2020 CVEs (page 117)
Page 117 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15831 | Medium | 6.1 | 2020-08-08 | JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI. |
CVE-2020-15830 | Medium | 6.1 | 2020-08-08 | JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI. |
CVE-2020-15829 | Medium | 5.3 | 2020-08-08 | In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs. |
CVE-2020-15828 | Medium | 6.5 | 2020-08-08 | In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions. |
CVE-2020-15827 | High | 7.5 | 2020-08-08 | In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file. |
CVE-2020-15826 | Medium | 4.3 | 2020-08-08 | In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have. |
CVE-2020-15825 | High | 8.8 | 2020-08-08 | In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges. |
CVE-2020-15824 | High | 8.8 | 2020-08-08 | In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation… |
CVE-2020-15823 | High | 7.5 | 2020-08-08 | JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component. |
CVE-2020-15821 | Medium | 6.5 | 2020-08-08 | In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft. |
CVE-2020-15820 | Medium | 5.3 | 2020-08-08 | In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence. |
CVE-2020-15819 | Medium | 5.3 | 2020-08-08 | JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports. |
CVE-2020-15818 | Medium | 5.3 | 2020-08-08 | In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence. |
CVE-2020-15817 | High | 8.8 | 2020-08-08 | In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues. |
CVE-2020-15065 | Medium | 6.5 | 2020-08-07 | DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to denial-of-service the device via long input values. |
CVE-2020-15064 | Medium | 4.3 | 2020-08-07 | DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging admin… |
CVE-2020-15063 | High | 8.8 | 2020-08-07 | DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to bypass authentication via a web-administration req… |
CVE-2020-15062 | High | 8.8 | 2020-08-07 | DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative pass… |
CVE-2020-15061 | Medium | 6.5 | 2020-08-07 | Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values. |
CVE-2020-15060 | Medium | 4.3 | 2020-08-07 | Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging admin… |
CVE-2020-15059 | High | 8.8 | 2020-08-07 | Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration req… |
CVE-2020-15058 | High | 8.8 | 2020-08-07 | Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative pass… |
CVE-2020-15057 | Medium | 6.5 | 2020-08-07 | TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to denial-of-service the device via long input values. |
CVE-2020-15056 | Medium | 4.3 | 2020-08-07 | TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to conduct persistent XSS attacks by leveraging admin… |
CVE-2020-15055 | High | 8.8 | 2020-08-07 | TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to bypass authentication via a web-administration req… |
CVE-2020-15054 | High | 8.8 | 2020-08-07 | TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to elevate privileges because the administrative pass… |
CVE-2020-5412 | Medium | 6.5 | 2020-08-07 | Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashbo… |
CVE-2020-15480 | High | 8.8 | 2020-08-07 | An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. The kernel driver exposes IOCTL functional… |
CVE-2020-15479 | High | 8.8 | 2020-08-07 | An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. The driver's IOCTL request handler attempt… |
CVE-2020-17352 | High | 8.8 | 2020-08-07 | Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely ex… |
CVE-2020-16169 | Critical | 9.8 | 2020-08-07 | Authentication Bypass Using an Alternate Path or Channel in temi Robox OS prior to120, temi Android app up to 1.3.7931 allows remote attackers to gain elevated… |
CVE-2020-16167 | Critical | 9.1 | 2020-08-07 | Missing Authentication for Critical Function in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to receive and answer calls… |
CVE-2020-15907 | Medium | 6.1 | 2020-08-07 | In Mahara 19.04 before 19.04.6, 19.10 before 19.10.4, and 20.04 before 20.04.1, certain places could execute file or folder names containing JavaScript. |
CVE-2020-13376 | Critical | 9.0 | 2020-08-07 | SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie. |
CVE-2020-15138 | High | 7.1 | 2020-08-07 | Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary co… |
CVE-2020-9490 | High | 7.5 | 2020-08-07 | Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the serv… |
CVE-2020-7810 | High | 8.8 | 2020-08-07 | hslogin2.dll ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to the… |
CVE-2020-11993 | High | 7.5 | 2020-08-07 | Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were m… |
CVE-2020-11985 | Medium | 5.3 | 2020-08-07 | IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an atta… |
CVE-2020-11984 | Critical | 9.8 | 2020-08-07 | Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE |
CVE-2020-11852 | High | 8.8 | 2020-08-07 | DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vuln… |
CVE-2020-16168 | Medium | 6.5 | 2020-08-07 | Origin Validation Error in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to access the REST API and MQTT broker used by t… |
CVE-2020-8026 | High | 8.4 | 2020-08-07 | A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers wit… |
CVE-2020-8025 | Medium | 6.1 | 2020-08-07 | A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTS… |
CVE-2020-16227 | High | 7.8 | 2020-08-07 | Delta Electronics TPEditor Versions 1.97 and prior. An improper input validation may be exploited by processing a specially crafted project file not validated… |
CVE-2020-16225 | High | 7.8 | 2020-08-07 | Delta Electronics TPEditor Versions 1.97 and prior. A write-what-where condition may be exploited by processing a specially crafted project file. Successful ex… |
CVE-2020-16223 | High | 7.8 | 2020-08-07 | Delta Electronics TPEditor Versions 1.97 and prior. A heap-based buffer overflow may be exploited by processing a specially crafted project file. Successful ex… |
CVE-2020-16221 | High | 7.8 | 2020-08-07 | Delta Electronics TPEditor Versions 1.97 and prior. A stack-based buffer overflow may be exploited by processing a specially crafted project file. Successful e… |
