2020 CVEs (page 118)
Page 118 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15135 | Medium | 6.7 | 2020-08-04 | save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version… |
CVE-2020-16843 | Medium | 5.9 | 2020-08-04 | In Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic. This can result in a denial of service… |
CVE-2020-15956 | High | 7.5 | 2020-08-04 | ActiveMediaServer.exe in ACTi NVR3 Standard Server 3.0.12.42 allows remote unauthenticated attackers to trigger a buffer overflow and application termination v… |
CVE-2020-15944 | Medium | 5.4 | 2020-08-04 | An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is vulnerable to a persistent XSS attack… |
CVE-2020-15943 | High | 8.1 | 2020-08-04 | An issue was discovered in the Gantt-Chart module before 5.5.4 for Jira. Due to a missing privilege check, it is possible to read and write to the module confi… |
CVE-2020-13522 | High | 7.1 | 2020-08-04 | An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can allow… |
CVE-2020-16203 | High | 7.8 | 2020-08-04 | Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a specially crafted proje… |
CVE-2020-16201 | Low | 3.3 | 2020-08-04 | Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specia… |
CVE-2020-16199 | High | 7.8 | 2020-08-04 | Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processi… |
CVE-2020-16134 | High | 8.0 | 2020-08-04 | An issue was discovered on Swisscom Internet Box 2, Internet Box Standard, Internet Box Plus prior to 10.04.38, Internet Box 3 prior to 11.01.20, and Internet… |
CVE-2020-13523 | Low | 3.3 | 2020-08-04 | An exploitable information disclosure vulnerability exists in SoftPerfect’s RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can cau… |
CVE-2020-4631 | Medium | 5.5 | 2020-08-04 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permis… |
CVE-2020-4542 | Medium | 5.4 | 2020-08-04 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4525 | Medium | 5.4 | 2020-08-04 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4459 | Critical | 9.8 | 2020-08-04 | IBM Security Verify Access 10.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, out… |
CVE-2020-4410 | Medium | 4.3 | 2020-08-04 | IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to send a specially crafted HTTP GET request to read attachments on the serv… |
CVE-2020-4396 | Medium | 5.4 | 2020-08-04 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-7823 | High | 7.8 | 2020-08-04 | DaviewIndy has a Memory corruption vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could exploi… |
CVE-2020-7822 | High | 7.8 | 2020-08-04 | DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Attackers could expl… |
CVE-2020-6012 | High | 7.4 | 2020-08-04 | ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed attacker can replace t… |
CVE-2020-15467 | High | 8.8 | 2020-08-04 | The administrative interface of Cohesive Networks vns3:vpn appliances before version 4.11.1 is vulnerable to authenticated remote code execution leading to ser… |
CVE-2020-5617 | High | 7.8 | 2020-08-04 | Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unauthorized privileges and modify/obtain se… |
CVE-2020-5616 | Critical | 9.8 | 2020-08-04 | [Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [Calenda… |
CVE-2020-5615 | High | 8.8 | 2020-08-04 | Cross-site request forgery (CSRF) vulnerability in [Calendar01] free edition ver1.0.0 and [Calendar02] free edition ver1.0.0 allows remote attackers to hijack… |
CVE-2020-11584 | Medium | 6.1 | 2020-08-03 | A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parame… |
CVE-2020-11583 | Medium | 6.1 | 2020-08-03 | A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET pa… |
CVE-2020-5773 | High | 8.8 | 2020-08-03 | Improper Access Control in Teltonika firmware TRB2_R_00.02.04.01 allows a low privileged user to perform unauthorized write operations. |
CVE-2020-5772 | High | 7.5 | 2020-08-03 | Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious pac… |
CVE-2020-5771 | High | 7.5 | 2020-08-03 | Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious bac… |
CVE-2020-5770 | High | 8.8 | 2020-08-03 | Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.01 allows a remote attacker to perform sensitive application actions by tricking legitimate us… |
CVE-2020-16116 | Low | 3.3 | 2020-08-03 | In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal. |
