2020 CVEs (page 130)
Page 130 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15513 | Medium | 5.3 | 2020-07-07 | The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control. |
CVE-2020-15509 | Medium | 6.5 | 2020-07-07 | Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applications) can engage in… |
CVE-2020-15392 | Medium | 5.3 | 2020-07-07 | A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error message… |
CVE-2020-15367 | Critical | 9.8 | 2020-07-07 | Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-forc… |
CVE-2020-10745 | High | 7.5 | 2020-07-07 | A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote… |
CVE-2020-10730 | Medium | 6.5 | 2020-07-07 | A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Alt… |
CVE-2020-15567 | High | 7.8 | 2020-07-07 | An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification… |
CVE-2020-15566 | Medium | 6.5 | 2020-07-07 | An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port alloc… |
CVE-2020-15565 | High | 8.8 | 2020-07-07 | An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain privileges because o… |
CVE-2020-15564 | Medium | 6.5 | 2020-07-07 | An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_… |
CVE-2020-15563 | Medium | 6.5 | 2020-07-07 | An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty vi… |
CVE-2020-5600 | High | 7.5 | 2020-07-07 | TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT2… |
CVE-2020-5599 | Critical | 9.8 | 2020-07-07 | TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT2… |
CVE-2020-5598 | High | 7.5 | 2020-07-07 | TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT2… |
CVE-2020-5597 | High | 7.5 | 2020-07-07 | TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT2… |
CVE-2020-5596 | High | 7.5 | 2020-07-07 | TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT2… |
CVE-2020-5595 | Critical | 9.8 | 2020-07-07 | TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT2… |
CVE-2020-15507 | High | 7.5 | 2020-07-07 | An arbitrary file reading vulnerability in MobileIron Core versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0… |
CVE-2020-15506 | Critical | 9.8 | 2020-07-07 | An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0… |
CVE-2020-15505 | Critical | 9.8 | 2020-07-07 | A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0… |
CVE-2020-4077 | High | 7.7 | 2020-07-07 | In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can rea… |
CVE-2020-4076 | High | 7.8 | 2020-07-07 | In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can rea… |
CVE-2020-4075 | Medium | 6.8 | 2020-07-07 | In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened vi… |
CVE-2020-15096 | Medium | 6.8 | 2020-07-07 | In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in… |
CVE-2020-9395 | High | 8.0 | 2020-07-06 | An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code… |
CVE-2020-9262 | High | 7.8 | 2020-07-06 | HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a use after free vulnerability. There is a condition exists that the system would refere… |
CVE-2020-9261 | High | 7.8 | 2020-07-06 | HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a type confusion vulnerability. The system does not properly check and transform the typ… |
CVE-2020-9226 | Medium | 5.5 | 2020-07-06 | HUAWEI P30 with versions earlier than 10.1.0.135(C00E135R2P11) have an improper signature verification vulnerability. The system does not improper check signat… |
CVE-2020-1839 | Medium | 6.3 | 2020-07-06 | HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a race condition vulnerability. There is a timing window exists in which certain pointer… |
CVE-2020-1838 | Medium | 5.5 | 2020-07-06 | HUAWEI Mate 30 Pro with versions earlier than 10.1.0.150(C00E136R5P3) have is an improper authentication vulnerability. The device does not sufficiently valida… |
CVE-2020-1836 | Medium | 5.3 | 2020-07-06 | HUAWEI P30 with versions earlier than 10.1.0.160(C00E160R2P11) and HUAWEI P30 Pro with versions earlier than 10.1.0.160(C00E160R2P8) have an information disclo… |
CVE-2020-10760 | Medium | 6.5 | 2020-07-06 | A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC configuration. A Samba LDAP use… |
CVE-2020-9100 | High | 7.8 | 2020-07-06 | Earlier than HiSuite 10.1.0.500 have a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly. And it allo… |
CVE-2020-6013 | High | 8.8 | 2020-07-06 | ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute code at elevated priv… |
