2020 CVEs (page 121)
Page 121 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-8174 | High | 8.1 | 2020-07-24 | napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0. |
CVE-2020-15945 | Medium | 5.5 | 2020-07-24 | Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an old… |
CVE-2020-14725 | Medium | 4.9 | 2020-07-24 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exp… |
CVE-2020-15932 | High | 8.8 | 2020-07-24 | Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges. |
CVE-2020-8326 | High | 7.3 | 2020-07-24 | An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execu… |
CVE-2020-8317 | High | 7.3 | 2020-07-24 | A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code… |
CVE-2020-15860 | Critical | 9.9 | 2020-07-24 | Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any appli… |
CVE-2020-14307 | Medium | 6.5 | 2020-07-24 | A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed fr… |
CVE-2020-14297 | Medium | 6.5 | 2020-07-24 | A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the tim… |
CVE-2020-15778 | High | 7.4 | 2020-07-24 | scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE… |
CVE-2020-14175 | Medium | 5.4 | 2020-07-24 | Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS)… |
CVE-2020-15924 | High | 7.5 | 2020-07-24 | There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is required. The injection point resides in o… |
CVE-2020-15923 | High | 7.5 | 2020-07-24 | Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal. |
CVE-2020-15922 | Critical | 9.8 | 2020-07-24 | There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges… |
CVE-2020-15921 | Critical | 9.8 | 2020-07-24 | Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execu… |
CVE-2020-15920 | Critical | 9.8 | 2020-07-24 | There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) pri… |
CVE-2020-15919 | Medium | 6.1 | 2020-07-24 | A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0. |
CVE-2020-15918 | Medium | 5.4 | 2020-07-24 | Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0. |
CVE-2020-7520 | Medium | 4.7 | 2020-07-23 | A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could… |
CVE-2020-7519 | High | 7.5 | 2020-07-23 | A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to compromise a user ac… |
CVE-2020-7518 | High | 7.5 | 2020-07-23 | A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to modify project configu… |
CVE-2020-7517 | Medium | 5.5 | 2020-07-23 | A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to read… |
CVE-2020-7516 | High | 7.8 | 2020-07-23 | A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker access… |
CVE-2020-7515 | High | 7.8 | 2020-07-23 | A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker to… |
CVE-2020-7514 | High | 7.8 | 2020-07-23 | A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker a… |
CVE-2020-7491 | High | 7.5 | 2020-07-23 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 through 10.5.3 is visible on the network… |
CVE-2020-15633 | High | 8.8 | 2020-07-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi… |
CVE-2020-15632 | High | 8.8 | 2020-07-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is no… |
CVE-2020-15631 | High | 8.0 | 2020-07-23 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 1.04B03_HOTFIX WiFi extenders. Alth… |
CVE-2020-11625 | Medium | 5.3 | 2020-07-23 | An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438… |
CVE-2020-11624 | Critical | 9.8 | 2020-07-23 | An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438… |
CVE-2020-15492 | Critical | 9.8 | 2020-07-23 | An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) i… |
CVE-2020-15477 | Critical | 9.8 | 2020-07-23 | The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTorto… |
CVE-2020-15391 | Critical | 9.8 | 2020-07-23 | The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. T… |
CVE-2020-11623 | Medium | 6.8 | 2020-07-23 | An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438… |
CVE-2020-15917 | Critical | 9.8 | 2020-07-23 | common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled. |
CVE-2020-15916 | Critical | 9.8 | 2020-07-23 | goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in t… |
CVE-2020-8557 | Medium | 5.5 | 2020-07-23 | The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/h… |
CVE-2020-4447 | Medium | 5.4 | 2020-07-23 | IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2020-12638 | Medium | 6.8 | 2020-07-23 | An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices throu… |
CVE-2020-10922 | High | 7.5 | 2020-07-23 | This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch scre… |
CVE-2020-10921 | Critical | 9.8 | 2020-07-23 | This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authenticat… |
CVE-2020-10920 | Critical | 9.8 | 2020-07-23 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Aut… |
CVE-2020-10919 | Medium | 5.9 | 2020-07-23 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen pan… |
CVE-2020-10918 | High | 7.5 | 2020-07-23 | This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Auth… |
CVE-2020-15912 | Medium | 6.5 | 2020-07-23 | Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. NOTE: the vendor has developed P… |
CVE-2020-15887 | High | 8.8 | 2020-07-23 | A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary S… |
CVE-2020-15886 | High | 8.8 | 2020-07-23 | A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute arbitrary SQL comman… |
CVE-2020-15885 | Medium | 5.4 | 2020-07-23 | A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by p… |
CVE-2020-15884 | High | 8.8 | 2020-07-23 | A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order[0][dir] field on P… |
