2020 CVEs (page 131)
Page 131 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2207 | Medium | 6.1 | 2020-07-02 | Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site sc… |
CVE-2020-2206 | Medium | 6.1 | 2020-07-02 | Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site… |
CVE-2020-2205 | Medium | 4.8 | 2020-07-02 | Jenkins VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint, resulting in a stored cross-site script… |
CVE-2020-2204 | Medium | 5.4 | 2020-07-02 | A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to the globally confi… |
CVE-2020-2203 | Medium | 4.3 | 2020-07-02 | A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify… |
CVE-2020-2202 | Medium | 4.3 | 2020-07-02 | A missing permission check in Jenkins Fortify on Demand Plugin 6.0.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate cr… |
CVE-2020-2201 | Medium | 5.4 | 2020-07-02 | Jenkins Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation, resulting in a stored cross-site… |
CVE-2020-12119 | High | 8.1 | 2020-07-02 | Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). It increases the user's balance with the value of an unconfirmed transaction as soon a… |
CVE-2020-15503 | High | 7.5 | 2020-07-02 | LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For… |
CVE-2020-9498 | Medium | 6.7 | 2020-07-02 | Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious o… |
CVE-2020-9497 | Medium | 4.4 | 2020-07-02 | Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If a userconnects to a malicious or compro… |
CVE-2020-7821 | High | 7.8 | 2020-07-02 | Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by modifying the… |
CVE-2020-7820 | High | 7.8 | 2020-07-02 | Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by setting the a… |
CVE-2020-5911 | High | 7.3 | 2020-07-02 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu sy… |
CVE-2020-5910 | High | 7.5 | 2020-07-02 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require… |
CVE-2020-5909 | Medium | 5.4 | 2020-07-02 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the… |
CVE-2020-3282 | Medium | 6.1 | 2020-07-02 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition… |
CVE-2020-15502 | High | 7.5 | 2020-07-02 | The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers… |
CVE-2020-3402 | High | 7.5 | 2020-07-02 | A vulnerability in the Java Remote Method Invocation (RMI) interface of Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attack… |
CVE-2020-3391 | Medium | 6.5 | 2020-07-02 | A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to view sensitive information in clear text. T… |
CVE-2020-3340 | Medium | 4.8 | 2020-07-02 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with admin… |
CVE-2020-3297 | Critical | 9.8 | 2020-07-02 | A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote att… |
CVE-2020-5238 | Medium | 6.5 | 2020-07-01 | The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown tab… |
CVE-2020-15500 | Medium | 6.1 | 2020-07-01 | An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the… |
CVE-2020-15490 | Critical | 9.8 | 2020-07-01 | An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple buffer overflow vulnerabilities exist in CGI scripts, leading to remote co… |
CVE-2020-15489 | Critical | 9.8 | 2020-07-01 | An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple shell metacharacter injection vulnerabilities exist in CGI scripts, leadin… |
CVE-2020-14196 | Medium | 5.3 | 2020-07-01 | In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced. |
CVE-2020-7688 | High | 8.4 | 2020-07-01 | The issue occurs because tagName user input is formatted inside the exec function is executed without any checks. |
CVE-2020-14057 | Critical | 9.8 | 2020-07-01 | Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary local files, allow… |
CVE-2020-14056 | Critical | 9.8 | 2020-07-01 | Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch functionality. This allows… |
CVE-2020-14055 | Medium | 6.1 | 2020-07-01 | Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encoding. |
CVE-2020-13619 | Critical | 9.8 | 2020-07-01 | php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution. |
CVE-2020-6089 | High | 7.8 | 2020-07-01 | An exploitable code execution vulnerability exists in the ANI file format parser of Leadtools 20. A specially crafted ANI file can cause a buffer overflow resu… |
CVE-2020-2500 | Critical | 9.8 | 2020-07-01 | This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP… |
CVE-2020-12498 | High | 7.8 | 2020-07-01 | mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated… |
CVE-2020-12497 | High | 7.8 | 2020-07-01 | PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projec… |
CVE-2020-8663 | High | 7.5 | 2020-07-01 | Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections. |
CVE-2020-5908 | Medium | 5.5 | 2020-07-01 | In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files. |
CVE-2020-5907 | High | 7.2 | 2020-07-01 | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the… |
CVE-2020-5906 | High | 8.1 | 2020-07-01 | In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files… |
CVE-2020-5905 | Medium | 4.3 | 2020-07-01 | In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display. |
CVE-2020-5904 | High | 8.8 | 2020-07-01 | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Managem… |
CVE-2020-5903 | Medium | 6.1 | 2020-07-01 | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page… |
CVE-2020-5902 | Critical | 9.8 | 2020-07-01 | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also… |
CVE-2020-5901 | Critical | 9.6 | 2020-07-01 | In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admi… |
CVE-2020-5899 | High | 7.8 | 2020-07-01 | In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an at… |
CVE-2020-4420 | High | 7.5 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker to cause a denial of… |
CVE-2020-4414 | Medium | 4.4 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local attacker to perform unauthorized actions… |
CVE-2020-4387 | Medium | 4.7 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information usin… |