CVE-2020-16219 | High | 7.8 | 2020-08-07 | Delta Electronics TPEditor Versions 1.97 and prior. An out-of-bounds read may be exploited by processing specially crafted project files. Successful exploitati… |
CVE-2020-15702 | High | 7.0 | 2020-08-06 | TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed proce… |
CVE-2020-15701 | Medium | 5.5 | 2020-08-06 | An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a st… |
CVE-2020-15136 | Medium | 6.5 | 2020-08-06 | In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS au… |
CVE-2020-15114 | High | 7.7 | 2020-08-06 | In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to i… |
CVE-2020-11937 | Medium | 5.5 | 2020-08-06 | In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion d… |
CVE-2020-15115 | Medium | 5.8 | 2020-08-06 | etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of o… |
CVE-2020-16229 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may c… |
CVE-2020-16217 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. A double free vulnerability caused by processing specially crafted project files may allow remot… |
CVE-2020-16215 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may c… |
CVE-2020-16213 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may c… |
CVE-2020-16211 | Medium | 5.5 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially crafted project fil… |
CVE-2020-16207 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafte… |
CVE-2020-13793 | Critical | 9.8 | 2020-08-06 | Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key. |
CVE-2020-12441 | Critical | 9.8 | 2020-08-06 | Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemoteService’ agent. The… |
CVE-2020-16845 | High | 7.5 | 2020-08-06 | Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs. |
CVE-2020-7817 | Medium | 5.5 | 2020-08-06 | MyBrowserPlus downloads the files needed to run the program through the setup file (Setup.inf). At this time, there is a vulnerability in downloading arbitrary… |
CVE-2020-7460 | High | 7.0 | 2020-08-06 | In FreeBSD 12.1-STABLE before r363918, 12.1-RELEASE before p8, 11.4-STABLE before r363919, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, the sendmsg sys… |
CVE-2020-7459 | Medium | 6.8 | 2020-08-06 | In FreeBSD 12.1-STABLE before r362166, 12.1-RELEASE before p8, 11.4-STABLE before r362167, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, missing length… |
CVE-2020-13365 | High | 8.8 | 2020-08-06 | Certain Zyxel products have a locally accessible binary that allows a non-root user to generate a password for an undocumented user account that can be used fo… |
CVE-2020-13364 | High | 8.8 | 2020-08-06 | A backdoor in certain Zyxel products allows remote TELNET access via a CGI script. This affects NAS520 V5.21(AASZ.4)C0, V5.21(AASZ.0)C0, V5.11(AASZ.3)C0, and V… |
CVE-2020-7361 | Critical | 9.6 | 2020-08-06 | The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the Ze… |
CVE-2020-7357 | Critical | 9.6 | 2020-08-06 | Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute ar… |
CVE-2020-7356 | Critical | 10.0 | 2020-08-06 | CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is… |
CVE-2020-7352 | High | 8.4 | 2020-08-06 | The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, stat… |
CVE-2020-9036 | Medium | 6.1 | 2020-08-05 | Jeedom through 4.0.38 allows XSS. |
CVE-2020-17366 | High | 7.4 | 2020-08-05 | An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of… |
CVE-2020-7298 | High | 7.5 | 2020-08-05 | Unexpected behavior violation in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to turn off real time scanning via a specially crafted obje… |
CVE-2020-15132 | Medium | 5.3 | 2020-08-05 | In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email a… |
CVE-2020-15127 | High | 7.5 | 2020-08-05 | In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress… |
CVE-2020-13404 | High | 8.8 | 2020-08-05 | The ATOS/Sips (aka Atos-Magento) community module 3.0.0 to 3.0.5 for Magento allows command injection. |
CVE-2020-16254 | Medium | 6.1 | 2020-08-05 | The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute). |
CVE-2020-15113 | Medium | 5.7 | 2020-08-05 | In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically gener… |
CVE-2020-15112 | Medium | 6.5 | 2020-08-05 | In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This c… |
CVE-2020-15106 | Medium | 6.5 | 2020-08-05 | In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file… |
CVE-2020-16192 | Medium | 6.1 | 2020-08-05 | LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters. |
CVE-2020-17364 | Medium | 6.1 | 2020-08-05 | USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs. |
CVE-2020-8607 | Medium | 6.7 | 2020-08-05 | An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an… |
CVE-2020-5609 | Critical | 9.8 | 2020-08-05 | Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Bas… |
CVE-2020-5608 | Critical | 9.8 | 2020-08-05 | CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R… |
CVE-2020-4481 | High | 8.2 | 2020-08-05 | IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A re… |
CVE-2020-4243 | Low | 3.7 | 2020-08-05 | IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information using man in the middle… |
CVE-2020-17353 | Critical | 9.8 | 2020-08-05 | scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg… |
CVE-2020-16253 | High | 8.1 | 2020-08-05 | The PgHero gem through 2.6.0 for Ruby allows CSRF. |
CVE-2020-16252 | Medium | 4.3 | 2020-08-05 | The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF. |
CVE-2020-14347 | Medium | 5.5 | 2020-08-05 | A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server run… |
CVE-2020-14344 | Medium | 6.7 | 2020-08-05 | An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upst… |
CVE-2020-13921 | Critical | 9.8 | 2020-08-05 | **Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases. |
CVE-2020-13819 | Medium | 6.1 | 2020-08-05 | Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. |
CVE-2020-13151 | Critical | 9.8 | 2020-08-05 | Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database… |
CVE-2020-15109 | Medium | 5.3 | 2020-08-04 | In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allo… |
CVE-2020-16847 | Medium | 6.1 | 2020-08-04 | Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887. |