |
CVE-2020-16145 | Medium | 6.1 | 2020-08-12 | Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1… |
CVE-2020-8913 | High | 8.8 | 2020-08-12 | A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious… |
CVE-2020-7029 | Medium | 6.4 | 2020-08-11 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya… |
CVE-2020-17495 | High | 7.5 | 2020-08-11 | django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may co… |
CVE-2020-17489 | Medium | 4.3 | 2020-08-11 | An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog r… |
CVE-2020-8912 | Low | 2.5 | 2020-08-11 | A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted b… |
CVE-2020-8911 | Medium | 5.6 | 2020-08-11 | A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without comp… |
CVE-2020-17487 | High | 7.5 | 2020-08-11 | radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to… |
CVE-2020-16170 | High | 7.5 | 2020-08-11 | Use of Hard-coded Credentials in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to listen in on any ongoing calls between… |
CVE-2020-0260 | Critical | 9.1 | 2020-08-11 | There is a possible out of bounds read due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-152225183 |
CVE-2020-0259 | High | 7.8 | 2020-08-11 | In android_verity_ctr of dm-android-verity.c, there is a possible way to modify a dm-verity protected filesystem due to improperly used crypto. This could lead… |
CVE-2020-0258 | Medium | 5.5 | 2020-08-11 | In stopZygoteLocked of AppZygote.java, there is an insufficient cleanup. This could lead to local information disclosure in the application that is started nex… |
CVE-2020-0257 | High | 7.8 | 2020-08-11 | In SpecializeCommon of com_android_internal_os_Zygote.cpp, there is a permissions bypass due to an incomplete cleanup. This could lead to local escalation of p… |