CVE-2020-4386 | Medium | 4.7 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information usin… |
CVE-2020-4376 | Medium | 6.5 | 2020-07-01 | IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow an attacker to cause a denial of service caused by an error within the pubsub logi… |
CVE-2020-4363 | High | 7.8 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds… |
CVE-2020-4355 | Medium | 5.3 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service, caused by improper hand… |
CVE-2020-13383 | High | 7.5 | 2020-07-01 | openSIS through 7.4 allows Directory Traversal. |
CVE-2020-13382 | Critical | 9.1 | 2020-07-01 | openSIS through 7.4 has Incorrect Access Control. |
CVE-2020-13381 | Critical | 9.8 | 2020-07-01 | openSIS through 7.4 allows SQL Injection. |
CVE-2020-13380 | Critical | 9.8 | 2020-07-01 | openSIS before 7.4 allows SQL Injection. |
CVE-2020-12605 | High | 7.5 | 2020-07-01 | Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with… |
CVE-2020-12604 | High | 7.5 | 2020-07-01 | Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does n… |
CVE-2020-7689 | Medium | 5.9 | 2020-07-01 | Data is truncated wrong when its length is greater than 255 bytes. |
CVE-2020-5900 | High | 8.8 | 2020-07-01 | In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface. |
CVE-2020-12603 | High | 7.5 | 2020-07-01 | Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte… |
CVE-2020-6261 | Medium | 5.3 | 2020-07-01 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The r… |
CVE-2020-15478 | High | 7.5 | 2020-07-01 | The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors. |
CVE-2020-15476 | High | 7.5 | 2020-07-01 | In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c. |
CVE-2020-15475 | Critical | 9.8 | 2020-07-01 | In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free. |
CVE-2020-15474 | Critical | 9.8 | 2020-07-01 | In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c. |
CVE-2020-15473 | Critical | 9.1 | 2020-07-01 | In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c. |
CVE-2020-15472 | Critical | 9.1 | 2020-07-01 | In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a paylo… |
CVE-2020-15471 | Critical | 9.1 | 2020-07-01 | In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c. |
CVE-2020-15470 | Medium | 5.5 | 2020-07-01 | ffjpeg through 2020-02-24 has a heap-based buffer overflow in jfif_decode in jfif.c. |
CVE-2020-15468 | Critical | 9.8 | 2020-07-01 | Persian VIP Download Script 1.0 allows SQL Injection via the cart_edit.php active parameter. |
CVE-2020-4029 | Medium | 4.3 | 2020-07-01 | The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 be… |
CVE-2020-4027 | Medium | 4.7 | 2020-07-01 | Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template in… |
CVE-2020-4025 | Medium | 4.8 | 2020-07-01 | The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5… |
CVE-2020-4024 | Medium | 5.4 | 2020-07-01 | The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote… |
CVE-2020-4022 | Medium | 6.1 | 2020-07-01 | The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote… |
CVE-2020-14169 | Medium | 6.1 | 2020-07-01 | The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Sit… |
CVE-2020-14168 | Medium | 5.9 | 2020-07-01 | The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows re… |
CVE-2020-14167 | High | 7.5 | 2020-07-01 | The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 befor… |
CVE-2020-14166 | Medium | 4.8 | 2020-07-01 | The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator… |
CVE-2020-14165 | Medium | 5.3 | 2020-07-01 | The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom… |
CVE-2020-14164 | Medium | 6.1 | 2020-07-01 | The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cro… |
CVE-2020-5973 | Medium | 4.4 | 2020-06-30 | NVIDIA Virtual GPU Manager and the guest drivers contain a vulnerability in vGPU plugin, in which there is the potential to execute privileged operations, whic… |
CVE-2020-5972 | High | 7.1 | 2020-06-30 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which local pointer variables are not initialized and may be freed later, which may… |
CVE-2020-5971 | High | 7.8 | 2020-06-30 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software reads from a buffer by using buffer access mechanisms such as ind… |
CVE-2020-5970 | High | 7.1 | 2020-06-30 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampering or denial of… |
CVE-2020-5969 | Medium | 6.3 | 2020-06-30 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which it validates a shared resource before using it, creating a race condition whic… |
CVE-2020-5968 | High | 7.8 | 2020-06-30 | NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software does not restrict or incorrectly restricts operations within the… |
CVE-2020-14947 | High | 8.8 | 2020-06-30 | OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/… |
CVE-2020-9414 | High | 8.8 | 2020-06-30 | The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a… |
CVE-2020-9413 | Medium | 6.3 | 2020-06-30 | The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Mana… |
CVE-2020-7049 | High | 7.3 | 2020-06-30 | Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection. |
CVE-2020-14474 | High | 7.5 | 2020-06-30 | The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, a… |
CVE-2020-14059 | Medium | 6.5 | 2020-06-30 | An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of Service can occur when processing objects in an SMP cache b… |
CVE-2020-14058 | High | 7.5 | 2020-06-30 | An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation… |
CVE-2020-15307 | Medium | 6.1 | 2020-06-30 | Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom field with a crafted f… |
CVE-2020-15049 | Critical | 9.9 | 2020-06-30 | An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed aga… |
CVE-2020-14482 | High | 7.8 | 2020-06-30 | Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Opening a specially crafted project file may overflow the heap, which may allow remote code… |
CVE-2020-15087 | High | 7.4 | 2020-06-30 | In Presto before version 337, authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations… |