2020 CVEs (page 134)
Page 134 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-9606 | High | 7.8 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an us… |
CVE-2020-9605 | High | 7.8 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have a buf… |
CVE-2020-9604 | High | 7.8 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have a buf… |
CVE-2020-9603 | Medium | 5.5 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an ou… |
CVE-2020-9602 | Medium | 5.5 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an ou… |
CVE-2020-9601 | High | 7.5 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an ou… |
CVE-2020-9600 | High | 7.5 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an ou… |
CVE-2020-9599 | High | 7.5 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an ou… |
CVE-2020-9598 | Medium | 5.5 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an in… |
CVE-2020-9597 | High | 8.8 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an ou… |
CVE-2020-9596 | High | 7.8 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have a sec… |
CVE-2020-9595 | Medium | 5.5 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an in… |
CVE-2020-9594 | High | 7.8 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an ou… |
CVE-2020-9593 | Medium | 5.5 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have an in… |
CVE-2020-9592 | High | 7.8 | 2020-06-25 | Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have a sec… |
CVE-2020-9575 | High | 7.8 | 2020-06-25 | Adobe Illustrator versions 24.1.2 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution . |
CVE-2020-5967 | Medium | 4.7 | 2020-06-25 | NVIDIA Linux GPU Display Driver, all versions, contains a vulnerability in the UVM driver, in which a race condition may lead to a denial of service. |
CVE-2020-5966 | High | 7.8 | 2020-06-25 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, in which a NULL po… |
CVE-2020-9666 | Medium | 5.5 | 2020-06-25 | Adobe Campaign Classic before 20.2 have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2020-9437 | Medium | 4.8 | 2020-06-25 | SecureAuth.aspx in SecureAuth IdP 9.3.0 suffers from a client-side template injection that allows for script execution, in the same manner as XSS. |
CVE-2020-4072 | Medium | 5.3 | 2020-06-25 | In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is publi… |
CVE-2020-15302 | High | 7.5 | 2020-06-25 | In Argent RecoveryManager before 0xdc350d09f71c48c5D22fBE2741e4d6A03970E192, the executeRecovery function does not require any signatures in the zero-guardian… |
CVE-2020-11538 | High | 8.1 | 2020-06-25 | In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-… |
CVE-2020-10994 | Medium | 5.5 | 2020-06-25 | In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file. |
CVE-2020-10379 | High | 7.8 | 2020-06-25 | In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. |
CVE-2020-10378 | Medium | 5.5 | 2020-06-25 | In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond stat… |
CVE-2020-10177 | Medium | 5.5 | 2020-06-25 | Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. |
CVE-2020-7355 | Medium | 6.1 | 2020-06-25 | Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted n… |
CVE-2020-7354 | Medium | 6.1 | 2020-06-25 | Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted ne… |
CVE-2020-3971 | Medium | 5.5 | 2020-06-25 | VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201907101-SG), Workstation (15.x before 15.0.2), and Fusion (11.x before 11.0.2) contain a… |
CVE-2020-3970 | Low | 3.8 | 2020-06-25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and F… |
CVE-2020-3968 | High | 8.2 | 2020-06-25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and F… |
CVE-2020-3967 | High | 7.5 | 2020-06-25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and F… |
CVE-2020-3966 | High | 7.5 | 2020-06-25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and F… |
CVE-2020-3965 | Medium | 5.5 | 2020-06-25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and F… |
CVE-2020-3964 | Medium | 4.7 | 2020-06-25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and F… |
CVE-2020-3963 | Medium | 5.5 | 2020-06-25 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.2), and F… |
CVE-2020-11735 | Medium | 5.3 | 2020-06-25 | The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective co… |
CVE-2020-15047 | Medium | 5.9 | 2020-06-25 | MSA/SMTP.cpp in Trojita before 0.8 ignores certificate-verification errors, which allows man-in-the-middle attackers to spoof SMTP servers. |
CVE-2020-5965 | Medium | 5.5 | 2020-06-25 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the DirectX 11 user mode driver (nvwgf2um/x.dll), in which a specially crafted sha… |
CVE-2020-5964 | High | 7.8 | 2020-06-25 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the service host component, in which the application resources integrity check may… |
CVE-2020-5963 | High | 7.8 | 2020-06-25 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the Inter Process Communication APIs, in which improper access control may lead to… |
CVE-2020-15046 | High | 8.8 | 2020-06-24 | The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF iss… |
CVE-2020-15005 | Low | 3.1 | 2020-06-24 | In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image autho… |
CVE-2020-15041 | Medium | 4.8 | 2020-06-24 | PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link field. |
CVE-2020-5962 | High | 7.8 | 2020-06-24 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component, in which an attacker with local system access… |
CVE-2020-15038 | Medium | 5.4 | 2020-06-24 | The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS. |
CVE-2020-13247 | High | 7.3 | 2020-06-24 | BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the… |
CVE-2020-15026 | Medium | 4.9 | 2020-06-24 | Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php. |
CVE-2020-15025 | Medium | 4.4 | 2020-06-24 | ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, becaus… |
CVE-2020-13248 | Medium | 5.4 | 2020-06-24 | BooleBox Secure File Sharing Utility before 4.2.3.0 allows stored XSS via a crafted avatar field within My Account JSON data to Account.aspx. |
CVE-2020-3962 | High | 8.2 | 2020-06-24 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and F… |