CVE-2020-5372 | High | 8.6 | 2020-07-06 | Dell EMC PowerStore versions prior to 1.0.1.0.5.002 contain a vulnerability that exposes test interface ports to external network. A remote unauthenticated att… |
CVE-2020-5371 | High | 8.0 | 2020-07-06 | Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale version 9.0.0 contain a file permissions vulnerability. An attacker, with network or l… |
CVE-2020-5368 | Critical | 9.8 | 2020-07-06 | Dell EMC VxRail versions 4.7.410 and 4.7.411 contain an improper authentication vulnerability. A remote unauthenticated attacker may exploit this vulnerability… |
CVE-2020-5356 | High | 7.7 | 2020-07-06 | Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability… |
CVE-2020-5352 | High | 8.8 | 2020-07-06 | Dell EMC Data Protection Advisor 6.4, 6.5 and 18.1 contain an OS command injection vulnerability. A remote authenticated malicious user may exploit this vulner… |
CVE-2020-1837 | Medium | 5.3 | 2020-07-06 | ChangXiang 8 Plus with versions earlier than 9.1.0.136(C00E121R1P6T8) have a denial of service vulnerability. The device does not properly handle certain messa… |
CVE-2020-14303 | High | 7.5 | 2020-07-06 | A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to… |
CVE-2020-15570 | Medium | 5.5 | 2020-07-06 | The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows an attacker to cause a denial of servi… |
CVE-2020-15569 | Medium | 5.5 | 2020-07-06 | PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor. |
CVE-2020-7691 | Medium | 6.3 | 2020-07-06 | In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex. |
CVE-2020-7690 | Medium | 6.1 | 2020-07-06 | All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method. |
CVE-2020-15562 | Medium | 6.1 | 2020-07-06 | An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as de… |
CVE-2020-15543 | Critical | 9.8 | 2020-07-05 | SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path. |
CVE-2020-15542 | Critical | 9.8 | 2020-07-05 | SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command. |
CVE-2020-15541 | Critical | 9.8 | 2020-07-05 | SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution. |
CVE-2020-15540 | Critical | 9.8 | 2020-07-05 | We-com OpenData CMS 2.0 allows SQL Injection via the username field on the administrator login page. |
CVE-2020-15539 | Critical | 9.8 | 2020-07-05 | SQL injection can occur in We-com Municipality portal CMS 2.1.x via the cerca/ keywords field. |
CVE-2020-15538 | Medium | 6.1 | 2020-07-05 | XSS can occur in We-com Municipality portal CMS 2.1.x via the cerca/ search bar. |
CVE-2020-15537 | Medium | 6.1 | 2020-07-05 | An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products S… |
CVE-2020-15536 | Medium | 6.1 | 2020-07-05 | An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fiel… |
CVE-2020-15535 | Medium | 6.1 | 2020-07-05 | An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields. |
CVE-2020-15466 | High | 7.5 | 2020-07-05 | In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gvcp.c by ensuring that an offset… |
CVE-2020-15530 | High | 7.8 | 2020-07-05 | An issue was discovered in Valve Steam Client 2.10.91.91. The installer allows local users to gain NT AUTHORITY\SYSTEM privileges because some parts of %PROGRA… |
CVE-2020-15529 | High | 7.8 | 2020-07-05 | An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user installs a game or performs a verify/repair operati… |
CVE-2020-15528 | High | 7.8 | 2020-07-05 | An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user starts or uninstalls a game because of weak file pe… |
CVE-2020-15523 | High | 7.8 | 2020-07-04 | In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases wh… |
CVE-2020-7284 | High | 8.6 | 2020-07-03 | Exposure of Sensitive Information in McAfee Network Security Management (NSM) prior to 10.1.7.7 allows local users to gain unauthorised access to the root acco… |
CVE-2020-10282 | Critical | 9.8 | 2020-07-03 | The Micro Air Vehicle Link (MAVLink) protocol presents no authentication mechanism on its version 1.0 (nor authorization) whichs leads to a variety of attacks… |
CVE-2020-10281 | High | 7.5 | 2020-07-03 | This vulnerability applies to the Micro Air Vehicle Link (MAVLink) protocol and allows a remote attacker to gain access to sensitive information provided it ha… |
CVE-2020-7283 | High | 7.5 | 2020-07-03 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to create and edit files via symbolic link manipulation… |
