2020 CVEs (page 137)
Page 137 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3364 | Medium | 5.3 | 2020-06-18 | A vulnerability in the access control list (ACL) functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unau… |
CVE-2020-3362 | Medium | 4.7 | 2020-06-18 | A vulnerability in the CLI of Cisco Network Services Orchestrator (NSO) could allow an authenticated, local attacker to access confidential information on an a… |
CVE-2020-3361 | High | 8.1 | 2020-06-18 | A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to gain unauthorized access to a vulner… |
CVE-2020-3360 | Medium | 5.3 | 2020-06-18 | A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive info… |
CVE-2020-3356 | Medium | 6.1 | 2020-06-18 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a… |
CVE-2020-3355 | Medium | 4.8 | 2020-06-18 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administra… |
CVE-2020-3354 | Medium | 4.8 | 2020-06-18 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administra… |
CVE-2020-3350 | Medium | 5.5 | 2020-06-18 | A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running softwa… |
CVE-2020-3347 | Medium | 5.5 | 2020-06-18 | A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affe… |
CVE-2020-3342 | High | 8.8 | 2020-06-18 | A vulnerability in the software update feature of Cisco Webex Meetings Desktop App for Mac could allow an unauthenticated, remote attacker to execute arbitrary… |
CVE-2020-3337 | Medium | 6.1 | 2020-06-18 | A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerabil… |
CVE-2020-3336 | High | 7.2 | 2020-06-18 | A vulnerability in the software upgrade process of Cisco TelePresence Collaboration Endpoint Software and Cisco RoomOS Software could allow an authenticated, r… |
CVE-2020-3296 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3295 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3294 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3293 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3292 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3291 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3290 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3289 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3288 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3287 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3286 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3279 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3278 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3277 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3276 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3275 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3274 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, an… |
CVE-2020-3269 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco RV110W, RV130, RV130W, and RV215W Series Routers could allow an authenticated, remote a… |
CVE-2020-3268 | High | 7.2 | 2020-06-18 | Multiple vulnerabilities in the web-based management interface of Cisco RV110W, RV130, RV130W, and RV215W Series Routers could allow an authenticated, remote a… |
CVE-2020-3263 | High | 7.5 | 2020-06-18 | A vulnerability in Cisco Webex Meetings Desktop App could allow an unauthenticated, remote attacker to execute programs on an affected end-user system. The vul… |
CVE-2020-3245 | Medium | 5.3 | 2020-06-18 | A vulnerability in the web application of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to create arbitrar… |
CVE-2020-3244 | Medium | 5.3 | 2020-06-18 | A vulnerability in the Enhanced Charging Service (ECS) functionality of Cisco ASR 5000 Series Aggregation Services Routers could allow an unauthenticated, remo… |
CVE-2020-3242 | Medium | 4.9 | 2020-06-18 | A vulnerability in the REST API of Cisco UCS Director could allow an authenticated, remote attacker with administrative privileges to obtain confidential infor… |
CVE-2020-3241 | Medium | 6.5 | 2020-06-18 | A vulnerability in the orchestration tasks of Cisco UCS Director could allow an authenticated, remote attacker to perform a path traversal attack on an affecte… |
CVE-2020-3236 | Medium | 6.7 | 2020-06-18 | A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to gain root shell access to th… |
CVE-2020-8619 | Medium | 4.9 | 2020-06-17 | In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a… |
CVE-2020-8618 | Medium | 4.9 | 2020-06-17 | An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially c… |
CVE-2020-14408 | Medium | 6.1 | 2020-06-17 | An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary Ja… |
CVE-2020-14157 | High | 8.1 | 2020-06-17 | The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used proximity chip keys (R… |
CVE-2020-14040 | High | 7.5 | 2020-06-17 | The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the pro… |
CVE-2020-6869 | High | 8.1 | 2020-06-17 | All versions up to 10.06 of ZTEMarket APK are impacted by an information leak vulnerability. Due to Activity Component exposure users can exploit this vulnerab… |
CVE-2020-4532 | Medium | 5.3 | 2020-06-17 | IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote atta… |
CVE-2020-9332 | High | 7.8 | 2020-06-17 | ftusbbus2.sys in FabulaTech USB for Remote Desktop through 2020-02-19 allows privilege escalation via crafted IoCtl code related to a USB HID device. |
CVE-2020-7932 | Medium | 5.7 | 2020-06-17 | OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into… |
CVE-2020-6752 | Low | 3.8 | 2020-06-17 | In OMERO before 5.6.1, group owners can access members' data in other groups. |
CVE-2020-13637 | High | 7.5 | 2020-06-17 | An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the client_key, the device_… |
