2020 CVEs (page 141)
Page 141 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7585 | High | 7.8 | 2020-06-10 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions <… |
CVE-2020-7580 | Medium | 6.7 | 2020-06-10 | A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC… |
CVE-2020-10755 | Medium | 6.5 | 2020-06-10 | An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-c… |
CVE-2020-7675 | Critical | 9.8 | 2020-06-10 | cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the `color` argument executed by the `eval` function resulting in… |
CVE-2020-7674 | Critical | 9.8 | 2020-06-10 | access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the `template` function is executed by the `eval` function result… |
CVE-2020-7673 | Critical | 9.8 | 2020-06-10 | node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located wit… |
CVE-2020-7672 | High | 8.6 | 2020-06-10 | mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in cod… |
CVE-2020-7671 | High | 7.5 | 2020-06-10 | goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct… |
CVE-2020-7670 | High | 7.5 | 2020-06-10 | agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and re… |
CVE-2020-13271 | Medium | 6.1 | 2020-06-10 | A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 1… |
CVE-2020-13270 | High | 7.5 | 2020-06-10 | Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted pub… |
CVE-2020-13269 | Medium | 6.1 | 2020-06-10 | A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later thr… |
CVE-2020-13268 | Medium | 5.3 | 2020-06-10 | A specially crafted request could be used to confirm the existence of files hosted on object storage services, without disclosing their contents. This vulnerab… |
CVE-2020-13267 | Medium | 6.1 | 2020-06-10 | A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1 |
CVE-2020-6275 | Critical | 9.8 | 2020-06-10 | SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in… |
CVE-2020-6271 | High | 8.2 | 2020-06-10 | SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of me… |
CVE-2020-6270 | Medium | 6.5 | 2020-06-10 | SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for… |
CVE-2020-6269 | Medium | 6.5 | 2020-06-10 | Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be re… |
CVE-2020-6268 | High | 8.1 | 2020-06-10 | Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 10… |
CVE-2020-6266 | Medium | 5.4 | 2020-06-10 | SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL validation, leading… |
CVE-2020-6264 | High | 7.5 | 2020-06-10 | SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leadi… |
CVE-2020-6263 | Critical | 9.8 | 2020-06-10 | Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CO… |
CVE-2020-6260 | Medium | 5.3 | 2020-06-10 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete X… |
CVE-2020-6246 | Medium | 6.1 | 2020-06-10 | SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficient… |
CVE-2020-6239 | Medium | 4.4 | 2020-06-10 | Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear… |
CVE-2020-4436 | High | 7.5 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the syst… |
CVE-2020-4435 | High | 7.5 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate k… |
CVE-2020-4434 | High | 7.5 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker wi… |
CVE-2020-4433 | High | 7.5 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with in… |
CVE-2020-4432 | High | 7.5 | 2020-06-10 | Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the sy… |
CVE-2020-7280 | High | 7.8 | 2020-06-10 | Privilege Escalation vulnerability during daily DAT updates when using McAfee Virus Scan Enterprise (VSE) prior to 8.8 Patch 15 allows local users to cause the… |
CVE-2020-7279 | Medium | 4.6 | 2020-06-10 | DLL Search Order Hijacking Vulnerability in the installer component of McAfee Host Intrusion Prevention System (Host IPS) for Windows prior to 8.0.0 Patch 15 U… |
CVE-2020-13996 | High | 8.8 | 2020-06-09 | The J2Store plugin before 3.3.13 for Joomla! allows a SQL injection attack by a trusted store manager. |
CVE-2020-8337 | Medium | 6.7 | 2020-06-09 | An unquoted search path vulnerability was reported in versions prior to 1.0.83.0 of the Synaptics Smart Audio UWP app associated with the DCHU audio drivers on… |
CVE-2020-8336 | Medium | 6.4 | 2020-06-09 | Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to prevent roll back of CSME Firmware in flash. |
CVE-2020-8334 | Medium | 6.1 | 2020-06-09 | The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T495s, X395, T495, A485, A285, A475, A275 which may allow for unauthorized access. |
CVE-2020-8323 | Medium | 6.4 | 2020-06-09 | A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStation, and Lenovo Notebook models may allow… |
CVE-2020-8322 | Medium | 6.4 | 2020-06-09 | A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code e… |
CVE-2020-8321 | Medium | 6.4 | 2020-06-09 | A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and ThinkStation models may allow… |
CVE-2020-8320 | Medium | 6.4 | 2020-06-09 | An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege. |
CVE-2020-1348 | Medium | 6.5 | 2020-06-09 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2020-1343 | Medium | 5.9 | 2020-06-09 | An information disclosure vulnerability exists in Visual Studio Code Live Share Extension when it exposes tokens in plain text, aka 'Visual Studio Code Live Sh… |
CVE-2020-1340 | Medium | 5.4 | 2020-06-09 | A spoofing vulnerability exists when the NuGetGallery does not properly sanitize input on package metadata values, aka 'NuGetGallery Spoofing Vulnerability'. |
CVE-2020-1334 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1331 | Medium | 5.4 | 2020-06-09 | A spoofing vulnerability exists when System Center Operations Manager (SCOM) does not properly sanitize a specially crafted web request to an affected SCOM ins… |
CVE-2020-1329 | Medium | 6.5 | 2020-06-09 | A spoofing vulnerability exists when Microsoft Bing Search for Android improperly handles specific HTML content, aka 'Microsoft Bing Search Spoofing Vulnerabil… |
CVE-2020-1327 | Medium | 6.1 | 2020-06-09 | A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnera… |
CVE-2020-1324 | High | 7.8 | 2020-06-09 | An elevation of privilege (user to user) vulnerability exists in Windows Security Health Service when handling certain objects in memory.To exploit the vulnera… |
