2020 CVEs (page 13)
Page 13 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-28462 | High | 7.3 | 2022-07-25 | This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute th… |
CVE-2020-28461 | High | 7.3 | 2022-07-25 | This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the p… |
CVE-2020-28459 | High | 7.3 | 2022-07-25 | This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link. |
CVE-2020-28455 | High | 7.3 | 2022-07-25 | This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped. |
CVE-2020-28447 | Critical | 9.8 | 2022-07-25 | This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath) |
CVE-2020-28446 | Critical | 9.8 | 2022-07-25 | The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js. |
CVE-2020-28445 | Critical | 9.8 | 2022-07-25 | This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function. |
CVE-2020-28443 | Critical | 9.8 | 2022-07-25 | This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js. |
CVE-2020-28441 | High | 7.3 | 2022-07-25 | This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute… |
CVE-2020-28438 | Critical | 9.8 | 2022-07-25 | This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js |
CVE-2020-28436 | High | 7.3 | 2022-07-25 | This affects all versions of package google-cloudstorage-commands. |
CVE-2020-28435 | Critical | 9.4 | 2022-07-25 | This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js. |
CVE-2020-28422 | Medium | 6.4 | 2022-07-25 | All versions of package git-archive are vulnerable to Command Injection via the exports function. |
CVE-2020-14126 | High | 7.5 | 2022-07-22 | Information leakage vulnerability exists in the Mi Sound APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be explo… |
CVE-2020-14114 | High | 7.5 | 2022-07-22 | information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can… |
CVE-2020-36558 | Medium | 5.1 | 2022-07-21 | A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault. |
CVE-2020-36557 | Medium | 5.1 | 2022-07-21 | A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free. |
CVE-2020-21406 | High | 7.5 | 2022-07-20 | An issue was discovered in RK Smart TV Box MAX and V88 SmartTV box that allows attackers to cause a denial of service via the switchNextDisplayInterface servic… |
CVE-2020-21405 | High | 7.5 | 2022-07-20 | An issue was discovered in H96 Smart TV Box H96 Pro Plus allows attackers to corrupt files via calls to the saveDeepColorAttr service.unk |
CVE-2020-23563 | Medium | 5.5 | 2022-07-18 | IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000002cba. |
CVE-2020-23562 | Medium | 5.5 | 2022-07-18 | IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x000000000000aefe. |
CVE-2020-23561 | Medium | 5.5 | 2022-07-18 | IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000005722. |
CVE-2020-16093 | High | 7.5 | 2022-07-18 | In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because… |
CVE-2020-7641 | Medium | 4.0 | 2022-07-17 | This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __… |
CVE-2020-35305 | Medium | 6.1 | 2022-07-15 | Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog. |
CVE-2020-36553 | Medium | 5.4 | 2022-07-15 | Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Area(food_type) field to /dashboard/menu-list… |
CVE-2020-36552 | Medium | 5.4 | 2022-07-15 | Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Made field to /dashboard/menu-list.php. |
CVE-2020-36551 | Medium | 5.4 | 2022-07-15 | Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Item Name field to /dashboard/menu-list.php. |
CVE-2020-36550 | Medium | 5.4 | 2022-07-15 | Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Table Name field to /dashboard/table-list.php. |
CVE-2020-35261 | Medium | 5.4 | 2022-07-15 | Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Restaurant Name field to /dashboard/profile.ph… |
CVE-2020-14127 | High | 7.5 | 2022-07-14 | A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by heap overflow and can be exploited by attackers to mak… |
CVE-2020-21967 | Medium | 4.8 | 2022-07-13 | File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file page. |
CVE-2020-4159 | High | 7.5 | 2022-07-12 | IBM QRadar Network Security 5.4.0 and 5.5.0 discloses sensitive information to unauthorized users which could be used to mount further attacks against the syst… |
CVE-2020-4157 | High | 7.5 | 2022-07-12 | IBM QRadar Network Security 5.4.0 and 5.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authent… |
CVE-2020-35169 | Critical | 9.1 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Input Validation Vulne… |
CVE-2020-35168 | Medium | 4.7 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vul… |
CVE-2020-35167 | Medium | 4.8 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vul… |
