2020 CVEs (page 147)
Page 147 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-8816 | High | 7.2 | 2020-05-29 | Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. |
CVE-2020-1798 | Medium | 4.6 | 2020-05-29 | HUAWEI P30 smartphones with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. A logic error occurs when handling NF… |
CVE-2020-11041 | Low | 2.2 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse… |
CVE-2020-11039 | High | 8.0 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to i… |
CVE-2020-11038 | Medium | 6.9 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the cli… |
CVE-2020-11019 | Medium | 4.3 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a read of an invalid a… |
CVE-2020-12493 | Critical | 10.0 | 2020-05-29 | An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via netw… |
CVE-2020-13634 | High | 7.8 | 2020-05-29 | In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or… |
CVE-2020-11018 | Medium | 6.5 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causi… |
CVE-2020-12675 | High | 8.8 | 2020-05-29 | The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation… |
CVE-2020-11017 | Medium | 6.5 | 2020-05-29 | In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixe… |
CVE-2020-4490 | Medium | 6.1 | 2020-05-29 | IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, c… |
CVE-2020-4352 | High | 7.0 | 2020-05-29 | IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when running in restricted mode. IBM X-Force ID: 178427. |
CVE-2020-4306 | Medium | 5.4 | 2020-05-29 | IBM Planning Analytics Local 2.0.0 through 2.0.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2020-5573 | Medium | 4.6 | 2020-05-29 | Android App 'kintone mobile for Android' 1.0.0 to 2.5 allows an attacker to obtain credential information registered in the product via unspecified vectors. |
CVE-2020-5572 | Medium | 4.6 | 2020-05-29 | Android App 'Mailwise for Android' 1.0.0 to 1.0.1 allows an attacker to obtain credential information registered in the product via unspecified vectors. |
CVE-2020-13693 | Critical | 9.8 | 2020-05-29 | An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. |
CVE-2020-13173 | High | 7.8 | 2020-05-28 | Initialization of the pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows versions 19.11.1 and earlier… |
CVE-2020-11082 | Medium | 6.4 | 2020-05-28 | In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed… |
CVE-2020-5357 | High | 7.1 | 2020-05-28 | Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerabili… |
CVE-2020-13660 | Medium | 4.8 | 2020-05-28 | CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. |
CVE-2020-13245 | Medium | 5.9 | 2020-05-28 | Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, and possibly R6120, R… |
CVE-2020-11079 | High | 8.6 | 2020-05-28 | node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the libr… |
CVE-2020-8330 | Medium | 5.3 | 2020-05-28 | A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user s… |
CVE-2020-8329 | Medium | 5.3 | 2020-05-28 | A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user s… |
CVE-2020-4248 | Low | 2.7 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message i… |
CVE-2020-4419 | Medium | 5.4 | 2020-05-28 | IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4249 | Medium | 6.5 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could disclose highly sensitive information to other authenticated users on the sytem due to incorrect… |
CVE-2020-4246 | High | 7.1 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2020-4245 | High | 7.5 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 does not require that users should have strong passwords by default, which makes it easier for attacker… |
CVE-2020-4244 | Medium | 5.3 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive information through user enumeration. IBM X-Force… |
CVE-2020-4233 | Medium | 5.3 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure… |
CVE-2020-4232 | High | 7.5 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which could be used to a… |
CVE-2020-4231 | Medium | 6.5 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an authenticated user to perform unauthorized commands due to hazardous input validation. I… |
CVE-2020-13649 | High | 7.5 | 2020-05-28 | parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scanner_reverse_info_list NULL poin… |
CVE-2020-13362 | Low | 3.2 | 2020-05-28 | In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. |
CVE-2020-7812 | High | 7.8 | 2020-05-28 | Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary… |
CVE-2020-13361 | Low | 3.9 | 2020-05-28 | In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out… |
CVE-2020-11950 | High | 8.8 | 2020-05-28 | VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execute a script (with r… |
CVE-2020-11949 | Medium | 6.5 | 2020-05-28 | testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user t… |
CVE-2020-13645 | Medium | 6.5 | 2020-05-28 | In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the applicat… |
CVE-2020-13644 | Medium | 5.4 | 2020-05-28 | An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authent… |
CVE-2020-13643 | High | 8.8 | 2020-05-28 | An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing… |
CVE-2020-13642 | High | 8.8 | 2020-05-28 | An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verificati… |
CVE-2020-13641 | High | 8.8 | 2020-05-28 | An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, a… |
CVE-2020-8606 | Critical | 9.8 | 2020-05-27 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Tr… |
CVE-2020-8605 | High | 8.8 | 2020-05-27 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Aut… |
CVE-2020-8604 | High | 7.5 | 2020-05-27 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installati… |
