2020 CVEs (page 129)
Page 129 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15093 | High | 8.6 | 2020-07-09 | The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicat… |
CVE-2020-15092 | High | 7.2 | 2020-07-09 | In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of… |
CVE-2020-15001 | Medium | 5.3 | 2020-07-09 | An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access… |
CVE-2020-15000 | Medium | 5.9 | 2020-07-09 | A PIN management problem was discovered on Yubico YubiKey 5 devices 5.2.0 to 5.2.6. OpenPGP has three passwords: Admin PIN, Reset Code, and User PIN. The Reset… |
CVE-2020-14171 | Medium | 6.5 | 2020-07-09 | Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the… |
CVE-2020-14170 | Medium | 4.3 | 2020-07-09 | Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal network resources via a… |
CVE-2020-13132 | Medium | 4.6 | 2020-07-09 | An issue was discovered in Yubico libykpiv before 2.1.0. An attacker can trigger an incorrect free() in the ykpiv_util_generate_key() function in lib/util.c th… |
CVE-2020-13131 | Medium | 4.3 | 2020-07-09 | An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is included in yubico-piv-tool) does not properly check embedded len… |
CVE-2020-15526 | Medium | 5.9 | 2020-07-09 | In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive), the scope for disabling some TLS security certificate checks can extend beyond that defined by various… |
CVE-2020-10756 | Medium | 6.5 | 2020-07-09 | An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routi… |
CVE-2020-13994 | High | 8.8 | 2020-07-09 | An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the server via a ticket because of improper ac… |
CVE-2020-13993 | High | 7.5 | 2020-07-09 | An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A blind time-based SQL injection issue allows remote unauthenticated attackers to retrieve inf… |
CVE-2020-13992 | Medium | 6.1 | 2020-07-09 | An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attackers to abuse a helpdesk user's logged i… |
CVE-2020-12426 | High | 8.8 | 2020-07-09 | Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2020-12425 | Medium | 6.5 | 2020-07-09 | Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential information disclosure… |
CVE-2020-12423 | High | 7.8 | 2020-07-09 | When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%, Firefox may have lo… |
CVE-2020-12422 | High | 8.8 | 2020-07-09 | In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out of bounds write, mem… |
CVE-2020-12421 | Medium | 6.5 | 2020-07-09 | When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.)… |
CVE-2020-12420 | High | 8.8 | 2020-07-09 | When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially explo… |
CVE-2020-12419 | High | 8.8 | 2020-07-09 | When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This c… |
CVE-2020-12418 | Medium | 6.5 | 2020-07-09 | Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affec… |
CVE-2020-12417 | High | 8.8 | 2020-07-09 | Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitab… |
CVE-2020-12416 | High | 8.8 | 2020-07-09 | A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory corruption, and a po… |
CVE-2020-12415 | Medium | 6.5 | 2020-07-09 | When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This co… |
CVE-2020-12414 | Medium | 6.5 | 2020-07-09 | IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the pr… |
CVE-2020-12412 | Medium | 4.3 | 2020-07-09 | By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with the https:// scheme, a blocked port nu… |
CVE-2020-12411 | High | 8.8 | 2020-07-09 | Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2020-12410 | High | 8.8 | 2020-07-09 | Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2020-12409 | High | 8.8 | 2020-07-09 | When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This vulnerability affects Firefox < 77. |
CVE-2020-12408 | Medium | 6.5 | 2020-07-09 | When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the address bar. This vuln… |
CVE-2020-12407 | Medium | 6.5 | 2020-07-09 | Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the visible screen. The le… |
CVE-2020-12406 | High | 8.8 | 2020-07-09 | Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it… |
CVE-2020-12405 | Medium | 5.3 | 2020-07-09 | When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects… |
CVE-2020-12404 | Medium | 4.3 | 2020-07-09 | For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when… |
CVE-2020-12402 | Medium | 4.4 | 2020-07-09 | During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow… |
CVE-2020-12399 | Medium | 4.4 | 2020-07-09 | NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thund… |
CVE-2020-12398 | High | 7.5 | 2020-07-09 | If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted co… |
CVE-2020-7693 | Medium | 5.3 | 2020-07-09 | Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.2… |
CVE-2020-7692 | High | 7.4 | 2020-07-09 | PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an author… |
CVE-2020-7458 | Critical | 9.8 | 2020-07-09 | In FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEASE before p1, long values in the user-controlled PATH environment variable cau… |
CVE-2020-7457 | High | 8.1 | 2020-07-09 | In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchro… |
CVE-2020-5366 | High | 7.1 | 2020-07-09 | Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentiall… |
CVE-2020-12424 | Medium | 6.5 | 2020-07-09 | When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin… |
CVE-2020-9377 | High | 8.8 | 2020-07-09 | D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer s… |
CVE-2020-9376 | High | 7.5 | 2020-07-09 | D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects produ… |
CVE-2020-5604 | High | 8.1 | 2020-07-09 | Android App 'Mercari' (Japan version) prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a Man-In-The-Middle a… |
CVE-2020-5974 | High | 7.8 | 2020-07-08 | NVIDIA JetPack SDK, version 4.2 and 4.3, contains a vulnerability in its installation scripts in which permissions are incorrectly set on certain directories… |
CVE-2020-15073 | Medium | 5.4 | 2020-07-08 | An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. T… |
CVE-2020-15072 | High | 8.8 | 2020-07-08 | An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section. |
CVE-2020-2034 | High | 8.1 | 2020-07-08 | An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with… |
