2020 CVEs (page 138)
Page 138 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7501 | High | 8.8 | 2020-06-16 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) which… |
CVE-2020-7500 | Critical | 9.8 | 2020-06-16 | A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and Touch Panels (affect… |
CVE-2020-7499 | Medium | 6.5 | 2020-06-16 | A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which coul… |
CVE-2020-7498 | Critical | 9.8 | 2020-06-16 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simp… |
CVE-2020-7497 | Critical | 9.8 | 2020-06-16 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Servi… |
CVE-2020-7496 | High | 7.8 | 2020-06-16 | A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo… |
CVE-2020-7495 | Medium | 5.5 | 2020-06-16 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file extraction exists in EcoStruxure Operato… |
CVE-2020-7494 | High | 7.8 | 2020-06-16 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Servi… |
CVE-2020-7493 | High | 7.8 | 2020-06-16 | A CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1… |
CVE-2020-7492 | Medium | 6.5 | 2020-06-16 | A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the password when the user is… |
CVE-2020-13162 | High | 7.0 | 2020-06-16 | A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as N… |
CVE-2020-14199 | Medium | 6.5 | 2020-06-16 | BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into making two signatures… |
CVE-2020-10268 | Medium | 6.1 | 2020-06-16 | Critical services for operation can be terminated from windows task manager, bringing the manipulator to a halt. After this a Re-Calibration of the brakes need… |
CVE-2020-14195 | High | 8.1 | 2020-06-16 | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRea… |
CVE-2020-9522 | Medium | 6.1 | 2020-06-16 | Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, Affecting versions 7.0.x, 7.2 and 7.2.1 . The vulne… |
CVE-2020-9296 | Critical | 9.8 | 2020-06-16 | Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of in… |
CVE-2020-8544 | Medium | 6.5 | 2020-06-16 | OX App Suite through 7.10.3 allows SSRF. |
CVE-2020-8543 | High | 7.5 | 2020-06-16 | OX App Suite through 7.10.3 has Improper Input Validation. |
CVE-2020-8542 | Medium | 5.4 | 2020-06-16 | OX App Suite through 7.10.3 allows XSS. |
CVE-2020-8541 | Medium | 6.5 | 2020-06-16 | OX App Suite through 7.10.3 allows XXE attacks. |
CVE-2020-4320 | Medium | 6.5 | 2020-06-16 | IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name… |
CVE-2020-4310 | High | 7.5 | 2020-06-16 | IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logi… |
CVE-2020-12494 | Medium | 5.3 | 2020-06-16 | Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features. Except for Ethern… |
CVE-2020-11841 | Medium | 4.3 | 2020-06-16 | Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9… |
CVE-2020-11840 | Medium | 4.3 | 2020-06-16 | Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9… |
CVE-2020-11838 | Medium | 5.4 | 2020-06-16 | Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The v… |
CVE-2020-0235 | Critical | 9.8 | 2020-06-16 | In crus_sp_shared_ioctl we first copy 4 bytes from userdata into "size" variable, and then use that variable as the size parameter for "copy_from_user", ending… |
CVE-2020-0234 | High | 7.8 | 2020-06-16 | In crus_afe_get_param of msm-cirrus-playback.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p… |
CVE-2020-0232 | Critical | 9.8 | 2020-06-16 | Function abc_pcie_issue_dma_xfer_sync creates a transfer object, adds it to the session object then continues to work with it. A concurrent thread could retrie… |
CVE-2020-0223 | Critical | 9.8 | 2020-06-16 | This is an unbounded write into kernel global memory, via a user-controlled buffer size.Product: AndroidVersions: Android kernelAndroid ID: A-135130450 |
CVE-2020-13431 | High | 7.8 | 2020-06-16 | I2P before 0.9.46 allows local users to gain privileges via a Trojan horse I2PSvc.exe file because of weak permissions on a certain %PROGRAMFILES% subdirectory. |
CVE-2020-4051 | Low | 3.7 | 2020-06-15 | In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and great… |
CVE-2020-5358 | Medium | 6.7 | 2020-06-15 | Dell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7 contain a privilege escalation vulnerability due to incorrect per… |
CVE-2020-14163 | High | 7.5 | 2020-06-15 | An issue was discovered in ecma/operations/ecma-container-object.c in JerryScript 2.2.0. Operations with key/value pairs did not consider the case where garbag… |
CVE-2020-5755 | High | 7.8 | 2020-06-15 | Webroot endpoint agents prior to version v9.0.28.48 did not protect the "%PROGRAMDATA%\WrData\PKG" directory against renaming. This could allow attackers to tr… |
CVE-2020-5754 | Critical | 9.1 | 2020-06-15 | Webroot endpoint agents prior to version v9.0.28.48 allows remote attackers to trigger a type confusion vulnerability over its listening TCP port, resulting in… |
