2020 CVEs (page 144)
Page 144 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11696 | Medium | 6.1 | 2020-06-05 | In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in ver… |
CVE-2020-13646 | High | 7.8 | 2020-06-05 | In Cheetah free WiFi 5.1, the driver file (liebaonat.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2020-11697 | Medium | 6.1 | 2020-06-05 | In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for vers… |
CVE-2020-13870 | Medium | 5.4 | 2020-06-05 | An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name. |
CVE-2020-13869 | Medium | 5.4 | 2020-06-05 | An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name. |
CVE-2020-13868 | Medium | 6.5 | 2020-06-05 | An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity. |
CVE-2020-5591 | High | 7.5 | 2020-06-05 | XACK DNS 1.11.0 to 1.11.4, 1.10.0 to 1.10.8, 1.8.0 to 1.8.23, 1.7.0 to 1.7.18, and versions before 1.7.0 allow remote attackers to cause a denial of service co… |
CVE-2020-13867 | Medium | 5.5 | 2020-06-05 | Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup files). |
CVE-2020-10071 | Critical | 9.0 | 2020-06-05 | The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code exe… |
CVE-2020-10070 | Critical | 9.0 | 2020-06-05 | In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: z… |
CVE-2020-10068 | Medium | 5.1 | 2020-06-05 | In the Zephyr project Bluetooth subsystem, certain duplicate and back-to-back packets can cause incorrect behavior, resulting in a denial of service. This issu… |
CVE-2020-10063 | Medium | 6.8 | 2020-06-05 | A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service. This issue affects: zephyrproje… |
CVE-2020-10062 | Critical | 9.0 | 2020-06-05 | An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue… |
CVE-2020-10061 | High | 8.1 | 2020-06-05 | Improper handling of the full-buffer case in the Zephyr Bluetooth implementation can result in memory corruption. This issue affects: zephyrproject-rtos zephyr… |
CVE-2020-8555 | Medium | 6.3 | 2020-06-05 | The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side… |
CVE-2020-8103 | High | 7.2 | 2020-06-05 | A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and r… |
CVE-2020-4450 | Critical | 9.8 | 2020-06-05 | IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequenc… |
CVE-2020-4449 | High | 7.5 | 2020-06-05 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequ… |
CVE-2020-4448 | Critical | 9.8 | 2020-06-05 | IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a special… |
CVE-2020-4229 | High | 7.3 | 2020-06-05 | IBM Worklight/MobileFoundation 8.0.0.0 does not properly invalidate session cookies when a user logs out of a session, which could allow another user to gain u… |
CVE-2020-9859 | High | 7.8 | 2020-06-05 | A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplementa… |
CVE-2020-9074 | Medium | 5.3 | 2020-06-05 | Huawei Smartphones HONOR 20 PRO;Honor View 20;HONOR 20 have an improper handling of exceptional condition Vulnerability. A component cannot deal with an except… |
CVE-2020-1883 | Medium | 4.9 | 2020-06-05 | Huawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability. An attacker with high privileges exploits this vulnerability by continuousl… |
CVE-2020-12723 | High | 7.5 | 2020-06-05 | regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. |
CVE-2020-11975 | Critical | 9.8 | 2020-06-05 | Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the per… |
CVE-2020-11492 | High | 7.8 | 2020-06-05 | An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same n… |
CVE-2020-10878 | High | 8.6 | 2020-06-05 | Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to mal… |
CVE-2020-10543 | High | 8.2 | 2020-06-05 | Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. |
CVE-2020-12849 | Medium | 5.4 | 2020-06-05 | Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later… |
CVE-2020-12848 | Medium | 5.4 | 2020-06-05 | In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backen… |
CVE-2020-13843 | Medium | 5.5 | 2020-06-05 | An issue was discovered on LG mobile devices with Android OS software before 2020-06-01. Local users can cause a denial of service because checking of the user… |
CVE-2020-13842 | High | 7.8 | 2020-06-05 | An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). A dangerous AT command was made available even though it… |
CVE-2020-13841 | Critical | 9.8 | 2020-06-05 | An issue was discovered on LG mobile devices with Android OS 9 and 10 (MTK chipsets). An AT command handler allows attackers to bypass intended access restrict… |
CVE-2020-13840 | Critical | 9.8 | 2020-06-05 | An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via an MTK AT command handler bu… |
CVE-2020-13839 | Critical | 9.8 | 2020-06-05 | An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via a custom AT command handler… |
CVE-2020-13849 | High | 7.5 | 2020-06-04 | The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to caus… |
CVE-2020-13768 | Critical | 9.8 | 2020-06-04 | In MiniShare before 1.4.2, there is a stack-based buffer overflow via an HTTP PUT request, which allows an attacker to achieve arbitrary code execution, a simi… |
CVE-2020-13848 | High | 7.5 | 2020-06-04 | Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointe… |
CVE-2020-12853 | Medium | 6.1 | 2020-06-04 | Pydio Cells 2.0.4 allows XSS. A malicious user can either upload or create a new file that contains potentially malicious HTML and JavaScript code to personal… |
CVE-2020-12852 | Medium | 6.8 | 2020-06-04 | The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update… |
CVE-2020-12851 | High | 8.1 | 2020-06-04 | Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another user’s personal and cells folders (repositories) by uploading a… |
CVE-2020-12847 | High | 7.2 | 2020-06-04 | Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator role. This console pr… |
CVE-2020-11682 | Medium | 6.5 | 2020-06-04 | Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, and included in reques… |
CVE-2020-11681 | High | 8.1 | 2020-06-04 | Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an admin… |
CVE-2020-11680 | Medium | 6.5 | 2020-06-04 | Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted… |
CVE-2020-11679 | High | 8.8 | 2020-06-04 | Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/Users/Edit/:UserId fail… |
CVE-2020-7661 | High | 7.5 | 2020-06-04 | all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of… |
CVE-2020-13838 | Low | 3.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The DeX Lockscreen feature does not block access to Quick Panel and notific… |
CVE-2020-13837 | Low | 3.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with Q(10.0) software. The Lockscreen feature does not block Quick Panel access to Music Share. The Samsung I… |
