2020 CVEs (page 145)
Page 145 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6497 | Medium | 6.5 | 2020-06-03 | Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted URI. |
CVE-2020-6496 | High | 8.8 | 2020-06-03 | Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2020-6495 | Medium | 6.5 | 2020-06-03 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6494 | Medium | 6.5 | 2020-06-03 | Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) vi… |
CVE-2020-6493 | Critical | 9.6 | 2020-06-03 | Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2020-6453 | High | 8.8 | 2020-06-03 | Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-6419 | High | 8.8 | 2020-06-03 | Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-11091 | Medium | 5.8 | 2020-06-03 | In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert… |
CVE-2020-11080 | Low | 3.7 | 2020-06-03 | In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious cli… |
CVE-2020-5299 | Medium | 4.0 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually… |
CVE-2020-5298 | Medium | 4.0 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `Impo… |
CVE-2020-5297 | Low | 3.4 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp… |
CVE-2020-5296 | Medium | 6.2 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local… |
CVE-2020-5295 | Medium | 4.8 | 2020-06-03 | In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an… |
CVE-2020-13798 | Medium | 6.1 | 2020-06-03 | An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/feeds/feed.class.php. |
CVE-2020-13797 | Medium | 6.1 | 2020-06-03 | An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/websites/website.class.php. |
CVE-2020-13796 | Medium | 6.1 | 2020-06-03 | An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/structure/structure.class.php. |
CVE-2020-13795 | Medium | 5.3 | 2020-06-03 | An issue was discovered in Navigate CMS through 2.8.7. It allows Directory Traversal because lib/packages/templates/template.class.php mishandles ../ and ..\ s… |
CVE-2020-13792 | Medium | 4.3 | 2020-06-03 | PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion. |
CVE-2020-3353 | Medium | 5.9 | 2020-06-03 | A vulnerability in the syslog processing engine of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of se… |
CVE-2020-3339 | Medium | 5.4 | 2020-06-03 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct SQL injection atta… |
CVE-2020-13790 | High | 8.1 | 2020-06-03 | libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file. |
CVE-2020-13379 | High | 8.2 | 2020-06-03 | The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make… |
CVE-2020-7015 | Medium | 5.4 | 2020-06-03 | Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization cou… |
CVE-2020-7014 | High | 8.8 | 2020-06-03 | The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an a… |
CVE-2020-7013 | High | 7.2 | 2020-06-03 | Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations coul… |
CVE-2020-7012 | High | 8.8 | 2020-06-03 | Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to wri… |
CVE-2020-7011 | Medium | 6.1 | 2020-06-03 | Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injec… |
CVE-2020-7010 | High | 7.5 | 2020-06-03 | Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the… |
CVE-2020-3335 | Medium | 5.5 | 2020-06-03 | A vulnerability in the key store of Cisco Application Services Engine Software could allow an authenticated, local attacker to read sensitive information of ot… |
CVE-2020-3333 | Medium | 5.3 | 2020-06-03 | A vulnerability in the API of Cisco Application Services Engine Software could allow an unauthenticated, remote attacker to update event policies on an affecte… |
CVE-2020-3281 | High | 8.8 | 2020-06-03 | A vulnerability in the audit logging component of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to view sensiti… |
CVE-2020-3267 | High | 7.1 | 2020-06-03 | A vulnerability in the API subsystem of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to change the availabi… |
CVE-2020-3258 | Critical | 9.8 | 2020-06-03 | Multiple vulnerabilities in Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected G… |
CVE-2020-3257 | High | 8.1 | 2020-06-03 | Multiple vulnerabilities in the Cisco IOx application environment of Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000… |
CVE-2020-3238 | High | 8.1 | 2020-06-03 | A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or… |
CVE-2020-3237 | Medium | 6.3 | 2020-06-03 | A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, local attacker to overwrite… |
CVE-2020-3235 | High | 7.7 | 2020-06-03 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software on Catalyst 4500 Series Switches cou… |
CVE-2020-3234 | High | 8.8 | 2020-06-03 | A vulnerability in the virtual console authentication of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and… |
CVE-2020-3233 | Medium | 5.4 | 2020-06-03 | A vulnerability in the web-based Local Manager interface of the Cisco IOx Application Framework could allow an authenticated, remote attacker to conduct a stor… |
CVE-2020-3232 | High | 7.7 | 2020-06-03 | A vulnerability in the Simple Network Management Protocol (SNMP) implementation in Cisco ASR 920 Series Aggregation Services Router model ASR920-12SZ-IM could… |
CVE-2020-3231 | Medium | 4.7 | 2020-06-03 | A vulnerability in the 802.1X feature of Cisco Catalyst 2960-L Series Switches and Cisco Catalyst CDB-8P Switches could allow an unauthenticated, adjacent atta… |
CVE-2020-3230 | High | 7.5 | 2020-06-03 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, r… |
CVE-2020-3229 | High | 8.8 | 2020-06-03 | A vulnerability in Role Based Access Control (RBAC) functionality of Cisco IOS XE Web Management Software could allow a Read-Only authenticated, remote attacke… |
CVE-2020-3228 | High | 8.6 | 2020-06-03 | A vulnerability in Security Group Tag Exchange Protocol (SXP) in Cisco IOS Software, Cisco IOS XE Software, and Cisco NX-OS Software could allow an unauthentic… |
CVE-2020-3227 | Critical | 9.8 | 2020-06-03 | A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, rem… |
CVE-2020-3226 | High | 8.6 | 2020-06-03 | A vulnerability in the Session Initiation Protocol (SIP) library of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacke… |
CVE-2020-3225 | High | 8.6 | 2020-06-03 | Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an u… |
CVE-2020-3224 | High | 8.8 | 2020-06-03 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to in… |
CVE-2020-3223 | Medium | 4.9 | 2020-06-03 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges… |