CVE-2020-5742 | High | 8.8 | 2020-06-15 | Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests. |
CVE-2020-12019 | Critical | 9.8 | 2020-06-15 | WebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. |
CVE-2020-12005 | High | 7.5 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-12003 | High | 7.5 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-12001 | Critical | 9.8 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-11999 | High | 8.1 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-11969 | Critical | 9.8 | 2020-06-15 | If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099… |
CVE-2020-14159 | High | 8.8 | 2020-06-15 | By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individua… |
CVE-2020-13652 | Medium | 6.1 | 2020-06-15 | An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200528, 2019R2 before p20200430, and 2020R1 before p20200507. A cross-site scripti… |
CVE-2020-13651 | High | 7.8 | 2020-06-15 | An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200421, and 2019R2 before p20200430. It allows a user to provide data that will be… |
CVE-2020-13650 | High | 7.5 | 2020-06-15 | An issue was discovered in DigDash 2018R2 before p20200210 and 2019R1 before p20200210. The login page is vulnerable to Server-Side Request Forgery (SSRF) that… |
CVE-2020-14156 | High | 8.8 | 2020-06-15 | user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions. |
CVE-2020-14149 | High | 7.5 | 2020-06-15 | In uftpd before 2.12, handle_CWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of service, as demonstrate… |
CVE-2020-14148 | High | 7.5 | 2020-06-15 | The Server-Server protocol implementation in ngIRCd before 26~rc2 allows an out-of-bounds access, as demonstrated by the IRC_NJOIN() function. |
CVE-2020-14147 | High | 7.7 | 2020-06-15 | An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis… |
CVE-2020-14155 | Medium | 5.3 | 2020-06-15 | libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. |
CVE-2020-14154 | Medium | 4.8 | 2020-06-15 | Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate. |
CVE-2020-14153 | High | 7.1 | 2020-06-15 | In IJG JPEG (aka libjpeg) from version 8 through 9c, jdhuff.c has an out-of-bounds array read for certain table pointers. |
CVE-2020-14152 | High | 7.1 | 2020-06-15 | In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memor… |
CVE-2020-14150 | Medium | 5.5 | 2020-06-15 | GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: there is a risk only if Bison is used with untrusted input, and… |
CVE-2020-14034 | Critical | 9.8 | 2020-06-15 | An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_get_codec_from_pt in utils.c has a Buffer Overflow via long value in a… |
CVE-2020-14033 | Critical | 9.8 | 2020-06-15 | An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_streaming_rtsp_parse_sdp in plugins/janus_streaming.c has a Buffer Ove… |
CVE-2020-9076 | Medium | 6.8 | 2020-06-15 | HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B smartphones with versions earlier than 10.1.0.135(C00E135R2P11); versions earlier than 10.1.0.135(C00E135R2P8), versions e… |
CVE-2020-3961 | High | 7.8 | 2020-06-15 | VMware Horizon Client for Windows (prior to 5.4.3) contains a privilege escalation vulnerability due to folder permission configuration and unsafe loading of l… |
CVE-2020-14054 | Critical | 9.8 | 2020-06-15 | SOKKIA GNR5 Vanguard WEB version 1.2 (build: 91f2b2c3a04d203d79862f87e2440cb7cefc3cd3) and hardware version 212 allows remote attackers to bypass admin authent… |
CVE-2020-13999 | Medium | 5.5 | 2020-06-15 | ScaleViewPortExtEx in libemf.cpp in libEMF (aka ECMA-234 Metafile Library) 1.0.12 allows an integer overflow and denial of service via a crafted EMF file. |
CVE-2020-13150 | High | 7.8 | 2020-06-15 | D-link DSL-2750U ISL2750UEME3.V1E devices allow approximately 90 seconds of access to the control panel, after a restart, before MAC address filtering rules be… |
CVE-2020-9427 | Medium | 5.0 | 2020-06-15 | OX Guard 2.10.3 and earlier allows SSRF. |
CVE-2020-9426 | Medium | 6.1 | 2020-06-15 | OX Guard 2.10.3 and earlier allows XSS. |
CVE-2020-9075 | Medium | 6.5 | 2020-06-15 | Huawei products Secospace USG6300;USG6300E with versions of V500R001C30,V500R001C50,V500R001C60,V500R001C80,V500R005C00,V500R005C10;V600R006C00 have a vulnerab… |
CVE-2020-1825 | Medium | 6.5 | 2020-06-15 | FusionAccess with versions earlier than 6.5.1.SPC002 have a Denial of Service (DoS) vulnerability. Due to insufficient verification on specific input, attacker… |
CVE-2020-1813 | Medium | 6.8 | 2020-06-15 | HUAWEI P30 smart phone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. Due to improper authentication of spe… |