CVE-2020-2031 | Medium | 4.9 | 2020-07-08 | An integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface allows authenticated administrators to issue a command from th… |
CVE-2020-2030 | High | 7.2 | 2020-07-08 | An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root pr… |
CVE-2020-1982 | Medium | 4.8 | 2020-07-08 | Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak protocol. These clou… |
CVE-2020-6938 | High | 7.5 | 2020-07-08 | A sensitive information disclosure vulnerability in Tableau Server 10.5, 2018.x, 2019.x, 2020.x released before June 26, 2020, could allow access to sensitive… |
CVE-2020-5839 | High | 7.5 | 2020-07-08 | Symantec Endpoint Detection And Response, prior to 4.4, may be susceptible to an information disclosure issue, which is a type of vulnerability that could pote… |
CVE-2020-11994 | High | 7.5 | 2020-07-08 | Server-Side Template Injection and arbitrary file disclosure on Camel templating components |
CVE-2020-7140 | Medium | 6.1 | 2020-07-08 | A security vulnerability in HPE IceWall SSO Dfw and Dgfw (Domain Gateway Option) could be exploited remotely to cause a remote cross-site scripting (XSS). HPE… |
CVE-2020-5764 | High | 8.8 | 2020-07-08 | MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive"… |
CVE-2020-3973 | High | 8.8 | 2020-07-08 | The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orch… |
CVE-2020-11849 | Critical | 9.8 | 2020-07-08 | Elevation of privilege and/or unauthorized access vulnerability in Micro Focus Identity Manager. Affecting versions prior to 4.7.3 and 4.8.1 hot fix 1. The vul… |
CVE-2020-3931 | Critical | 9.8 | 2020-07-08 | Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command. |
CVE-2020-15600 | Medium | 6.5 | 2020-07-07 | An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password. |
CVE-2020-8916 | Medium | 5.0 | 2020-07-07 | A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly in… |
CVE-2020-15599 | Medium | 6.1 | 2020-07-07 | Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field. |
CVE-2020-8521 | Critical | 9.8 | 2020-07-07 | SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql |
CVE-2020-8520 | Critical | 9.8 | 2020-07-07 | SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql |
CVE-2020-8519 | Critical | 9.8 | 2020-07-07 | SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql |
CVE-2020-15008 | High | 7.5 | 2020-07-07 | A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a cu… |
CVE-2020-12821 | Critical | 9.8 | 2020-07-07 | Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack. |
CVE-2020-12736 | High | 7.2 | 2020-07-07 | Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO… |
CVE-2020-15095 | Medium | 4.4 | 2020-07-07 | Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<u… |
CVE-2020-15350 | Critical | 9.8 | 2020-07-07 | RIOT 2020.04 has a buffer overflow in the base64 decoder. The decoding function base64_decode() uses an output buffer estimation function to compute the requir… |
CVE-2020-15515 | High | 8.8 | 2020-07-07 | The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution. |
CVE-2020-15035 | Medium | 5.4 | 2020-07-07 | NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Map.ph… |
CVE-2020-15034 | Medium | 5.4 | 2020-07-07 | NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Setup… |
CVE-2020-15033 | Medium | 5.4 | 2020-07-07 | NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the snmpget.php ip pa… |
CVE-2020-15032 | Medium | 5.4 | 2020-07-07 | NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Incide… |
CVE-2020-15031 | Medium | 5.4 | 2020-07-07 | NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management… |
CVE-2020-15030 | Medium | 5.4 | 2020-07-07 | NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Routes.p… |
CVE-2020-15029 | Medium | 5.4 | 2020-07-07 | NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management… |
CVE-2020-15028 | Medium | 5.4 | 2020-07-07 | NeDi 1.9C is vulnerable to a cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Map.ph… |
CVE-2020-11882 | Medium | 6.1 | 2020-07-07 | The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications. The purpose of this activity is to handle… |
CVE-2020-15037 | Medium | 5.4 | 2020-07-07 | NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.p… |
CVE-2020-15036 | Medium | 5.4 | 2020-07-07 | NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Linked.p… |
CVE-2020-15584 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can trigger an out-of-bounds access and device reset via a 4K wallpaper imag… |
CVE-2020-15583 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. StickerProvider allows directory traversal for access to system fi… |
CVE-2020-15582 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 7885 chipsets) software. The Bluetooth Low Energy (BLE) component has a buffe… |
CVE-2020-15581 | Medium | 5.3 | 2020-07-07 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The kernel logging feature allows attackers to discover virtual ad… |
CVE-2020-15580 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) by enrolling a… |
CVE-2020-15579 | High | 7.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via the KNOX A… |
CVE-2020-15578 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with O(8.x) software. FactoryCamera does not properly restrict runtime permissions. The Samsung ID is SVE-202… |
CVE-2020-15577 | Medium | 5.5 | 2020-07-07 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Cameralyzer allows attackers to write files to the SD card. The Samsung ID… |
CVE-2020-15576 | High | 7.5 | 2020-07-07 | SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response. |
CVE-2020-15575 | Medium | 6.1 | 2020-07-07 | SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194. |
CVE-2020-15574 | High | 7.5 | 2020-07-07 | SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893. |
CVE-2020-15573 | Medium | 6.1 | 2020-07-07 | SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421. |
CVE-2020-15525 | Medium | 5.3 | 2020-07-07 | GitLab EE 11.3 through 13.1.2 has Incorrect Access Control because of the Maven package upload endpoint. |
CVE-2020-15517 | Medium | 5.4 | 2020-07-07 | The ke_search (aka Faceted Search) extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS. |
CVE-2020-15516 | Medium | 5.4 | 2020-07-07 | The mm_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF. |
CVE-2020-15514 | Medium | 5.4 | 2020-07-07 | The jh_captcha extension through 2.1.3, and 3.x through 3.0.2, for TYPO3 allows XSS. |