CVE-2020-1323 | Medium | 6.1 | 2020-06-09 | An open redirect vulnerability exists in Microsoft SharePoint that could lead to spoofing.To exploit the vulnerability, an attacker could send a link that has… |
CVE-2020-1322 | Medium | 6.5 | 2020-06-09 | An information disclosure vulnerability exists when Microsoft Project reads out of bound memory due to an uninitialized variable, aka 'Microsoft Project Inform… |
CVE-2020-1321 | High | 8.8 | 2020-06-09 | A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory, aka 'Microsoft Office Remote Code… |
CVE-2020-1320 | Medium | 5.4 | 2020-06-09 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2020-1318 | Medium | 5.4 | 2020-06-09 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2020-1317 | High | 8.8 | 2020-06-09 | An elevation of privilege vulnerability exists when Group Policy improperly checks access, aka 'Group Policy Elevation of Privilege Vulnerability'. |
CVE-2020-1316 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2020-1315 | Medium | 5.3 | 2020-06-09 | An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory, aka 'Internet Explorer Information Disclosure Vulne… |
CVE-2020-1314 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists in Windows Text Service Framework (TSF) when the TSF server fails to properly handle messages sent from TSF clie… |
CVE-2020-1313 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows Update Orchestrator Service improperly handles file operations, aka 'Windows Update Orchestrato… |
CVE-2020-1312 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operations.To exploit the v… |
CVE-2020-1311 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when Component Object Model (COM) client uses special case IIDs, aka 'Component Object Model Elevation of Privil… |
CVE-2020-1310 | Medium | 6.7 | 2020-06-09 | An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation… |
CVE-2020-1309 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Microsoft Store Runtime improperly handles memory.To exploit this vulnerability, an attacker would firs… |
CVE-2020-1307 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2020-1306 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1305 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1304 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1302 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operations.To exploit the v… |
CVE-2020-1301 | High | 8.8 | 2020-06-09 | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests, aka 'Windows SMB R… |
CVE-2020-1300 | High | 8.8 | 2020-06-09 | A remote code execution vulnerability exists when Microsoft Windows fails to properly handle cabinet files.To exploit the vulnerability, an attacker would have… |
CVE-2020-1299 | High | 8.8 | 2020-06-09 | A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successful… |
CVE-2020-1298 | Medium | 5.4 | 2020-06-09 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2020-1297 | Medium | 5.4 | 2020-06-09 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2020-1296 | Medium | 5.5 | 2020-06-09 | A vulnerability exists in the way the Windows Diagnostics & feedback settings app handles objects in memory, aka 'Windows Diagnostics & feedback Informatio… |
CVE-2020-1295 | High | 8.8 | 2020-06-09 | An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. |
CVE-2020-1294 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletService Elevation of Pri… |
CVE-2020-1293 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'Diagnostics Hub Sta… |
CVE-2020-1292 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists in OpenSSH for Windows when it does not properly restrict access to configuration settings, aka 'OpenSSH for Win… |
CVE-2020-1291 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windows Network Connecti… |
CVE-2020-1290 | Medium | 5.5 | 2020-06-09 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili… |
CVE-2020-1289 | Medium | 5.4 | 2020-06-09 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, a… |
CVE-2020-1287 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletService Elevation of Pri… |
CVE-2020-1286 | High | 8.8 | 2020-06-09 | A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.An attacker who successfully exploited this vulnerabi… |
CVE-2020-1284 | Medium | 6.5 | 2020-06-09 | A denial of service vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3… |
CVE-2020-1283 | Medium | 6.5 | 2020-06-09 | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. |
CVE-2020-1282 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1281 | High | 8.8 | 2020-06-09 | A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerabi… |
CVE-2020-1280 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists in the way that the Windows Bluetooth Service handles objects in memory, aka 'Windows Bluetooth Service Elevatio… |
CVE-2020-1279 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when Windows Lockscreen fails to properly load spotlight images from a secure location, aka 'Windows Lockscreen… |
CVE-2020-1278 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'Diagnostics Hub Sta… |
CVE-2020-1277 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operations.To exploit the v… |
CVE-2020-1276 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2020-1275 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2020-1274 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2020-1273 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2020-1272 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure libr… |
CVE-2020-1271 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows Backup Service improperly handles file operations.To exploit this vulnerability, an attacker wo… |
CVE-2020-1270 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists in the way that the wlansvc.dll handles objects in memory, aka 'Windows WLAN Service Elevation of Privilege Vuln… |
CVE-2020-1269 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2020-1268 | Medium | 5.5 | 2020-06-09 | An information disclosure vulnerability exists when a Windows service improperly handles objects in memory, aka 'Windows Service Information Disclosure Vulnera… |
CVE-2020-1266 | High | 7.8 | 2020-06-09 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |