2020 CVEs (page 149)
Page 149 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-1112 | Critical | 9.9 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) IIS module improperly handles uploaded content… |
CVE-2020-1111 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Clipboard Service, aka 'Windows Clipboard Service Elevation of Privileg… |
CVE-2020-1110 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Update Stack fails to properly handle objects in memory, aka 'Windows Update Stack Elevation of… |
CVE-2020-1109 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Update Stack fails to properly handle objects in memory, aka 'Windows Update Stack Elevation of… |
CVE-2020-1108 | High | 7.5 | 2020-05-21 | A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vu… |
CVE-2020-1107 | Medium | 5.4 | 2020-05-21 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, a… |
CVE-2020-1106 | Medium | 6.1 | 2020-05-21 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2020-1105 | Medium | 5.4 | 2020-05-21 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, a… |
CVE-2020-1104 | Medium | 5.4 | 2020-05-21 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, a… |
CVE-2020-1103 | Medium | 6.5 | 2020-05-21 | An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search at… |
CVE-2020-1102 | High | 8.8 | 2020-05-21 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso… |
CVE-2020-1101 | Medium | 5.4 | 2020-05-21 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2020-1100 | Medium | 5.4 | 2020-05-21 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2020-1099 | Medium | 5.4 | 2020-05-21 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2020-1096 | High | 7.5 | 2020-05-21 | A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF Remote Code Execution… |
CVE-2020-1093 | High | 7.5 | 2020-05-21 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'… |
CVE-2020-1092 | High | 7.5 | 2020-05-21 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerabili… |
CVE-2020-1090 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1088 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of… |
CVE-2020-1087 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnera… |
CVE-2020-1086 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1084 | Medium | 5.5 | 2020-05-21 | A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values.An attacker who succes… |
CVE-2020-1082 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of… |
CVE-2020-1081 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers, aka 'Windows Pri… |
CVE-2020-1079 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows fails to properly handle objects in memory, aka 'Microsoft Windows Elevation of Privilege Vulne… |
CVE-2020-1078 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operations.To exploit the v… |
CVE-2020-1077 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulne… |
CVE-2020-1076 | Medium | 5.5 | 2020-05-21 | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. |
CVE-2020-1075 | Medium | 5.5 | 2020-05-21 | An information disclosure vulnerability exists when Windows Subsystem for Linux improperly handles objects in memory, aka 'Windows Subsystem for Linux Informat… |
CVE-2020-1072 | Medium | 5.5 | 2020-05-21 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2020-1071 | Medium | 6.8 | 2020-05-21 | An elevation of privilege vulnerability exists when Windows improperly handles errors tied to Remote Access Common Dialog, aka 'Windows Remote Access Common Di… |
CVE-2020-1070 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Prin… |
CVE-2020-1069 | High | 8.8 | 2020-05-21 | A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Mic… |
CVE-2020-1068 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in Windows Media Service that allows file creation in arbitrary locations.To exploit the vulnerability, an attac… |
CVE-2020-1067 | High | 8.8 | 2020-05-21 | A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka 'Windows Remote Code Execution Vulnerability'. |
CVE-2020-1066 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level.To exploit the vulnerability, a… |
CVE-2020-1065 | High | 7.5 | 2020-05-21 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption… |
CVE-2020-1064 | High | 7.5 | 2020-05-21 | A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input.An attacker could execute arbitrary code in the conte… |
CVE-2020-1063 | Medium | 5.4 | 2020-05-21 | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected… |
CVE-2020-1062 | High | 7.5 | 2020-05-21 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerabili… |
CVE-2020-1061 | High | 8.8 | 2020-05-21 | A remote code execution vulnerability exists in the way that the Microsoft Script Runtime handles objects in memory, aka 'Microsoft Script Runtime Remote Code… |
CVE-2020-1060 | High | 7.5 | 2020-05-21 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'… |
CVE-2020-1059 | Medium | 4.3 | 2020-05-21 | A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka 'Microsoft Edge Spoofing Vulnerability'. |
CVE-2020-1058 | High | 7.5 | 2020-05-21 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'… |
CVE-2020-1056 | High | 8.1 | 2020-05-21 | An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access inf… |
CVE-2020-1055 | Medium | 6.1 | 2020-05-21 | A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs, aka 'Microsoft Activ… |
CVE-2020-1054 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation… |
CVE-2020-1051 | High | 7.8 | 2020-05-21 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2020-1048 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Prin… |
CVE-2020-1037 | High | 7.5 | 2020-05-21 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Chakra… |
CVE-2020-1035 | High | 7.5 | 2020-05-21 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'… |
CVE-2020-1028 | High | 7.8 | 2020-05-21 | A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil… |
CVE-2020-1024 | High | 8.8 | 2020-05-21 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso… |
