2020 CVEs (page 150)
Page 150 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6465 | Critical | 9.6 | 2020-05-21 | Use after free in reader mode in Google Chrome on Android prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2020-6464 | High | 8.8 | 2020-05-21 | Type confusion in Blink in Google Chrome prior to 81.0.4044.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6463 | High | 8.8 | 2020-05-21 | Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6462 | Critical | 9.6 | 2020-05-21 | Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2020-6461 | Critical | 9.6 | 2020-05-21 | Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2020-6460 | Medium | 6.5 | 2020-05-21 | Insufficient data validation in URL formatting in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to perform domain spoofing via a crafted domai… |
CVE-2020-6459 | High | 8.8 | 2020-05-21 | Use after free in payments in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6458 | High | 8.8 | 2020-05-21 | Out of bounds read and write in PDFium in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted P… |
CVE-2020-6457 | Critical | 9.6 | 2020-05-21 | Use after free in speech recognizer in Google Chrome prior to 81.0.4044.113 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2020-13252 | High | 8.8 | 2020-05-21 | Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.ph… |
CVE-2020-12647 | High | 8.8 | 2020-05-21 | Unisys ALGOL Compiler 58.1 before 58.1a.15, 59.1 before 59.1a.9, and 60.0 before 60.0a.5 can emit invalid code sequences under rare circumstances related to sy… |
CVE-2020-5365 | Medium | 5.3 | 2020-05-20 | Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, remotesupport, is bundled in the Dell EMC… |
CVE-2020-5364 | Medium | 5.3 | 2020-05-20 | Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability. The SNMPv2 services is enabled, by default, with a pre-configured community s… |
CVE-2020-9484 | High | 7.0 | 2020-05-20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the con… |
CVE-2020-13249 | High | 8.8 | 2020-05-20 | libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mari… |
CVE-2020-13241 | High | 7.8 | 2020-05-20 | Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extension (used with t… |
CVE-2020-13246 | High | 7.5 | 2020-05-20 | An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization… |
CVE-2020-11078 | Medium | 6.8 | 2020-05-20 | In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send addi… |
CVE-2020-13240 | Medium | 5.4 | 2020-05-20 | The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions… |
CVE-2020-13239 | Medium | 5.4 | 2020-05-20 | The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link… |
CVE-2020-5753 | Medium | 5.3 | 2020-05-20 | Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used… |
CVE-2020-3956 | High | 8.8 | 2020-05-20 | VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading t… |
CVE-2020-1955 | Critical | 9.8 | 2020-05-20 | CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_… |
CVE-2020-13231 | Medium | 6.5 | 2020-05-20 | In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change. |
CVE-2020-13230 | Medium | 4.3 | 2020-05-20 | In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs). |
CVE-2020-11716 | Critical | 9.8 | 2020-05-20 | Panasonic P110, Eluga Z1 Pro, Eluga X1, and Eluga X1 Pro devices through 2020-04-10 have Insecure Permissions. NOTE: the vendor states that all affected produc… |
CVE-2020-10726 | Medium | 6.0 | 2020-05-20 | A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_G… |
CVE-2020-10725 | High | 7.7 | 2020-05-20 | A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on t… |
CVE-2020-9410 | High | 7.3 | 2020-05-20 | The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Serv… |
CVE-2020-9409 | Critical | 9.8 | 2020-05-20 | The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Se… |
CVE-2020-4461 | Medium | 6.5 | 2020-05-20 | IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing id_token claims manipulation without verificatio… |
CVE-2020-13152 | Medium | 5.5 | 2020-05-20 | A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will trigger a memory leak, whereby Amarok 2.8… |
CVE-2020-12835 | Critical | 9.8 | 2020-05-20 | An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inj… |
CVE-2020-13226 | Critical | 9.8 | 2020-05-20 | WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intra… |
CVE-2020-5579 | High | 7.2 | 2020-05-20 | SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary SQL commands via uns… |
CVE-2020-13225 | Medium | 4.8 | 2020-05-20 | phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget. |
CVE-2020-9753 | Critical | 9.1 | 2020-05-20 | Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer. |
CVE-2020-12034 | High | 8.2 | 2020-05-20 | Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLi… |
CVE-2020-7139 | High | 8.1 | 2020-05-19 | Potential remote access security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker to access and modi… |
CVE-2020-7138 | High | 8.8 | 2020-05-19 | Potential remote code execution security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker to gain el… |
CVE-2020-7137 | Medium | 6.7 | 2020-05-19 | A validation issue in HPE Superdome Flex's RMC component may allow local elevation of privilege. Apply HPE Superdome Flex Server version 3.25.46 or later to re… |
CVE-2020-13164 | High | 7.5 | 2020-05-19 | In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in epan/dissectors/packet-nfs.c by prevent… |
CVE-2020-13163 | High | 7.4 | 2020-05-19 | em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The ho… |
CVE-2020-12038 | Medium | 5.5 | 2020-05-19 | Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLi… |
CVE-2020-7656 | Medium | 6.1 | 2020-05-19 | jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain… |
CVE-2020-2025 | High | 8.8 | 2020-05-19 | Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite t… |
CVE-2020-2024 | Medium | 6.5 | 2020-05-19 | An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown, a malicious guest can trick the kata-runti… |
CVE-2020-13167 | Critical | 9.8 | 2020-05-19 | Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command li… |
CVE-2020-13166 | Critical | 9.8 | 2020-05-19 | The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' install… |