CVE-2020-14405 | Medium | 6.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size. |
CVE-2020-14404 | Medium | 5.4 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rre.c allows out-of-bounds access via encodings. |
CVE-2020-14403 | Medium | 5.4 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/hextile.c allows out-of-bounds access via encodings. |
CVE-2020-14402 | Medium | 5.4 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings. |
CVE-2020-14401 | Medium | 6.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow. |
CVE-2020-14400 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties… |
CVE-2020-14399 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is repor… |
CVE-2020-14398 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c. |
CVE-2020-14397 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference. |
CVE-2020-14396 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tls_openssl.c has a NULL pointer dereference. |
CVE-2020-14295 | High | 7.2 | 2020-06-17 | A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because th… |
CVE-2020-12827 | High | 7.2 | 2020-06-17 | MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document. |
CVE-2020-13224 | High | 8.8 | 2020-06-17 | TP-LINK NC200 devices through 2.1.10 build 200401, NC210 devices through 1.0.10 build 200401, NC220 devices through 1.3.1 build 200401, NC230 devices through 1… |
CVE-2020-11914 | Medium | 4.3 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read. |
CVE-2020-11913 | Medium | 5.3 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read. |
CVE-2020-11912 | Medium | 5.3 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read. |
CVE-2020-11911 | Medium | 5.3 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control. |
CVE-2020-11910 | Medium | 5.3 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read. |
CVE-2020-11909 | Medium | 5.3 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow. |
CVE-2020-11908 | Medium | 4.3 | 2020-06-17 | The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP. |
CVE-2020-11907 | Medium | 6.3 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP. |
CVE-2020-11906 | Medium | 6.3 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow. |
CVE-2020-11905 | Medium | 6.5 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read. |
CVE-2020-11904 | High | 7.3 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write. |
CVE-2020-11903 | Medium | 6.5 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read. |
CVE-2020-11902 | High | 7.3 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read. |
CVE-2020-11901 | Critical | 9.0 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response. |
CVE-2020-11900 | High | 8.2 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free. |
CVE-2020-11899 | Medium | 5.4 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read. |
CVE-2020-11898 | Critical | 9.1 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an infor… |
CVE-2020-11897 | Critical | 10.0 | 2020-06-17 | The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets. |
CVE-2020-11896 | Critical | 10.0 | 2020-06-17 | The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling. |
CVE-2020-14214 | Medium | 6.5 | 2020-06-16 | Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new ac… |
CVE-2020-14213 | Medium | 5.4 | 2020-06-16 | In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge). |
CVE-2020-4054 | High | 7.3 | 2020-06-16 | In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using… |
CVE-2020-4053 | Low | 3.7 | 2020-06-16 | In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It i… |
CVE-2020-4052 | Medium | 6.3 | 2020-06-16 | In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism… |
CVE-2020-14212 | High | 8.8 | 2020-06-16 | FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a… |
CVE-2020-14210 | Medium | 6.1 | 2020-06-16 | Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL information. It provides a… |
CVE-2020-9289 | High | 7.5 | 2020-06-16 | Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an… |
CVE-2020-7513 | High | 7.5 | 2020-06-16 | A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to… |
CVE-2020-7512 | Critical | 9.8 | 2020-06-16 | A CWE-1103: Use of Platform-Dependent Third Party Components with vulnerabilities vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which… |
CVE-2020-7511 | High | 7.5 | 2020-06-16 | A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attack… |
CVE-2020-7510 | High | 7.5 | 2020-06-16 | A CWE-200: Information Exposure vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow attacker to obtain private keys. |
CVE-2020-7509 | High | 7.2 | 2020-06-16 | A CWE-269: Improper privilege management (write) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to eleva… |
CVE-2020-7508 | Critical | 9.8 | 2020-06-16 | A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow a… |
CVE-2020-7507 | High | 7.5 | 2020-06-16 | A CWE-400: Uncontrolled Resource Consumption vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to login mul… |
CVE-2020-7506 | High | 7.5 | 2020-06-16 | A CWE-200: Information Exposure vulnerability exists in Easergy T300, Firmware V1.5.2 and prior, which could allow an attacker to pack or unpack the archive wi… |
CVE-2020-7505 | High | 7.2 | 2020-06-16 | A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to inj… |
CVE-2020-7504 | Medium | 5.3 | 2020-06-16 | A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to disable the webser… |
CVE-2020-7503 | High | 8.8 | 2020-06-16 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to execute m… |
CVE-2020-7502 | High | 7.5 | 2020-06-16 | A CWE-787: Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (Firmware version 4.3 and prior), which may cause a Denial of Service when… |