CVE-2020-35166 | Medium | 5.1 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vul… |
CVE-2020-35164 | Medium | 6.7 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vul… |
CVE-2020-35163 | Medium | 5.3 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain a Use of Insufficiently Random Value… |
CVE-2020-29508 | Medium | 5.3 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper Input Validation Vulnera… |
CVE-2020-29507 | Medium | 5.3 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.4, and Dell BSAFE Micro Edition Suite, versions before 4.4, contain an Improper Input Validation Vulnera… |
CVE-2020-29506 | Medium | 6.8 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy V… |
CVE-2020-29505 | High | 7.1 | 2022-07-11 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Management Error Vulnerabili… |
CVE-2020-4150 | Critical | 9.8 | 2022-07-11 | IBM SiteProtector Appliance 3.1.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, o… |
CVE-2020-4138 | Medium | 5.5 | 2022-07-11 | IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174049. |
CVE-2020-26877 | Medium | 6.1 | 2022-06-29 | ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attack. Specifically, it… |
CVE-2020-19897 | Medium | 6.1 | 2022-06-28 | A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter. |
CVE-2020-19896 | Critical | 9.8 | 2022-06-28 | File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php. |
CVE-2020-21161 | Medium | 6.1 | 2022-06-27 | Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0. |
CVE-2020-9754 | Medium | 5.3 | 2022-06-27 | NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode. |
CVE-2020-27509 | Medium | 5.4 | 2022-06-26 | Persistent XSS in Galaxkey Secure Mail Client in Galaxkey up to 5.6.11.5 allows an attacker to perform an account takeover by intercepting the HTTP Post reques… |
CVE-2020-21046 | High | 7.8 | 2022-06-24 | A local privilege escalation vulnerability was identified within the "luminati_net_updater_win_eagleget_com" service in EagleGet Downloader version 2.1.5.20 St… |
CVE-2020-36549 | High | 8.8 | 2022-06-17 | A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an e… |
CVE-2020-36548 | Medium | 5.9 | 2022-06-17 | A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser. The manipulation l… |
CVE-2020-36547 | Medium | 5.9 | 2022-06-17 | A vulnerability was found in GE Voluson S8. It has been rated as critical. This issue affects the Service Browser which itroduces hard-coded credentials. Attac… |
CVE-2020-28865 | High | 7.5 | 2022-06-16 | An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/save. |
CVE-2020-25459 | High | 7.5 | 2022-06-16 | An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attack… |
CVE-2020-35597 | High | 8.8 | 2022-06-16 | Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id parameter of admin_edit… |
CVE-2020-14125 | High | 7.5 | 2022-06-08 | A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be exploited by attack… |
CVE-2020-36544 | Low | 3.5 | 2022-06-08 | A vulnerability has been found in SialWeb CMS and classified as problematic. This vulnerability affects unknown code of the component Search Handler. The manip… |
CVE-2020-36543 | Medium | 6.3 | 2022-06-08 | A vulnerability, which was classified as critical, was found in SialWeb CMS. This affects an unknown part of the file /about.php. The manipulation of the argum… |
CVE-2020-36542 | High | 7.3 | 2022-06-07 | A vulnerability classified as critical has been found in Demokratian. This affects an unknown part of the file install/install3.php. The manipulation leads to… |
CVE-2020-36541 | High | 7.3 | 2022-06-07 | A vulnerability was found in Demokratian. It has been rated as critical. Affected by this issue is some unknown functionality of the file basicos_php/genera_se… |
CVE-2020-36540 | Medium | 6.3 | 2022-06-07 | A vulnerability, which was classified as critical, was found in Neetai Tech. Affected is an unknown function of the file /product.php. The manipulation leads t… |
CVE-2020-36539 | Medium | 6.3 | 2022-06-07 | A vulnerability was found in Lógico y Creativo 1.0 and classified as critical. This issue affects some unknown processing. The manipulation of the argument id… |
CVE-2020-36538 | Medium | 6.3 | 2022-06-07 | A vulnerability was found in Eatan CMS. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to… |
CVE-2020-36537 | Medium | 6.3 | 2022-06-07 | A vulnerability was found in Everywhere CMS. It has been classified as critical. Affected is an unknown function. The manipulation of the argument id leads to… |
CVE-2020-36536 | Medium | 6.3 | 2022-06-07 | A vulnerability was found in Brandbugle. It has been rated as critical. Affected by this issue is some unknown functionality of the file /main.php. The manipul… |