CVE-2020-11766 | High | 8.8 | 2020-05-19 | sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticated Command Injection. |
CVE-2020-10724 | Medium | 5.1 | 2020-05-19 | A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing… |
CVE-2020-10723 | Medium | 5.1 | 2020-05-19 | A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain cir… |
CVE-2020-10722 | Medium | 5.1 | 2020-05-19 | A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memo… |
CVE-2020-11715 | Critical | 9.8 | 2020-05-19 | Panasonic P99 devices through 2020-04-10 have Incorrect Access Control. NOTE: the vendor states that all affected products are at "End-of-software-support." |
CVE-2020-10995 | High | 7.5 | 2020-05-19 | PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found… |
CVE-2020-11807 | High | 7.8 | 2020-05-19 | Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrary PHP code (and som… |
CVE-2020-10135 | Medium | 5.4 | 2020-05-19 | Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to compl… |
CVE-2020-10134 | Medium | 6.3 | 2020-05-19 | Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjacent access when the… |
CVE-2020-10030 | High | 8.8 | 2020-05-19 | An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker (with enough privileges to change the system's hostname) to… |
CVE-2020-8021 | Medium | 5.3 | 2020-05-19 | a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disab… |
CVE-2020-1695 | High | 7.5 | 2020-05-19 | A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation… |
CVE-2020-11845 | Medium | 6.1 | 2020-05-19 | Cross Site Scripting vulnerability in Micro Focus Service Manager product. Affecting versions 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, 9.63. The vulnerability could… |
CVE-2020-8617 | High | 7.5 | 2020-05-19 | Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesse… |
CVE-2020-8616 | High | 8.6 | 2020-05-19 | A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the us… |
CVE-2020-6956 | Medium | 6.1 | 2020-05-19 | PCS DEXICON 3.4.1 allows XSS via the loginName parameter in login_action.jsp. |
CVE-2020-4412 | Medium | 5.3 | 2020-05-19 | The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service security vulnerability. An att… |
CVE-2020-4411 | High | 7.1 | 2020-05-19 | The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service vulnerability in its kernel mo… |
CVE-2020-4298 | Medium | 5.4 | 2020-05-19 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod… |
CVE-2020-4286 | Medium | 6.5 | 2020-05-19 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unaut… |
CVE-2020-12663 | High | 7.5 | 2020-05-19 | Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. |
CVE-2020-12662 | High | 7.5 | 2020-05-19 | Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in N… |
CVE-2020-12244 | High | 7.5 | 2020-05-19 | An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly va… |
CVE-2020-8434 | Critical | 9.8 | 2020-05-19 | Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a determ… |
CVE-2020-12667 | High | 7.5 | 2020-05-19 | Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka an "NXNSAttack" issue. This is trigger… |
CVE-2020-1897 | Critical | 9.8 | 2020-05-18 | A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific… |
CVE-2020-13154 | Medium | 6.5 | 2020-05-18 | Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectio… |
CVE-2020-13153 | Medium | 6.1 | 2020-05-18 | app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view. |
CVE-2020-13094 | Medium | 5.4 | 2020-05-18 | Dolibarr before 11.0.4 allows XSS. |
CVE-2020-13149 | High | 7.8 | 2020-05-18 | Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center before 2.6.2003.2401, shipped with Micro-Star MSI Gaming laptops, allows loca… |
CVE-2020-13146 | High | 8.8 | 2020-05-18 | Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the "Cours… |
CVE-2020-13145 | Medium | 5.4 | 2020-05-18 | Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "Content>File Uploads" screen. These files can contain JavaScript code and thus lead t… |
CVE-2020-13144 | High | 8.8 | 2020-05-18 | Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component… |
CVE-2020-13143 | Medium | 6.5 | 2020-05-18 | gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an… |
CVE-2020-8034 | Medium | 6.1 | 2020-05-18 | Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability… |
CVE-2020-6093 | Medium | 5.5 | 2020-05-18 | An exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A specially crafted PDF document can cause… |
CVE-2020-6092 | High | 7.8 | 2020-05-18 | An exploitable code execution vulnerability exists in the way Nitro Pro 13.9.1.155 parses Pattern objects. A specially crafted PDF file can trigger an integer… |
CVE-2020-6074 | High | 8.8 | 2020-05-18 | An exploitable code execution vulnerability exists in the PDF parser of Nitro Pro 13.9.1.155. A specially crafted PDF document can cause a use-after-free which… |
CVE-2020-13136 | High | 7.5 | 2020-05-18 | D-Link DSP-W215 1.26b03 devices send an obfuscated hash that can be retrieved and understood by a network sniffer. |
CVE-2020-13135 | Medium | 6.5 | 2020-05-18 | D-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the local network, as demonstrated by a Squid Proxy. |
CVE-2020-11551 | High | 8.8 | 2020-05-18 | An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-B… |
CVE-2020-11550 | Medium | 6.5 | 2020-05-18 | An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-B… |
CVE-2020-11549 | High | 8.8 | 2020-05-18 | An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-B… |
CVE-2020-8035 | Medium | 6.1 | 2020-05-18 | The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image… |
CVE-2020-12801 | Medium | 5.3 | 2020-05-18 | If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and pr… |
CVE-2020-12256 | Medium | 5.4 | 2020-05-18 | rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary Java… |
CVE-2020-12255 | High | 8.8 | 2020-05-18 | rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file upload by chec… |
CVE-2020-10967 | Medium | 5.3 | 2020-05-18 | In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart. |
CVE-2020-9524 | Medium | 5.4 | 2020-05-18 | Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8. The v… |
CVE-2020-12258 | Critical | 9.1 | 2020-05-18 | rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Als… |
CVE-2020-12257 | High | 8.8 | 2020-05-18 | rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token. An attacker can lever… |