CVE-2020-3222 | Medium | 4.3 | 2020-06-03 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to bypass access control re… |
CVE-2020-3221 | High | 8.6 | 2020-06-03 | A vulnerability in the Flexible NetFlow Version 9 packet processor of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an… |
CVE-2020-3220 | Medium | 6.8 | 2020-06-03 | A vulnerability in the hardware crypto driver of Cisco IOS XE Software for Cisco 4300 Series Integrated Services Routers and Cisco Catalyst 9800-L Wireless Con… |
CVE-2020-3219 | High | 8.8 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with administrati… |
CVE-2020-3218 | High | 7.2 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code w… |
CVE-2020-3217 | High | 8.8 | 2020-06-03 | A vulnerability in the Topology Discovery Service of Cisco One Platform Kit (onePK) in Cisco IOS Software, Cisco IOS XE Software, Cisco IOS XR Software, and Ci… |
CVE-2020-3216 | Medium | 6.8 | 2020-06-03 | A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, physical attacker to bypass authentication and gain unrestricted access to the… |
CVE-2020-3215 | Medium | 6.7 | 2020-06-03 | A vulnerability in the Virtual Services Container of Cisco IOS XE Software could allow an authenticated, local attacker to gain root-level privileges on an aff… |
CVE-2020-3214 | Medium | 6.7 | 2020-06-03 | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to escalate their privileges to a user with root-level privileges. The vu… |
CVE-2020-3213 | Medium | 6.7 | 2020-06-03 | A vulnerability in the ROMMON of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to those of the root user of the unde… |
CVE-2020-3212 | High | 7.2 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the… |
CVE-2020-3211 | High | 7.2 | 2020-06-03 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges on the… |
CVE-2020-3210 | Medium | 6.7 | 2020-06-03 | A vulnerability in the CLI parsers of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series C… |
CVE-2020-3209 | Medium | 6.8 | 2020-06-03 | A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious softw… |
CVE-2020-3208 | Medium | 6.7 | 2020-06-03 | A vulnerability in the image verification feature of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) could al… |
CVE-2020-3207 | Medium | 6.7 | 2020-06-03 | A vulnerability in the processing of boot options of specific Cisco IOS XE Software switches could allow an authenticated, local attacker with root shell acces… |
CVE-2020-3206 | Medium | 4.7 | 2020-06-03 | A vulnerability in the handling of IEEE 802.11w Protected Management Frames (PMFs) of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IO… |
CVE-2020-3205 | High | 8.8 | 2020-06-03 | A vulnerability in the implementation of the inter-VM channel of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial IS… |
CVE-2020-3204 | Medium | 6.7 | 2020-06-03 | A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker wit… |
CVE-2020-3203 | High | 8.6 | 2020-06-03 | A vulnerability in the locally significant certificate (LSC) provisioning feature of Cisco Catalyst 9800 Series Wireless Controllers that are running Cisco IOS… |
CVE-2020-3201 | Medium | 6.0 | 2020-06-03 | A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker wit… |
CVE-2020-3200 | High | 7.7 | 2020-06-03 | A vulnerability in the Secure Shell (SSH) server code of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an… |
CVE-2020-3199 | High | 8.8 | 2020-06-03 | Multiple vulnerabilities in the Cisco IOx application environment of Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000… |
CVE-2020-3198 | Critical | 9.8 | 2020-06-03 | Multiple vulnerabilities in Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected G… |
CVE-2020-4035 | Medium | 5.9 | 2020-06-03 | In WatermelonDB (NPM package "@nozbe/watermelondb") before versions 0.15.1 and 0.16.2, a maliciously crafted record ID can exploit a SQL Injection vulnerabilit… |
CVE-2020-3322 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-3321 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-3319 | Low | 3.3 | 2020-06-03 | A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting… |
CVE-2020-13787 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information. |
CVE-2020-13786 | High | 8.8 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF. |
CVE-2020-13785 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength. |
CVE-2020-13784 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator. |
CVE-2020-13783 | High | 7.5 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information. |
CVE-2020-13782 | High | 8.8 | 2020-06-03 | D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection. |
CVE-2020-13597 | Medium | 6.0 | 2020-06-03 | Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled b… |
CVE-2020-12846 | High | 8.0 | 2020-06-03 | Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet… |
CVE-2020-4307 | Medium | 6.5 | 2020-06-03 | IBM Security Guardium 11.1 could allow an attacker on the same network to gain access to the Solr dashboard and cause a denial of service attack. IBM X-Force I… |
CVE-2020-4190 | Medium | 6.7 | 2020-06-03 | IBM Security Guardium 10.6, 11.0, and 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenti… |
CVE-2020-4187 | Medium | 5.3 | 2020-06-03 | IBM Security Guardium 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM X-Force ID: 174805. |
CVE-2020-4182 | Medium | 6.1 | 2020-06-03 | IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2020-4180 | High | 8.8 | 2020-06-03 | IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an… |
CVE-2020-4177 | Critical | 9.8 | 2020-06-03 | IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2020-13756 | Critical | 9.8 | 2020-06-03 | Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelector… |
CVE-2020-13596 | Medium | 6.1 | 2020-06-03 | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properl… |
CVE-2020-13254 | Medium | 5.9 | 2020-06-03 | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed… |
CVE-2020-10749 | Medium | 6.0 | 2020-06-03 | A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perfo… |
CVE-2020-10516 | Critical | 9.8 | 2020-06-03 | An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gai… |
CVE-2020-7117 | High | 7.2 | 2020-06-03 | The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the ad… |
CVE-2020-7116 | High | 7.2 | 2020-06-03 | The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the ad… |
CVE-2020-7115 | Critical | 9.8 | 2020-06-03 | The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then ex… |