2020 CVEs (page 120)

Page 120 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.

All CVEs published in 2020 — newest first (page 120 of 194)
CVESeverityScorePublishedSummary
CVE-2020-7685Medium5.42020-07-28This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The pa…
CVE-2020-15628High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15627High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15626High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15625High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15624High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15623Critical9.82020-07-28This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not requ…
CVE-2020-15622High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15621High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15620High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15619High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15618High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15617High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15616High7.52020-07-28This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is…
CVE-2020-15615Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15614Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15613Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15612Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15611Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15610Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15609Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15608Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15607Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15606Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15435Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15434Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15433Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15432Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15431Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15430Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15429Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15428Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15427Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15426Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15425Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15424Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15423Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15422Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15421Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req…
CVE-2020-15420Critical9.82020-07-28This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. Authentication is not req…
CVE-2020-15900Critical9.82020-07-28A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access control…
CVE-2020-15863Medium5.32020-07-28hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highban…
CVE-2020-15408Low3.72020-07-28An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web int…
CVE-2020-13919Critical9.82020-07-28emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to achieve command injection via a crafted HTTP request. This affects…
CVE-2020-13918High7.52020-07-28Incorrect access control in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to leak system information (that can be used for…
CVE-2020-13917Critical9.82020-07-28rkscli in Ruckus Wireless Unleashed through 200.7.10.92 allows a remote attacker to achieve command injection and jailbreak the CLI via a crafted CLI command…
CVE-2020-13916Critical9.82020-07-28A stack buffer overflow in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to execute code via an unauthenticated crafted HT…
CVE-2020-13915High7.52020-07-28Insecure permissions in emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allow a remote attacker to overwrite admin credentials via an unauthen…
CVE-2020-13914High7.52020-07-28webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to cause a denial of service (Segmentation fault) to the webserver via an un…
CVE-2020-13913Medium6.12020-07-28An XSS issue in emfd in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to execute JavaScript code via an unauthenticated crafted HT…
CVE-2020-15715Critical9.92020-07-28rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script. An attack…
CVE-2020-15714High8.82020-07-28rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.crud.php script using the custom…
CVE-2020-15713High8.82020-07-28rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.php script using the sortBy para…
CVE-2020-15712Medium4.32020-07-28rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a crafted request to the ajaxGetFileByP…
CVE-2020-4465Medium6.52020-07-28IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS is vulnerable to a buffer overflow vulnerability due to an error within the chann…
CVE-2020-4375High7.52020-07-28IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS could allow an attacker to cause a denial of service due to a memory leak caused by a…
CVE-2020-4319Medium4.32020-07-28IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitiv…
CVE-2020-4318Medium5.42020-07-28IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cro…
CVE-2020-4317Medium5.42020-07-28IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cro…
CVE-2020-16088Critical9.82020-07-28iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches.
CVE-2020-12880Medium5.52020-07-27An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8. By manipulating a certain kernel boot param…
CVE-2020-12845High7.52020-07-27Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sen…
CVE-2020-12460Critical9.82020-07-27OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap over…
CVE-2020-10643Medium6.52020-07-27An authenticated remote attacker could use specially crafted URLs to send a victim using PI Vision 2019 mobile to a vulnerable web page due to a known issue in…
CVE-2020-8558Medium5.42020-07-27The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent…
CVE-2020-1457High7.82020-07-27A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka 'Microsoft Windows Codecs Library…
CVE-2020-1425High7.82020-07-27A remoted code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka 'Microsoft Windows Codecs Library…
CVE-2020-10609High7.52020-07-27Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to be read or allow modification to system settings by someone w…
CVE-2020-7017Medium6.72020-07-27In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map v…
CVE-2020-7016Medium4.82020-07-27Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user c…
CVE-2020-15120Medium4.92020-07-27In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this othe…
CVE-2020-15103Low3.52020-07-27In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The in…
CVE-2020-4498Medium4.42020-07-27IBM MQ Appliance 9.1 LTS and 9.1 CD could allow a local privileged user to obtain highly sensitve information due to inclusion of data within trace files. IBM…
CVE-2020-4408Medium4.62020-07-27The IBM QRadar Advisor 1.1 through 2.5.2 with Watson App for IBM QRadar SIEM does not adequately mask all passwords during input, which could be obtained by a…
CVE-2020-4405Medium4.32020-07-27IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due to world readable log files. IBM X-Force…
CVE-2020-15593High7.82020-07-27SteelCentral Aternity Agent 11.0.0.120 on Windows mishandles IPC. It uses an executable running as a high privileged Windows service to perform administrative…
CVE-2020-15592High7.52020-07-27SteelCentral Aternity Agent before 11.0.0.120 on Windows allows Privilege Escalation via a crafted file. It uses an executable running as a high privileged Win…
CVE-2020-9251Low2.42020-07-27HUAWEI Mate 20 smartphones with versions earlier than 10.1.0.160(C00E160R2P11) have an improper authorization vulnerability. The software does not properly res…
CVE-2020-9077Low3.32020-07-27HUAWEI P30 smart phones with versions earlier than 10.1.0.160(C00E160R2P11) have an information exposure vulnerability. The system does not properly authentica…
CVE-2020-11110Medium5.42020-07-27Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that…
CVE-2020-7695Medium5.32020-07-27Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add…
CVE-2020-7694Low3.72020-07-27This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP req…
CVE-2020-5611High8.82020-07-27Cross-site request forgery (CSRF) vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attackers to hijack the authentication of admin…
CVE-2020-15954Medium6.52020-07-27KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.
CVE-2020-15953High7.42020-07-27LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server…
CVE-2020-7687High7.52020-07-25This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.
CVE-2020-7686High7.52020-07-25This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function.
CVE-2020-7683High7.52020-07-25This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase fun…
CVE-2020-7682High7.52020-07-25This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.
CVE-2020-7681High7.52020-07-25This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js.
CVE-2020-10614Medium4.82020-07-25In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject code into a display…
CVE-2020-10604High7.52020-07-25In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted reques…
CVE-2020-12812Critical9.82020-07-24An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully wi…
CVE-2020-10610High7.82020-07-24In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to…
CVE-2020-10608High7.82020-07-24In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. Thi…
CVE-2020-10606High7.82020-07-24In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. This exploitation c…
CVE-2020-10602Medium5.32020-07-24In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager due to a race condition. This can result i…
CVE-2020-10600Medium5.92020-07-24An authenticated remote attacker could crash PI Archive Subsystem when the subsystem is working under memory pressure. This can result in blocking queries to P…
CVE-2020-8207High8.82020-07-24Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the automatic updater servi…
CVE-2020-8175Medium5.52020-07-24Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.