CVE-2020-8603 | Medium | 6.1 | 2020-05-27 | A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web inter… |
CVE-2020-11075 | High | 7.7 | 2020-05-27 | In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the ancho… |
CVE-2020-11059 | Critical | 9.6 | 2020-05-27 | In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle… |
CVE-2020-10936 | High | 7.8 | 2020-05-27 | Sympa before 6.2.56 allows privilege escalation. |
CVE-2020-6774 | Critical | 9.3 | 2020-05-27 | Improper Access Control in the Kiosk Mode functionality of Bosch Recording Station allows a local unauthenticated attacker to escape from the Kiosk Mode and ac… |
CVE-2020-13633 | Medium | 6.1 | 2020-05-27 | Fork before 5.8.3 allows XSS via navigation_title or title. |
CVE-2020-13628 | Medium | 6.1 | 2020-05-27 | Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolb… |
CVE-2020-13627 | Medium | 6.1 | 2020-05-27 | Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/in… |
CVE-2020-10946 | Medium | 6.1 | 2020-05-27 | Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index… |
CVE-2020-10945 | Medium | 4.3 | 2020-05-27 | Centreon before 19.10.7 exposes Session IDs in server responses. |
CVE-2020-13632 | Medium | 5.5 | 2020-05-27 | ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. |
CVE-2020-13631 | Medium | 5.5 | 2020-05-27 | SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. |
CVE-2020-13630 | High | 7.0 | 2020-05-27 | ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. |
CVE-2020-13253 | Medium | 5.5 | 2020-05-27 | sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can c… |
CVE-2020-4379 | High | 7.5 | 2020-05-27 | IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |
CVE-2020-4378 | Medium | 4.9 | 2020-05-27 | IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to perform unauthorized actions using a specially crated HTTP POST comma… |
CVE-2020-4358 | Medium | 5.4 | 2020-05-27 | IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2020-4357 | Medium | 4.3 | 2020-05-27 | IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2020-4350 | High | 7.5 | 2020-05-27 | IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |
CVE-2020-4349 | High | 7.5 | 2020-05-27 | IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |
CVE-2020-4348 | Medium | 6.5 | 2020-05-27 | IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized actions due to missing fu… |
CVE-2020-4226 | High | 7.5 | 2020-05-27 | IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to information disclosure if unauthorized part… |
CVE-2020-13386 | High | 7.3 | 2020-05-27 | In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated Users group on the SmartDraw 2020 installation folder. Additio… |
CVE-2020-10737 | Medium | 6.3 | 2020-05-27 | A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhome… |
CVE-2020-13623 | High | 7.5 | 2020-05-27 | JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation. |
CVE-2020-13622 | High | 7.5 | 2020-05-27 | JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data. |
CVE-2020-13616 | Medium | 5.9 | 2020-05-26 | The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification. |
CVE-2020-13615 | Medium | 5.9 | 2020-05-26 | lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates. |
CVE-2020-13614 | Medium | 5.9 | 2020-05-26 | An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification. |
CVE-2020-9046 | High | 8.8 | 2020-05-26 | A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by… |
CVE-2020-6831 | Critical | 9.8 | 2020-05-26 | A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash… |
CVE-2020-6830 | High | 7.5 | 2020-05-26 | For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used… |
CVE-2020-12392 | Medium | 5.5 | 2020-05-26 | The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user… |
CVE-2020-12391 | High | 7.5 | 2020-05-26 | Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should hav… |
CVE-2020-12390 | Critical | 9.8 | 2020-05-26 | Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76. |
CVE-2020-12389 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2020-12388 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2020-12387 | High | 8.1 | 2020-05-26 | A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulner… |
CVE-2020-12396 | Critical | 9.8 | 2020-05-26 | Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2020-12395 | Critical | 9.8 | 2020-05-26 | Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory c… |
CVE-2020-12394 | Low | 3.3 | 2020-05-26 | A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing… |
CVE-2020-12393 | High | 7.8 | 2020-05-26 | The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user use… |
CVE-2020-8171 | Critical | 9.8 | 2020-05-26 | We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prio… |
CVE-2020-8170 | Medium | 6.1 | 2020-05-26 | We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prio… |
CVE-2020-8168 | High | 8.8 | 2020-05-26 | We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prio… |
CVE-2020-10719 | Medium | 6.5 | 2020-05-26 | A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an atta… |
CVE-2020-10751 | Medium | 6.1 | 2020-05-26 | A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single… |
CVE-2020-13487 | Medium | 4.8 | 2020-05-26 | The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=f… |
CVE-2020-3812 | Medium | 5.5 | 2020-05-26 | qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories… |
CVE-2020-3811 | High | 7.5 | 2020-05-26 | qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability. |
CVE-2020-13486 | Medium | 6.1 | 2020-05-25 | The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection. |
CVE-2020-13485 | Critical | 9.1 | 2020-05-25 | The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header. |