CVE-2020-8575 | Medium | 4.4 | 2020-08-03 | Active IQ Unified Manager for VMware vSphere and Windows versions prior to 9.5 are susceptible to a vulnerability which allows administrative users to cause De… |
CVE-2020-8574 | High | 7.8 | 2020-08-03 | Active IQ Unified Manager for Linux versions prior to 9.6 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service enabled allowing u… |
CVE-2020-16272 | Critical | 9.1 | 2020-08-03 | The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote attackers to read an… |
CVE-2020-16271 | Critical | 9.1 | 2020-08-03 | The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data… |
CVE-2020-16131 | Medium | 6.1 | 2020-08-03 | Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php. |
CVE-2020-14319 | Medium | 5.9 | 2020-08-03 | It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight checks are not inst… |
CVE-2020-13820 | Medium | 6.1 | 2020-08-03 | Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. |
CVE-2020-12739 | Medium | 5.3 | 2020-08-03 | A denial-of-service vulnerability in the Fanuc i Series CNC (0i-MD and 0i Mate-MD) could allow an unauthenticated, remote attacker to cause an affected CNC to… |
CVE-2020-16269 | Medium | 5.5 | 2020-08-03 | radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed DW_AT_name in the… |
CVE-2020-4560 | Medium | 6.1 | 2020-08-03 | IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2020-4554 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-4553 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-4552 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to op… |
CVE-2020-4551 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-4550 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-4549 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to op… |
CVE-2020-4534 | High | 8.8 | 2020-08-03 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by imprope… |
CVE-2020-4377 | Critical | 9.1 | 2020-08-03 | IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this… |
CVE-2020-4328 | Medium | 6.3 | 2020-08-03 | IBM Financial Transaction Manager 3.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the at… |
CVE-2020-8108 | High | 8.2 | 2020-08-03 | Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially injec… |
CVE-2020-14311 | Medium | 5.7 | 2020-07-31 | There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT3… |
CVE-2020-14310 | Medium | 5.7 | 2020-07-31 | There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it… |
CVE-2020-5414 | Medium | 5.7 | 2020-07-31 | VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Au… |
CVE-2020-5413 | Critical | 9.8 | 2020-07-31 | Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, al… |
CVE-2020-5396 | High | 8.8 | 2020-07-31 | VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a… |
CVE-2020-15871 | High | 8.8 | 2020-07-31 | Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution. |
CVE-2020-15870 | Medium | 6.1 | 2020-07-31 | Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). |
CVE-2020-15869 | Medium | 5.4 | 2020-07-31 | Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2). |
CVE-2020-5384 | High | 8.4 | 2020-07-31 | Authentication Bypass Vulnerability RSA MFA Agent 2.0 for Microsoft Windows contains an Authentication Bypass vulnerability. A local unauthenticated attacker c… |
CVE-2020-15134 | High | 8.0 | 2020-07-31 | Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes. Faye uses em-http-request and faye-websocket in the Ruby version of i… |
CVE-2020-15133 | High | 8.0 | 2020-07-31 | In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The `Faye::WebSocket::Client` class uses the `EM::Conne… |
CVE-2020-15128 | Medium | 6.1 | 2020-07-31 | In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of… |
CVE-2020-12081 | High | 7.5 | 2020-07-31 | An information disclosure vulnerability has been identified in FlexNet Publisher lmadmin.exe 11.14.0.2. The web portal link can be used to access to system fil… |
CVE-2020-16136 | High | 7.7 | 2020-07-31 | In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine (accessible by the owne… |
CVE-2020-9249 | Medium | 6.5 | 2020-07-31 | HUAWEI P30 smartphones with versions earlier than 10.1.0.160(C00E160R2P11) have a denial of service vulnerability. A module does not deal with mal-crafted mess… |
CVE-2020-9248 | Medium | 6.7 | 2020-07-31 | Huawei FusionComput 8.0.0 have an improper authorization vulnerability. A module does not verify some input correctly and authorizes files with incorrect acces… |
