2020 CVEs (page 148)
Page 148 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13482 | High | 7.4 | 2020-05-25 | EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the libra… |
CVE-2020-13459 | Medium | 5.4 | 2020-05-25 | An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action. |
CVE-2020-13458 | High | 8.8 | 2020-05-25 | An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action. |
CVE-2020-13442 | Critical | 9.8 | 2020-05-25 | A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An attacker can upload a PHP file via dext5handler.jsp handler becaus… |
CVE-2020-5537 | Critical | 9.8 | 2020-05-25 | Cybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors. |
CVE-2020-13440 | Medium | 6.5 | 2020-05-24 | ffjpeg through 2020-02-24 has an invalid write in bmp_load in bmp.c. |
CVE-2020-13439 | Medium | 6.5 | 2020-05-24 | ffjpeg through 2020-02-24 has a heap-based buffer over-read in jfif_decode in jfif.c. |
CVE-2020-13438 | Medium | 6.5 | 2020-05-24 | ffjpeg through 2020-02-24 has an invalid read in jfif_encode in jfif.c. |
CVE-2020-13435 | Medium | 5.5 | 2020-05-24 | SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. |
CVE-2020-13434 | Medium | 5.5 | 2020-05-24 | SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. |
CVE-2020-13433 | Critical | 9.8 | 2020-05-24 | Jason2605 AdminPanel 4.0 allows SQL Injection via the editPlayer.php hidden parameter. |
CVE-2020-13430 | Medium | 6.1 | 2020-05-24 | Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. |
CVE-2020-13429 | Medium | 5.4 | 2020-05-24 | legend.ts in the piechart-panel (aka Pie Chart Panel) plugin before 1.5.0 for Grafana allows XSS via the Values Header (aka legend header) option. |
CVE-2020-13425 | High | 7.1 | 2020-05-23 | TrackR devices through 2020-05-06 allow attackers to trigger the Beep (aka alarm) feature, which will eventually cause a denial of service when battery capacit… |
CVE-2020-13424 | Medium | 6.5 | 2020-05-23 | The XCloner component before 3.5.4 for Joomla! allows Authenticated Local File Disclosure. |
CVE-2020-13417 | Critical | 9.8 | 2020-05-22 | An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS… |
CVE-2020-13416 | Medium | 6.5 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens… |
CVE-2020-13415 | High | 7.5 | 2020-05-22 | An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity Provider can establish a connection (e… |
CVE-2020-13414 | High | 7.5 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software. |
CVE-2020-13413 | Medium | 5.3 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user… |
CVE-2020-13412 | High | 8.8 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token check to control access, leading to CSR… |
CVE-2020-12397 | Medium | 4.3 | 2020-05-22 | By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerab… |
CVE-2020-13398 | High | 8.3 | 2020-05-22 | An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto… |
CVE-2020-13397 | Medium | 5.5 | 2020-05-22 | An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/securi… |
CVE-2020-13396 | High | 7.1 | 2020-05-22 | An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/ss… |
CVE-2020-13394 | Critical | 9.8 | 2020-05-22 | An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD… |
CVE-2020-13393 | Critical | 9.8 | 2020-05-22 | An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD… |
CVE-2020-13392 | Critical | 9.8 | 2020-05-22 | An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD… |
CVE-2020-13391 | Critical | 9.8 | 2020-05-22 | An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD… |
CVE-2020-13390 | Critical | 9.8 | 2020-05-22 | An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD… |
CVE-2020-13389 | Critical | 9.8 | 2020-05-22 | An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD… |
CVE-2020-13388 | Critical | 9.8 | 2020-05-22 | An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with… |
CVE-2020-7658 | Medium | 6.1 | 2020-05-22 | meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Conten… |
CVE-2020-11077 | Medium | 6.8 | 2020-05-22 | In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown clien… |
CVE-2020-11076 | High | 7.5 | 2020-05-22 | In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed… |
CVE-2020-10711 | Medium | 5.9 | 2020-05-22 | A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Se… |
CVE-2020-8789 | Medium | 5.4 | 2020-05-22 | Composr 10.0.30 allows Persistent XSS via a Usergroup name under the Security configuration. |
CVE-2020-7813 | High | 7.8 | 2020-05-22 | Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download and execu… |
CVE-2020-6091 | Critical | 9.1 | 2020-05-22 | An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303… |
CVE-2020-1956 | High | 8.8 | 2020-05-22 | Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to… |
CVE-2020-3344 | Medium | 5.5 | 2020-05-22 | A vulnerability in Cisco AMP for Endpoints Linux Connector Software and Cisco AMP for Endpoints Mac Connector Software could allow an authenticated, local atta… |
CVE-2020-3343 | Medium | 5.5 | 2020-05-22 | A vulnerability in Cisco AMP for Endpoints Linux Connector Software and Cisco AMP for Endpoints Mac Connector Software could allow an authenticated, local atta… |
CVE-2020-3314 | Medium | 6.1 | 2020-05-22 | A vulnerability in the file scan process of Cisco AMP for Endpoints Mac Connector Software could cause the scan engine to crash during the scan of local files… |
CVE-2020-3280 | Critical | 9.8 | 2020-05-22 | A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker t… |