CVE-2020-36535 | Medium | 6.3 | 2022-06-07 | A vulnerability classified as critical has been found in MINMAX. This affects an unknown part of the file /newsDia.php. The manipulation of the argument id lea… |
CVE-2020-36534 | Medium | 4.3 | 2022-06-07 | A vulnerability was found in easyii CMS. It has been classified as problematic. Affected is an unknown function of the file /admin/sign/out. The manipulation l… |
CVE-2020-36533 | Low | 3.7 | 2022-06-07 | A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulatio… |
CVE-2020-36532 | Medium | 4.3 | 2022-06-07 | A vulnerability has been found in Klapp App and classified as problematic. This vulnerability affects unknown code of the component Authorization. The manipula… |
CVE-2020-36531 | Medium | 6.3 | 2022-06-07 | A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Pag… |
CVE-2020-36530 | Medium | 6.3 | 2022-06-07 | A vulnerability classified as critical was found in SevOne Network Management System up to 5.7.2.22. This vulnerability affects the Alert Summary. The manipula… |
CVE-2020-36529 | High | 8.8 | 2022-06-07 | A vulnerability classified as critical has been found in SevOne Network Management System up to 5.7.2.22. This affects the file traceroute.php of the Tracerout… |
CVE-2020-36528 | Medium | 5.5 | 2022-06-07 | A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control… |
CVE-2020-36527 | Low | 3.5 | 2022-06-07 | A vulnerability, which was classified as problematic, has been found in Server Status. This issue affects some unknown processing of the component HTTP Status/… |
CVE-2020-36526 | Low | 3.5 | 2022-06-07 | A vulnerability classified as problematic was found in Countdown Timer. This vulnerability affects unknown code of the component Macro Handler. The manipulatio… |
CVE-2020-36525 | Low | 3.5 | 2022-06-07 | A vulnerability classified as problematic has been found in Linking. This affects an unknown part of the component New Windows Macro. The manipulation leads to… |
CVE-2020-36524 | Low | 3.5 | 2022-06-07 | A vulnerability was found in Refined Toolkit. It has been rated as problematic. Affected by this issue is some unknown functionality of the component UI-Image/… |
CVE-2020-36523 | Low | 3.5 | 2022-06-07 | A vulnerability was found in PlantUML 6.43. It has been declared as problematic. Affected by this vulnerability is the component Database Information Macro. Th… |
CVE-2020-6220 | Medium | 4.7 | 2022-06-06 | BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting… |
CVE-2020-28246 | Critical | 9.8 | 2022-06-02 | A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL… |
CVE-2020-20971 | High | 8.8 | 2022-06-02 | Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index. |
CVE-2020-26185 | High | 7.5 | 2022-06-01 | Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain a Buffer Over-Read Vulnerability. |
CVE-2020-26184 | High | 7.5 | 2022-06-01 | Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain an Improper Certificate Validation vulnerability. |
CVE-2020-4926 | Critical | 9.1 | 2022-05-24 | A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitr… |
CVE-2020-4107 | High | 8.8 | 2022-05-19 | HCL Domino is affected by an Insufficient Access Control vulnerability. An authenticated attacker with local access to the system could exploit this vulnerabil… |
CVE-2020-16235 | Low | 3.8 | 2022-05-19 | Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access field devices and external systems to be ob… |
CVE-2020-16231 | High | 7.2 | 2022-05-19 | The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect device passwords. Affected controllers… |
CVE-2020-16209 | Critical | 9.8 | 2022-05-19 | A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messages with sufficiently large payloads to… |
CVE-2020-14496 | High | 8.3 | 2022-05-19 | Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow… |
CVE-2020-4970 | Medium | 5.9 | 2022-05-19 | IBM Security Identity Governance and Intelligence 5.2.4, 5.2.5, and 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure… |
CVE-2020-4994 | High | 7.5 | 2022-05-17 | IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial of service by sending… |
CVE-2020-4957 | Medium | 5.3 | 2022-05-17 | IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that could aid in future attacks against the sys… |
CVE-2020-22983 | High | 8.1 | 2022-05-13 | A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a serve… |
CVE-2020-22987 | Medium | 6.1 | 2022-05-12 | Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the… |
CVE-2020-22986 | Medium | 6.1 | 2022-05-12 | Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the… |
CVE-2020-22985 | Medium | 6.1 | 2022-05-12 | Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the… |