CVE-2020-7282 | High | 7.5 | 2020-07-03 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to delete files the user would otherwise not have access… |
CVE-2020-7281 | High | 7.5 | 2020-07-03 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to delete files the user would otherwise not have acce… |
CVE-2020-15518 | High | 8.8 | 2020-07-03 | VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achie… |
CVE-2020-14173 | Medium | 5.4 | 2020-07-03 | The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cros… |
CVE-2020-14172 | Critical | 9.8 | 2020-07-03 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in w… |
CVE-2020-15469 | Low | 2.3 | 2020-07-02 | In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. |
CVE-2020-8188 | High | 8.8 | 2020-07-02 | We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine Pro/UNVR respectivel… |
CVE-2020-8185 | Medium | 6.5 | 2020-07-02 | A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production. |
CVE-2020-8179 | Medium | 4.1 | 2020-07-02 | Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks. |
CVE-2020-8176 | Medium | 6.1 | 2020-07-02 | A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the… |
CVE-2020-8166 | Medium | 4.3 | 2020-07-02 | A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one presen… |
CVE-2020-8163 | High | 8.8 | 2020-07-02 | The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call t… |
CVE-2020-8161 | High | 8.6 | 2020-07-02 | A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is… |
CVE-2020-4074 | High | 8.9 | 2020-07-02 | In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute adm… |
CVE-2020-4061 | Low | 3.7 | 2020-07-02 | In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a success… |
CVE-2020-15091 | Medium | 6.5 | 2020-07-02 | TenderMint from version 0.33.0 and before version 0.33.6 allows block proposers to include signatures for the wrong block. This may happen naturally if you sta… |
CVE-2020-15083 | Medium | 4.7 | 2020-07-02 | In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS. The problem is fixed in 1.7.6.6 |
CVE-2020-15082 | High | 7.1 | 2020-07-02 | In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables. The problem is fixed in 1.7.6.6 |
CVE-2020-15081 | Medium | 5.3 | 2020-07-02 | In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possib… |
CVE-2020-15080 | Medium | 5.3 | 2020-07-02 | In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and others should not be accessible. The proble… |
CVE-2020-15079 | Medium | 6.4 | 2020-07-02 | In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module Manager and Module Positions. The probl… |
CVE-2020-11074 | Medium | 5.4 | 2020-07-02 | In PrestaShop from version 1.5.3.0 and before version 1.7.6.6, there is a stored XSS when using the name of a quick access item. The problem is fixed in 1.7.6… |
CVE-2020-14092 | Critical | 9.8 | 2020-07-02 | The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection. |
CVE-2020-13653 | Medium | 6.1 | 2020-07-02 | An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScrip… |
CVE-2020-2219 | Medium | 5.4 | 2020-07-02 | Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stored cross-site scri… |
CVE-2020-2218 | Low | 3.3 | 2020-07-02 | Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewe… |
CVE-2020-2217 | Medium | 6.1 | 2020-07-02 | Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint… |
CVE-2020-2216 | Medium | 4.3 | 2020-07-02 | A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an att… |
CVE-2020-2215 | Medium | 4.3 | 2020-07-02 | A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to an attacker-specifi… |
CVE-2020-2214 | Medium | 5.4 | 2020-07-02 | Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived art… |
CVE-2020-2213 | Medium | 4.3 | 2020-07-02 | Jenkins White Source Plugin 19.1.1 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins maste… |
CVE-2020-2212 | Medium | 4.3 | 2020-07-02 | Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master where they can be vie… |
CVE-2020-2211 | High | 8.8 | 2020-07-02 | Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resultin… |
CVE-2020-2210 | Medium | 4.3 | 2020-07-02 | Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentia… |
CVE-2020-2209 | Medium | 4.3 | 2020-07-02 | Jenkins TestComplete support Plugin 2.4.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by use… |
CVE-2020-2208 | Medium | 4.3 | 2020-07-02 | Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Exte… |