CVE-2020-13836 | High | 7.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. HWRResProvider allows path traversal for data exposure. The Samsun… |
CVE-2020-13835 | Critical | 9.8 | 2020-06-04 | An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The Gatekeeper Trustlet allows a brute-force attack on user credentials… |
CVE-2020-13834 | High | 7.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (with TEEGRIS) software. Secure Folder does not properly restrict use of And… |
CVE-2020-13833 | Critical | 9.1 | 2020-06-04 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The system area allows arbitrary file overwrites via a symlink att… |
CVE-2020-13832 | Critical | 9.8 | 2020-06-04 | An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software. The Widevine Trustlet allows arbitrary code executio… |
CVE-2020-13831 | Critical | 9.8 | 2020-06-04 | An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 7570 chipsets) software. The Trustonic Kinibi component allows arbitrary memor… |
CVE-2020-13830 | High | 7.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with P(9.0) software. One UI HOME logging can leak information. The Samsung ID is SVE-2019-16382 (June 2020). |
CVE-2020-13829 | High | 7.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Attackers can disable the SEAndroid protection mechanism in the RKP. The Sa… |
CVE-2020-10702 | Medium | 5.5 | 2020-06-04 | A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A ge… |
CVE-2020-9462 | Medium | 4.3 | 2020-06-04 | An issue was discovered in all Athom Homey and Homey Pro devices up to the current version 4.2.0. An attacker within RF range can obtain a cleartext copy of th… |
CVE-2020-13815 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It allows stack consumption via a loop of an indirect object reference. |
CVE-2020-13814 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It has a use-after-free via a document that lacks a dictionary. |
CVE-2020-13813 | High | 7.8 | 2020-06-04 | An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory whe… |
CVE-2020-13812 | High | 7.8 | 2020-06-04 | An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory. |
CVE-2020-13811 | High | 7.8 | 2020-06-04 | An issue was discovered in Foxit Studio Photo before 3.6.6.922. It has an out-of-bounds write via a crafted TIFF file. |
CVE-2020-13800 | Medium | 6.0 | 2020-06-04 | ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_writ… |
CVE-2020-13791 | Medium | 5.5 | 2020-06-04 | hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space. |
CVE-2020-13765 | Medium | 5.6 | 2020-06-04 | rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid mem… |
CVE-2020-13692 | High | 7.7 | 2020-06-04 | PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. |
CVE-2020-13827 | Medium | 6.1 | 2020-06-04 | phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php. |
CVE-2020-13822 | High | 7.7 | 2020-06-04 | The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could con… |
CVE-2020-13810 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows signature validation bypass via a modified file or a file with non-standard sign… |
CVE-2020-13809 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows resource consumption via long strings in the content stream. |
CVE-2020-13808 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows resource consumption via crafted cross-reference stream data. |
CVE-2020-13807 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has circular reference mishandling that causes a loop. |
CVE-2020-13806 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has a use-after-free because of JavaScript execution after a deletion or close operatio… |
CVE-2020-13805 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failu… |
CVE-2020-13804 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows information disclosure of a hardcoded username and password in the DocuSign plug… |
CVE-2020-13803 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF Mac and Foxit Reader for Mac before 4.0. It allows signature validation bypass via a modified file or a file with n… |
CVE-2020-4509 | High | 7.6 | 2020-06-04 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulne… |
CVE-2020-4193 | Critical | 9.8 | 2020-06-04 | IBM Security Guardium 11.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 17… |
CVE-2020-4191 | Medium | 4.4 | 2020-06-04 | IBM Security Guardium 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2020-4183 | Medium | 6.1 | 2020-06-04 | IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2020-9292 | Critical | 9.8 | 2020-06-04 | An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable s… |
CVE-2020-6640 | Medium | 5.4 | 2020-06-04 | An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross sit… |
CVE-2020-13818 | High | 7.5 | 2020-06-04 | In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed. |
CVE-2020-13817 | High | 7.4 | 2020-06-04 | ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting tra… |
CVE-2020-13777 | High | 7.4 | 2020-06-04 | GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in T… |
CVE-2020-10549 | Critical | 9.8 | 2020-06-04 | rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vul… |
CVE-2020-10548 | Critical | 9.8 | 2020-06-04 | rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vuln… |
CVE-2020-10547 | Critical | 9.8 | 2020-06-04 | rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cle… |
CVE-2020-10546 | Critical | 9.8 | 2020-06-04 | rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext… |
CVE-2020-7030 | Medium | 5.5 | 2020-06-04 | A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain una… |
CVE-2020-11094 | Medium | 6.1 | 2020-06-04 | The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request includin… |
CVE-2020-6504 | Medium | 4.3 | 2020-06-03 | Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass notification restrictions via a cr… |
CVE-2020-6503 | Medium | 6.5 | 2020-06-03 | Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information fro… |
CVE-2020-6502 | Medium | 6.5 | 2020-06-03 | Incorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6501 | Medium | 6.5 | 2020-06-03 | Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML pa… |
CVE-2020-6500 | Medium | 6.5 | 2020-06-03 | Inappropriate implementation in interstitials in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) v… |
CVE-2020-6499 | Medium | 6.5 | 2020-06-03 | Inappropriate implementation in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass AppCache security restrictions via a crafte… |
CVE-2020-6498 | Medium | 6.5 | 2020-06-03 | Incorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted HTM… |