CVE-2020-14011 | Critical | 9.8 | 2020-06-15 | Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually… |
CVE-2020-8675 | Medium | 6.8 | 2020-06-15 | Insufficient control flow management in firmware build and signing tool for Intel(R) Innovation Engine before version 1.0.859 may allow an unauthenticated user… |
CVE-2020-8674 | Medium | 5.3 | 2020-06-15 | Out-of-bounds read in DHCPv6 subsystem in Intel(R) AMT and Intel(R)ISM versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64 and 14.0.33 may allow an unauthenti… |
CVE-2020-4494 | High | 7.5 | 2020-06-15 | IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 thr… |
CVE-2020-4477 | Medium | 6.5 | 2020-06-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attac… |
CVE-2020-4471 | Medium | 6.5 | 2020-06-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions by send a specially… |
CVE-2020-4470 | High | 8.0 | 2020-06-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute a… |
CVE-2020-4469 | Critical | 9.8 | 2020-06-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP comman… |
CVE-2020-4406 | Medium | 5.4 | 2020-06-15 | IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 thr… |
CVE-2020-4216 | Critical | 9.8 | 2020-06-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound aut… |
CVE-2020-14146 | Medium | 5.4 | 2020-06-15 | KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATH_INFO. |
CVE-2020-0597 | High | 7.5 | 2020-06-15 | Out-of-bounds read in IPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 14.0.33 may allow an unauthenticated user to potentially enable denial of… |
CVE-2020-0596 | High | 7.5 | 2020-06-15 | Improper input validation in DHCPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthentic… |
CVE-2020-0595 | Critical | 9.8 | 2020-06-15 | Use after free in IPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to… |
CVE-2020-0594 | Critical | 9.8 | 2020-06-15 | Out-of-bounds read in IPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user… |
CVE-2020-0586 | High | 7.8 | 2020-06-15 | Improper initialization in subsystem for Intel(R) SPS versions before SPS_E3_04.01.04.109.0 and SPS_E3_04.08.04.070.0 may allow an authenticated user to potent… |
CVE-2020-0566 | Medium | 6.8 | 2020-06-15 | Improper Access Control in subsystem for Intel(R) TXE versions before 3.175 and 4.0.25 may allow an unauthenticated user to potentially enable escalation of pr… |
CVE-2020-0545 | Medium | 4.4 | 2020-06-15 | Integer overflow in subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77 and Intel(R) TXE versions before 3.1.75, 4.0.25 and Intel(R) Server… |
CVE-2020-0543 | Medium | 5.5 | 2020-06-15 | Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information… |
CVE-2020-0542 | High | 7.8 | 2020-06-15 | Improper buffer restrictions in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an authenticated user to potentiall… |
CVE-2020-0541 | Medium | 6.7 | 2020-06-15 | Out-of-bounds write in subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow a privileged user to potentially enable esca… |
CVE-2020-0540 | High | 7.5 | 2020-06-15 | Insufficiently protected credentials in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentially e… |
CVE-2020-0539 | Medium | 5.5 | 2020-06-15 | Path traversal in subsystem for Intel(R) DAL software for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33 and Intel(R) TXE… |
CVE-2020-0538 | High | 7.5 | 2020-06-15 | Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentiall… |
CVE-2020-0537 | Medium | 4.9 | 2020-06-15 | Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow a privileged user to potentially enab… |
CVE-2020-0536 | High | 7.5 | 2020-06-15 | Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and Intel(R) TXE version… |
CVE-2020-0535 | Medium | 5.3 | 2020-06-15 | Improper input validation in Intel(R) AMT versions before 11.8.76, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentially enable infor… |
CVE-2020-0534 | High | 7.5 | 2020-06-15 | Improper input validation in the DAL subsystem for Intel(R) CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow an unauthenticated user to pot… |
CVE-2020-0533 | Medium | 6.7 | 2020-06-15 | Reversible one-way hash in Intel(R) CSME versions before 11.8.76, 11.12.77 and 11.22.77 may allow a privileged user to potentially enable escalation of privile… |
CVE-2020-0532 | High | 7.1 | 2020-06-15 | Improper input validation in subsystem for Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentiall… |
CVE-2020-0531 | Medium | 6.5 | 2020-06-15 | Improper input validation in Intel(R) AMT versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an authenticated user to potentially enable informa… |
CVE-2020-0529 | High | 7.8 | 2020-06-15 | Improper initialization in BIOS firmware for 8th, 9th and 10th Generation Intel(R) Core(TM) Processor families may allow an unauthenticated user to potentially… |