CVE-2020-14473 | Critical | 9.8 | 2020-06-24 | Stack-based buffer overflow vulnerability in Vigor3900, Vigor2960, and Vigor300B with firmware before 1.5.1.1. |
CVE-2020-14472 | Critical | 9.8 | 2020-06-24 | On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file. |
CVE-2020-11961 | High | 7.5 | 2020-06-24 | Xiaomi router R3600 ROM before 1.0.50 is affected by a sensitive information leakage caused by an insecure interface get_config_result without authentication |
CVE-2020-11960 | Critical | 9.8 | 2020-06-24 | Xiaomi router R3600 ROM before 1.0.50 is affected by a vulnerability when checking backup file in c_upload interface let attacker able to extract malicious fil… |
CVE-2020-11959 | High | 7.5 | 2020-06-24 | An unsafe configuration of nginx lead to information leak in Xiaomi router R3600 ROM before 1.0.50. |
CVE-2020-10561 | Critical | 9.8 | 2020-06-24 | An issue was discovered on Xiaomi Mi Jia ink-jet printer < 3.4.6_0138. Injecting parameters to ippserver through the web management background, resulting in co… |
CVE-2020-9494 | High | 7.5 | 2020-06-24 | Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to… |
CVE-2020-6870 | High | 8.0 | 2020-06-24 | The version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability. An attacker could exploit the vulnerability to log in to the FTP s… |
CVE-2020-3969 | High | 7.8 | 2020-06-24 | VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and F… |
CVE-2020-14095 | Critical | 9.8 | 2020-06-24 | In Xiaomi router R3600, ROM version<1.0.20, a connect service suffers from an injection vulnerability through the web interface, leading to a stack overflow or… |
CVE-2020-14094 | Critical | 9.8 | 2020-06-24 | In Xiaomi router R3600, ROM version<1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execut… |
CVE-2020-15015 | Medium | 6.1 | 2020-06-24 | The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document. |
CVE-2020-14018 | Medium | 6.1 | 2020-06-24 | An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users, and on the page to edit user… |
CVE-2020-14017 | High | 7.5 | 2020-06-24 | An issue was discovered in Navigate CMS 2.9 r1433. Sessions, as well as associated information such as CSRF tokens, are stored in cleartext files in the direct… |
CVE-2020-14016 | Medium | 5.3 | 2020-06-24 | An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the emai… |
CVE-2020-14015 | High | 7.5 | 2020-06-24 | An issue was discovered in Navigate CMS 2.9 r1433. When performing a password reset, a user is emailed an activation code that allows them to reset their passw… |
CVE-2020-14014 | Medium | 5.4 | 2020-06-24 | An issue was discovered in Navigate CMS 2.8 and 2.9 r1433. The query parameter fid on the resource navigate.php does not perform sufficient data validation and… |
CVE-2020-13700 | High | 7.5 | 2020-06-24 | An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, a… |
CVE-2020-13484 | Critical | 9.8 | 2020-06-24 | Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview url parameter, if the destination URL ho… |
CVE-2020-13483 | Medium | 6.1 | 2020-06-24 | The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI. |
CVE-2020-13443 | High | 8.8 | 2020-06-24 | ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft… |
CVE-2020-4413 | Medium | 5.9 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport S… |
CVE-2020-4342 | Medium | 5.3 | 2020-06-24 | IBM Security Secret Server 10.7 could disclose sensitive information included in installation files to an unauthorized user. IBM X-Force ID: 178182. |
CVE-2020-4341 | Medium | 5.3 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2020-4327 | Medium | 5.3 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2020-4323 | Medium | 6.1 | 2020-06-24 | IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2020-4322 | Medium | 4.3 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site… |
CVE-2020-14007 | Medium | 5.4 | 2020-06-24 | Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition. |
CVE-2020-14006 | Medium | 5.4 | 2020-06-24 | Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team. |
CVE-2020-14005 | High | 8.8 | 2020-06-24 | Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote attackers to execute arbitrary code via a defined even… |
CVE-2020-4071 | Low | 2.2 | 2020-06-24 | In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASIC_A… |
CVE-2020-15018 | Medium | 6.5 | 2020-06-24 | playSMS through 1.4.3 is vulnerable to session fixation. |
CVE-2020-15014 | High | 8.8 | 2020-06-24 | pramodmahato BlogCMS through 2019-12-31 has admin/changepass.php CSRF. |
CVE-2020-12866 | Medium | 5.7 | 2020-06-24 | A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of serv… |
CVE-2020-12865 | High | 8.0 | 2020-06-24 | A heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to execute arbitrary code… |
CVE-2020-12864 | Medium | 4.3 | 2020-06-24 | An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important informati… |
CVE-2020-12863 | Medium | 4.3 | 2020-06-24 | An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important informati… |
CVE-2020-12862 | Medium | 4.3 | 2020-06-24 | An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important informati… |
CVE-2020-12861 | High | 8.8 | 2020-06-24 | A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to execute arbitrary code, ak… |
CVE-2020-7667 | High | 7.5 | 2020-06-24 | In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for… |
CVE-2020-15011 | Medium | 4.3 | 2020-06-24 | GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. |
CVE-2020-15007 | Critical | 9.8 | 2020-06-24 | A buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe usage of fscanf, beca… |
CVE-2020-15006 | Medium | 5.4 | 2020-06-24 | Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php. |
CVE-2020-10280 | High | 7.5 | 2020-06-24 | The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the das… |
CVE-2020-10279 | Critical | 9.8 | 2020-06-24 | MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents inse… |
CVE-2020-10278 | Medium | 4.6 | 2020-06-24 | The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings such as boot order. This can be leveraged… |
CVE-2020-10277 | Medium | 6.4 | 2020-06-24 | There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file)… |
CVE-2020-10276 | Critical | 9.8 | 2020-06-24 | The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, ef… |