CVE-2020-14520 | High | 7.5 | 2020-07-31 | The affected product is vulnerable to an information leak, which may allow an attacker to obtain sensitive information on the Ignition 8 (all versions prior to… |
CVE-2020-14337 | Medium | 5.8 | 2020-07-31 | A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attack… |
CVE-2020-14334 | High | 8.8 | 2020-07-31 | A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files. These cache credentials could help attacker to gain complete cont… |
CVE-2020-10731 | Critical | 9.9 | 2020-07-31 | A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, a… |
CVE-2020-3681 | Critical | 9.8 | 2020-07-31 | Authenticated and encrypted payload MMEs can be forged and remotely sent to any HPAV2 system using a jailbreak key recoverable from code. |
CVE-2020-3462 | Medium | 6.3 | 2020-07-31 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct SQL… |
CVE-2020-3461 | Medium | 5.3 | 2020-07-31 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to obtain con… |
CVE-2020-3460 | Medium | 6.1 | 2020-07-31 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a… |
CVE-2020-3386 | High | 8.8 | 2020-07-31 | A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with a low-privileged accoun… |
CVE-2020-3384 | High | 8.2 | 2020-07-31 | A vulnerability in specific REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary co… |
CVE-2020-3383 | High | 8.8 | 2020-07-31 | A vulnerability in the archive utility of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct directory traversal… |
CVE-2020-3382 | Critical | 9.8 | 2020-07-31 | A vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execut… |
CVE-2020-3377 | Medium | 6.3 | 2020-07-31 | A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary… |
CVE-2020-3376 | High | 7.3 | 2020-07-31 | A vulnerability in the Device Manager application of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authent… |
CVE-2020-3375 | Critical | 9.8 | 2020-07-31 | A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. The vulnera… |
CVE-2020-3374 | Critical | 9.9 | 2020-07-31 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, e… |
CVE-2020-16166 | Low | 3.7 | 2020-07-30 | The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network… |
CVE-2020-16165 | Critical | 9.8 | 2020-07-30 | The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. This is related to the /api/blade-log/api/list ascs and des… |
CVE-2020-7205 | Medium | 6.7 | 2020-07-30 | A potential security vulnerability has been identified in HPE Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit. The vulnerability… |
CVE-2020-16164 | High | 7.4 | 2020-07-30 | An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. It allows remote attackers to bypass intended access restrictions or to ca… |
CVE-2020-16163 | Critical | 9.1 | 2020-07-30 | An issue was discovered in RIPE NCC RPKI Validator 3.x before 3.1-2020.07.06.14.28. RRDP fetches proceed even with a lack of validation of a TLS HTTPS endpoint… |
CVE-2020-16162 | High | 7.5 | 2020-07-30 | An issue was discovered in RIPE NCC RPKI Validator 3.x through 3.1-2020.07.06.14.28. Missing validation checks on CRL presence or CRL staleness in the X509-bas… |
CVE-2020-15129 | Medium | 6.1 | 2020-07-30 | In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix"… |
CVE-2020-16157 | Medium | 5.4 | 2020-07-30 | A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu. |
CVE-2020-15131 | High | 7.5 | 2020-07-30 | In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis tran… |
CVE-2020-15130 | High | 7.5 | 2020-07-30 | In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type… |
CVE-2020-7829 | High | 7.8 | 2020-07-30 | DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by… |
CVE-2020-7828 | High | 7.8 | 2020-07-30 | DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by… |
CVE-2020-7827 | High | 7.8 | 2020-07-30 | DaviewIndy 8.98.7 and earlier version contain Use-After-Free vulnerability, triggered when the user opens a malformed specific file that is mishandled by Davie… |
CVE-2020-15957 | High | 7.5 | 2020-07-30 | An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing (DP3T). When it is configured to check JWT befo… |
CVE-2020-15511 | Medium | 5.3 | 2020-07-30 | HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when disabled, bypassing SAML enforcement. F… |
CVE-2020-14162 | High | 7.8 | 2020-07-30 | An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which… |
CVE-2020-14158 | Critical | 9.1 | 2020-07-30 | The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that are exchanged with a… |