CVE-2020-3272 | High | 7.5 | 2020-05-22 | A vulnerability in the DHCP server of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conditio… |
CVE-2020-3184 | High | 7.2 | 2020-05-22 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning Software could allow an authenticated, remote attacker to condu… |
CVE-2020-13384 | High | 8.8 | 2020-05-22 | Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php fil… |
CVE-2020-1195 | Medium | 5.9 | 2020-05-21 | An elevation of privilege vulnerability exists in Microsoft Edge (Chromium-based) when the Feedback extension improperly validates input, aka 'Microsoft Edge (… |
CVE-2020-1192 | High | 7.8 | 2020-05-21 | A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file, aka 'Visual Studio… |
CVE-2020-1191 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1190 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1189 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1188 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1187 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1186 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1185 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1184 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1179 | Medium | 6.5 | 2020-05-21 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2020-1176 | High | 7.8 | 2020-05-21 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2020-1175 | High | 7.8 | 2020-05-21 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2020-1174 | High | 7.8 | 2020-05-21 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2020-1173 | Medium | 6.8 | 2020-05-21 | A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments, aka 'Microsoft Power BI R… |
CVE-2020-1171 | High | 8.8 | 2020-05-21 | A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project, aka 'Visual Stu… |
CVE-2020-1166 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Clipboard Service, aka 'Windows Clipboard Service Elevation of Privileg… |
CVE-2020-1165 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Clipboard Service, aka 'Windows Clipboard Service Elevation of Privileg… |
CVE-2020-1164 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1161 | High | 7.5 | 2020-05-21 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. |
CVE-2020-1158 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1157 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1156 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1155 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1154 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common… |
CVE-2020-1153 | High | 7.8 | 2020-05-21 | A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote… |
CVE-2020-1151 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1150 | High | 7.8 | 2020-05-21 | A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil… |
CVE-2020-1149 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1145 | Medium | 5.5 | 2020-05-21 | An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to r… |
CVE-2020-1144 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1143 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation… |
CVE-2020-1142 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, aka 'Windows GDI Elevatio… |
CVE-2020-1141 | Medium | 5.5 | 2020-05-21 | An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to r… |
CVE-2020-1140 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'. |
CVE-2020-1139 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1138 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Elevation of Privilege… |
CVE-2020-1137 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in the way the Windows Push Notification Service handles objects in memory, aka 'Windows Push Notification Servi… |
CVE-2020-1136 | High | 7.8 | 2020-05-21 | A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil… |
CVE-2020-1135 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevat… |
CVE-2020-1134 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1132 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles file and folder links, aka 'Windows Error Reporting Mana… |
CVE-2020-1131 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1126 | High | 8.8 | 2020-05-21 | A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil… |
CVE-2020-1125 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1124 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Se… |
CVE-2020-1123 | Medium | 5.5 | 2020-05-21 | A denial of service vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Connected User Experien… |
CVE-2020-1121 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Clipboard Service, aka 'Windows Clipboard Service Elevation of Privileg… |
CVE-2020-1118 | High | 7.5 | 2020-05-21 | A denial of service vulnerability exists in the Windows implementation of Transport Layer Security (TLS) when it improperly handles certain key exchanges, aka… |
CVE-2020-1117 | High | 8.8 | 2020-05-21 | A remote code execution vulnerability exists in the way that the Color Management Module (ICM32.dll) handles objects in memory, aka 'Microsoft Color Management… |
CVE-2020-1116 | Medium | 5.5 | 2020-05-21 | An information disclosure vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in memory, aka 'Windo… |
CVE-2020-1114 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2020-1113 | High | 7.5 | 2020-05-21 | A security feature bypass vulnerability exists in Microsoft Windows when the Task Scheduler service fails to properly verify client connections over RPC, aka '… |