CVE-2020-1023 | High | 8.8 | 2020-05-21 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso… |
CVE-2020-1021 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of… |
CVE-2020-1010 | High | 7.8 | 2020-05-21 | An elevation of privilege vulnerability exists in Windows Block Level Backup Engine Service (wbengine) that allows file deletion in arbitrary locations.To expl… |
CVE-2020-12693 | High | 8.1 | 2020-05-21 | Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate P… |
CVE-2020-0963 | Medium | 6.5 | 2020-05-21 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2020-0909 | High | 7.5 | 2020-05-21 | A denial of service vulnerability exists when Hyper-V on a Windows Server fails to properly handle specially crafted network packets.To exploit the vulnerabili… |
CVE-2020-0901 | Critical | 9.8 | 2020-05-21 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
CVE-2020-7808 | High | 8.7 | 2020-05-21 | In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments… |
CVE-2020-13258 | Medium | 6.1 | 2020-05-21 | Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py. |
CVE-2020-13113 | High | 8.2 | 2020-05-21 | An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free con… |
CVE-2020-12828 | Critical | 9.8 | 2020-05-21 | An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations over a socket bound to localhost. Bindin… |
CVE-2020-12431 | Medium | 6.6 | 2020-05-21 | A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe al… |
CVE-2020-13114 | High | 7.5 | 2020-05-21 | An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of comp… |
CVE-2020-13112 | Critical | 9.1 | 2020-05-21 | An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This i… |
CVE-2020-10738 | High | 7.5 | 2020-05-21 | A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible… |
CVE-2020-9069 | Medium | 6.5 | 2020-05-21 | There is an information leakage vulnerability in some Huawei products. An unauthenticated, adjacent attacker could exploit this vulnerability to decrypt data… |
CVE-2020-9045 | Critical | 9.9 | 2020-05-21 | During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used… |
CVE-2020-8572 | High | 7.5 | 2020-05-21 | Element OS prior to version 12.0 and Element HealthTools prior to version 2020.04.01.04 are susceptible to a vulnerability which when successfully exploited co… |
CVE-2020-7655 | Medium | 6.1 | 2020-05-21 | netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transf… |
CVE-2020-5752 | High | 7.8 | 2020-05-21 | Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTE… |
CVE-2020-1799 | High | 7.5 | 2020-05-21 | E6878-370 with versions of 10.0.3.1(H557SP27C233), 10.0.3.1(H563SP1C00), 10.0.3.1(H563SP1C233) has a use after free vulnerability. The software references memo… |
CVE-2020-6491 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in site information in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted domain nam… |
CVE-2020-6490 | Medium | 4.3 | 2020-05-21 | Insufficient data validation in loader in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had been able to write to disk to leak cross-origin… |
CVE-2020-6489 | Medium | 4.3 | 2020-05-21 | Inappropriate implementation in developer tools in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had convinced the user to take certain act… |
CVE-2020-6488 | Medium | 4.3 | 2020-05-21 | Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2020-6487 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2020-6486 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in navigations in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2020-6485 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in media router in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2020-6484 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in ChromeDriver in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted r… |
CVE-2020-6483 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HT… |
CVE-2020-6482 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6481 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in URL formatting in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to perform domain spoofing via a crafted dom… |
CVE-2020-6480 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in enterprise in Google Chrome prior to 83.0.4103.61 allowed a local attacker to bypass navigation restrictions via UI actions. |
CVE-2020-6479 | Medium | 6.5 | 2020-05-21 | Inappropriate implementation in sharing in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6478 | Medium | 6.5 | 2020-05-21 | Inappropriate implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6477 | High | 7.8 | 2020-05-21 | Inappropriate implementation in installer in Google Chrome on OS X prior to 83.0.4103.61 allowed a local attacker to perform privilege escalation via a crafted… |
CVE-2020-6476 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2020-6475 | Medium | 6.5 | 2020-05-21 | Incorrect implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6474 | High | 8.8 | 2020-05-21 | Use after free in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6473 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to obtain potentially sensitive information from proc… |
CVE-2020-6472 | Medium | 6.5 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6471 | Critical | 9.6 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6470 | Medium | 6.1 | 2020-05-21 | Insufficient validation of untrusted input in clipboard in Google Chrome prior to 83.0.4103.61 allowed a local attacker to inject arbitrary scripts or HTML (UX… |
CVE-2020-6469 | Critical | 9.6 | 2020-05-21 | Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-6468 | High | 8.8 | 2020-05-21 | Type confusion in V8 in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6467 | High | 8.8 | 2020-05-21 | Use after free in WebRTC in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6466 | Critical | 9.6 | 2020-05-21 | Use after free in media in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |