2020 CVEs (page 15)
Page 15 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-25193 | Medium | 5.3 | 2022-03-18 | By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers woul… |
CVE-2020-25184 | High | 7.8 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x stores the password in plaintext in a file that is in the same directory as the executable file. ISaGR… |
CVE-2020-25182 | Medium | 6.7 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allo… |
CVE-2020-25180 | Medium | 5.3 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The… |
CVE-2020-25178 | High | 7.5 | 2022-03-18 | ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file sy… |
CVE-2020-25176 | Critical | 9.1 | 2022-03-18 | Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file sy… |
CVE-2020-16232 | Low | 2.8 | 2022-03-18 | In Yokogawa WideField3 R1.01 - R4.03, a buffer overflow could be caused when a user loads a maliciously crafted project file. |
CVE-2020-15388 | Medium | 6.5 | 2022-03-18 | A vulnerability in the Brocade Fabric OS before Brocade Fabric OS v9.0.1a, v8.2.3, v8.2.0_CBN4, and v7.4.2h could allow an authenticated CLI user to abuse the… |
CVE-2020-15591 | Critical | 9.8 | 2022-03-17 | fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution). |
CVE-2020-25721 | High | 8.8 | 2022-03-16 | Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to obtain a reliable S… |
CVE-2020-36519 | Medium | 4.9 | 2022-03-16 | Mimecast Email Security before 2020-01-10 allows any admin to spoof any domain, and pass DMARC alignment via SPF. This occurs through misuse of the address rew… |
CVE-2020-4989 | Medium | 4.3 | 2022-03-15 | IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 and IBM Rational Team Concert 6.0.6 and 6.0.0.1 could allow an authenticated user to obtain sensitive… |
CVE-2020-36518 | High | 7.5 | 2022-03-11 | jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. |
CVE-2020-36517 | High | 7.5 | 2022-03-10 | An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal n… |
CVE-2020-14115 | Critical | 9.8 | 2022-03-10 | A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attacker… |
CVE-2020-14112 | Medium | 5.3 | 2022-03-10 | Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. Attackers can exploit this v… |
CVE-2020-14111 | High | 7.8 | 2022-03-10 | A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attacker… |
CVE-2020-18327 | Medium | 6.1 | 2022-03-04 | Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowse… |
CVE-2020-18326 | High | 8.8 | 2022-03-04 | Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unaut… |
CVE-2020-18325 | Medium | 6.1 | 2022-03-04 | Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. |
CVE-2020-18324 | Medium | 6.1 | 2022-03-04 | Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template. |
CVE-2020-15936 | Low | 2.6 | 2022-03-01 | A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows a… |
CVE-2020-4925 | Medium | 5.5 | 2022-03-01 | A security vulnerability in the Spectrum Scale 5.0 and 5.1 allows a non-root user to overflow the mmfsd daemon with requests and preventing the daemon to servi… |
CVE-2020-12775 | Critical | 9.8 | 2022-03-01 | Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attac… |
CVE-2020-22845 | High | 7.5 | 2022-02-28 | A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests. |
CVE-2020-22844 | High | 7.5 | 2022-02-28 | A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests. |
CVE-2020-36510 | Medium | 6.1 | 2022-02-28 | The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX action, lea… |
CVE-2020-27958 | Medium | 4.3 | 2022-02-26 | The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to provide crafted inpu… |
CVE-2020-36516 | Medium | 5.9 | 2022-02-26 | An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path att… |
CVE-2020-14504 | Medium | 5.3 | 2022-02-24 | The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafte… |
CVE-2020-14502 | Medium | 6.1 | 2022-02-24 | The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker could store a malicious script within… |
CVE-2020-14481 | High | 7.8 | 2022-02-24 | The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authenticated attacker to decipher user credential… |
CVE-2020-14480 | Medium | 5.5 | 2022-02-24 | Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker could gain access to certain credentials, i… |
CVE-2020-14478 | High | 7.1 | 2022-02-24 | A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A succe… |
CVE-2020-10640 | Critical | 10.0 | 2022-02-24 | Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a… |
CVE-2020-10636 | Medium | 6.5 | 2022-02-24 | Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained. |
CVE-2020-10635 | Medium | 4.3 | 2022-02-24 | Simulation models for KUKA.Sim Pro version 3.1 are hosted by a server maintained by KUKA. When these devices request a model, the server transmits the model in… |
CVE-2020-10632 | High | 8.8 | 2022-02-24 | Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration files, which could ca… |
CVE-2020-27467 | High | 7.5 | 2022-02-24 | A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php. |
CVE-2020-8242 | High | 7.2 | 2022-02-18 | Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel… |
CVE-2020-25722 | High | 8.8 | 2022-02-18 | Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total dom… |
CVE-2020-25719 | High | 7.2 | 2022-02-18 | A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become conf… |
CVE-2020-25718 | High | 8.8 | 2022-02-18 | A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC… |
CVE-2020-25717 | High | 8.1 | 2022-02-18 | A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation. |
CVE-2020-8107 | High | 8.2 | 2022-02-18 | A Process Control vulnerability in ProductAgentUI.exe as used in Bitdefender Antivirus Plus allows an attacker to tamper with product settings via a specially… |
CVE-2020-6922 | High | 7.8 | 2022-02-16 | Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assist… |
CVE-2020-6921 | High | 7.8 | 2022-02-16 | Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assist… |
CVE-2020-6920 | Medium | 5.5 | 2022-02-16 | Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assist… |
CVE-2020-6919 | High | 7.8 | 2022-02-16 | Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assist… |
CVE-2020-6918 | High | 7.8 | 2022-02-16 | Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assist… |
CVE-2020-6917 | High | 7.8 | 2022-02-16 | Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assist… |
CVE-2020-26728 | Critical | 9.8 | 2022-02-11 | A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN which allows for remote code execution via shell m… |
CVE-2020-14523 | High | 8.3 | 2022-02-11 | Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code. |
CVE-2020-14521 | High | 8.3 | 2022-02-11 | Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use thi… |
CVE-2020-36062 | Critical | 9.8 | 2022-02-11 | Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if… |
CVE-2020-13677 | High | 7.5 | 2022-02-11 | Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. S… |
CVE-2020-13676 | Medium | 6.5 | 2022-02-11 | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affe… |
CVE-2020-13675 | Critical | 9.8 | 2022-02-11 | Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an acces… |
CVE-2020-13674 | Medium | 6.5 | 2022-02-11 | The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible da… |
CVE-2020-13673 | Medium | 6.1 | 2022-02-11 | The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user… |
CVE-2020-13672 | Medium | 6.1 | 2022-02-11 | Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issu… |
CVE-2020-13670 | High | 7.5 | 2022-02-11 | Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they… |
CVE-2020-13669 | Medium | 6.1 | 2022-02-11 | Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8… |
CVE-2020-13668 | Medium | 6.1 | 2022-02-11 | Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerab… |
CVE-2020-7534 | High | 8.8 | 2022-02-04 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on… |
CVE-2020-12966 | Medium | 5.5 | 2022-02-04 | AMD EPYC™ Processors contain an information disclosure vulnerability in the Secure Encrypted Virtualization with Encrypted State (SEV-ES) and Secure Encrypted… |
CVE-2020-12965 | High | 7.5 | 2022-02-04 | When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 address bits potentially… |
CVE-2020-12891 | High | 7.8 | 2022-02-04 | AMD Radeon Software may be vulnerable to DLL Hijacking through path variable. An unprivileged user may be able to drop its malicious DLL file in any location w… |
CVE-2020-5953 | High | 7.5 | 2022-02-03 | A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTI… |
CVE-2020-26208 | Medium | 5.3 | 2022-02-02 | JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions… |
CVE-2020-8562 | Low | 2.2 | 2022-02-01 | As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when… |
CVE-2020-36064 | Critical | 9.8 | 2022-01-31 | Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compro… |
CVE-2020-36056 | Medium | 5.4 | 2022-01-31 | Beetel 777VR1-DI Hardware Version REV.1.01 Firmware Version V01.00.09_55 was discovered to contain a cross-site scripting (XSS) vulnerability via the Ping diag… |
CVE-2020-25905 | Critical | 9.8 | 2022-01-28 | An SQL Injection vulnerabilty exists in Sourcecodester Mobile Shop System in PHP MySQL 1.0 via the email parameter in (1) login.php or (2) LoginAsAdmin.php. |
CVE-2020-28885 | High | 7.2 | 2022-01-28 | Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell modu… |
CVE-2020-28884 | High | 7.2 | 2022-01-28 | Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS comm… |
CVE-2020-17383 | Critical | 9.8 | 2022-01-24 | A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the device's file system… |
CVE-2020-4879 | Critical | 9.8 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication… |
CVE-2020-4877 | Critical | 9.8 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes. IBM X-Force ID: 19… |
CVE-2020-4876 | High | 8.2 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2020-4875 | High | 8.2 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2020-19861 | High | 7.5 | 2022-01-21 | When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is… |
CVE-2020-19860 | Medium | 6.5 | 2022-01-21 | When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read vulnerability. An attacker can leak infor… |
CVE-2020-19858 | High | 7.5 | 2022-01-21 | Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack victim by sending http://ip:port/../privacy.avi URL to… |
CVE-2020-23315 | High | 7.5 | 2022-01-20 | There is an ASSERTION (pFuncBody->GetYieldRegister() == oldYieldRegister) failed in Js::DebugContext::RundownSourcesAndReparse in ChakraCore version 1.12.0.0-b… |
CVE-2020-14110 | High | 7.8 | 2022-01-18 | AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background. |
CVE-2020-14107 | High | 7.5 | 2022-01-18 | A stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN. |
CVE-2020-28919 | Medium | 5.4 | 2022-01-15 | A stored cross site scripting (XSS) vulnerability in Checkmk 1.6.0x prior to 1.6.0p19 allows an authenticated remote attacker to inject arbitrary JavaScript vi… |
CVE-2020-28103 | Critical | 9.8 | 2022-01-11 | cscms v4.1 allows for SQL injection via the "page_del" function. |
CVE-2020-28102 | Critical | 9.8 | 2022-01-11 | cscms v4.1 allows for SQL injection via the "js_del" function. |
CVE-2020-25427 | Medium | 5.5 | 2022-01-10 | A Null pointer dereference vulnerability exits in MP4Box - GPAC version 0.8.0-rev177-g51a8ef874-master via the gf_isom_get_track_id function, which causes a de… |
CVE-2020-28679 | High | 8.8 | 2022-01-10 | A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to execute a SQL injectio… |
CVE-2020-9061 | Medium | 6.5 | 2022-01-10 | Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon… |
CVE-2020-9060 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, Zo… |
CVE-2020-9059 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption leading to battery exhaus… |
CVE-2020-9058 | High | 8.1 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome D… |
CVE-2020-9057 | High | 8.8 | 2022-01-10 | Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or… |
CVE-2020-29050 | High | 7.5 | 2022-01-10 | SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used f… |
CVE-2020-10137 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allowing a remote, unaut… |
CVE-2020-27428 | Medium | 6.1 | 2022-01-06 | A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3… |