CVE-2020-15883 | Medium | 6.1 | 2020-07-23 | A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or H… |
CVE-2020-15882 | High | 8.1 | 2020-07-23 | A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines from the MunkiReport database. |
CVE-2020-15881 | Medium | 6.1 | 2020-07-23 | A Cross-Site Scripting (XSS) vulnerability in the munki_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attackers to inject arbitr… |
CVE-2020-11440 | High | 7.5 | 2020-07-23 | httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root. |
CVE-2020-15688 | High | 8.8 | 2020-07-23 | The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote… |
CVE-2020-15908 | High | 7.5 | 2020-07-23 | tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction from a TAR archive. |
CVE-2020-15904 | High | 7.8 | 2020-07-22 | A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file. |
CVE-2020-15126 | Medium | 6.5 | 2020-07-22 | In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and… |
CVE-2020-10917 | Critical | 9.8 | 2020-07-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NEC ESMPRO Manager 6.42. Authentication is not required to ex… |
CVE-2020-15902 | Medium | 6.1 | 2020-07-22 | Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option. |
CVE-2020-15901 | High | 8.8 | 2020-07-22 | In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys. |
CVE-2020-4400 | High | 7.5 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM… |
CVE-2020-4399 | Medium | 6.5 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could allow an authenticated user to send malformed requests to cause a denial of service against the server. IBM X-Fo… |
CVE-2020-4397 | Medium | 5.9 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an attacker using man in the middle technique… |
CVE-2020-4385 | Critical | 9.8 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentica… |
CVE-2020-4372 | High | 7.8 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 179009 |
CVE-2020-4371 | Low | 3.3 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against t… |
CVE-2020-4369 | Medium | 5.5 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user. IBM X-Force ID: 179004. |
CVE-2020-9687 | High | 8.8 | 2020-07-22 | Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2020-9686 | Medium | 6.5 | 2020-07-22 | Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code e… |
CVE-2020-9685 | High | 8.8 | 2020-07-22 | Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2020-9684 | High | 8.8 | 2020-07-22 | Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2020-9683 | High | 8.8 | 2020-07-22 | Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code e… |
CVE-2020-9680 | High | 8.8 | 2020-07-22 | Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . |
CVE-2020-9679 | Medium | 6.5 | 2020-07-22 | Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-9678 | High | 8.8 | 2020-07-22 | Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . |
CVE-2020-9677 | High | 8.8 | 2020-07-22 | Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-9676 | High | 7.8 | 2020-07-22 | Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-9675 | High | 7.8 | 2020-07-22 | Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-9674 | High | 7.8 | 2020-07-22 | Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-9665 | Medium | 6.1 | 2020-07-22 | Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitiv… |
CVE-2020-9664 | Critical | 9.8 | 2020-07-22 | Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2020-9663 | Medium | 5.3 | 2020-07-22 | Adobe Reader Mobile versions 20.0.1 and earlier have a directory traversal vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2020-3452 | High | 7.5 | 2020-07-22 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-15896 | High | 7.5 | 2020-07-22 | An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any… |
CVE-2020-15895 | Medium | 6.1 | 2020-07-22 | An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT… |
CVE-2020-15894 | High | 7.5 | 2020-07-22 | An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used t… |
CVE-2020-15893 | Critical | 9.8 | 2020-07-22 | An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can… |
CVE-2020-15892 | Critical | 9.8 | 2020-07-22 | An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the reque… |
CVE-2020-15806 | High | 7.5 | 2020-07-22 | CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation. |
CVE-2020-15124 | Critical | 9.6 | 2020-07-22 | In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This i… |
CVE-2020-6536 | Medium | 4.3 | 2020-07-22 | Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the content… |
CVE-2020-6535 | Medium | 6.1 | 2020-07-22 | Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer process to inject scrip… |
CVE-2020-6534 | High | 8.8 | 2020-07-22 | Heap buffer overflow in WebRTC in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6533 | High | 8.8 | 2020-07-22 | Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6531 | Medium | 4.3 | 2020-07-22 | Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
CVE-2020-6530 | High | 8.8 | 2020-07-22 | Out of bounds memory access in developer tools in Google Chrome prior to 84.0.4147.89 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-6529 | Medium | 4.3 | 2020-07-22 | Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak cross-origin data vi… |
CVE-2020-6528 | Medium | 4.3 | 2020-07-22 | Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via… |
CVE-2020-6527 | Medium | 4.3 | 2020-07-22 | Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML pa… |