2020 CVEs (page 154)
Page 154 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10916 | High | 8.0 | 2020-05-07 | This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Firmware Ver: 855rev4-up-ver1-0-1-P… |
CVE-2020-9475 | High | 7.0 | 2020-05-07 | The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows local privilege escalation via a race condition in logrotate. By using an exploit chain, an a… |
CVE-2020-9474 | High | 8.8 | 2020-05-07 | The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the backup functionality in the web frontend. By using an exploit c… |
CVE-2020-11056 | High | 7.4 | 2020-05-07 | In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lea… |
CVE-2020-11055 | Medium | 6.3 | 2020-05-07 | In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments… |
CVE-2020-11054 | Low | 3.5 | 2020-05-07 | In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qut… |
CVE-2020-11053 | High | 7.1 | 2020-05-07 | In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at… |
CVE-2020-11052 | High | 8.3 | 2020-05-07 | In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will preven… |
CVE-2020-11050 | Critical | 9.0 | 2020-05-07 | In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hos… |
CVE-2020-10795 | High | 7.2 | 2020-05-07 | Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to authenticated remote code execution via the backup functionality of the web frontend. This can be combined with CV… |
CVE-2020-10794 | Critical | 9.8 | 2020-05-07 | Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to unauthenticated path traversal that allows an attacker to download the application database. This can be combined… |
CVE-2020-10176 | Critical | 9.8 | 2020-05-07 | ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43_p1 devices allow Eval Injection of commands. |
CVE-2020-4430 | Medium | 4.3 | 2020-05-07 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send… |
CVE-2020-4429 | Critical | 9.8 | 2020-05-07 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could expl… |
CVE-2020-4428 | Critical | 9.1 | 2020-05-07 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 1… |
CVE-2020-4427 | Critical | 9.8 | 2020-05-07 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML auth… |
CVE-2020-12708 | Medium | 6.1 | 2020-05-07 | Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to d… |
CVE-2020-12707 | Medium | 6.1 | 2020-05-07 | An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the str… |
CVE-2020-12706 | Medium | 5.4 | 2020-05-07 | Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/f… |
CVE-2020-12705 | Medium | 6.1 | 2020-05-07 | Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0. |
CVE-2020-12704 | Medium | 6.1 | 2020-05-07 | UliCMS before 2020.2 has PageController stored XSS. |
CVE-2020-12703 | Medium | 6.1 | 2020-05-07 | UliCMS before 2020.2 has XSS during PackageController uninstall. |
CVE-2020-12116 | High | 7.5 | 2020-05-07 | Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the serve… |
CVE-2020-11049 | Medium | 5.5 | 2020-05-07 | In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2… |
CVE-2020-11048 | Low | 2.2 | 2020-05-07 | In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed i… |
CVE-2020-11047 | Medium | 5.5 | 2020-05-07 | In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 byte… |
CVE-2020-11046 | Medium | 5.5 | 2020-05-07 | In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read. |
CVE-2020-11045 | Low | 2.2 | 2020-05-07 | In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The… |
CVE-2020-11044 | Low | 2.2 | 2020-05-07 | In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipu… |
CVE-2020-11042 | Medium | 5.5 | 2020-05-07 | In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client me… |
CVE-2020-7805 | Critical | 9.8 | 2020-05-07 | An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. This issue is a command injection allowing at… |
CVE-2020-7803 | High | 7.8 | 2020-05-07 | IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGT… |
CVE-2020-10974 | High | 7.5 | 2020-05-07 | An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the adm… |
CVE-2020-10973 | High | 7.5 | 2020-05-07 | An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST… |
CVE-2020-10972 | High | 7.5 | 2020-05-07 | An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is r… |
CVE-2020-10971 | High | 8.8 | 2020-05-07 | An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied comm… |
CVE-2020-7646 | Critical | 9.8 | 2020-05-07 | curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input. |
CVE-2020-5751 | Medium | 5.4 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating… |
CVE-2020-5750 | Medium | 6.1 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the se… |
CVE-2020-5749 | Medium | 5.4 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating… |
CVE-2020-5748 | Medium | 6.1 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the se… |
CVE-2020-5747 | Medium | 5.4 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating… |
CVE-2020-5746 | Medium | 5.4 | 2020-05-07 | Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating… |
CVE-2020-5745 | High | 7.4 | 2020-05-07 | Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a craf… |
CVE-2020-5744 | Medium | 4.9 | 2020-05-07 | Relative Path Traversal in TCExam 14.2.2 allows a remote, authenticated attacker to read the contents of arbitrary files on disk. |
CVE-2020-5743 | Medium | 4.3 | 2020-05-07 | Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they don't have permission. |
CVE-2020-12679 | Medium | 6.1 | 2020-05-07 | A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remot… |
CVE-2020-12608 | High | 7.8 | 2020-05-07 | An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file p… |
CVE-2020-12448 | Medium | 5.3 | 2020-05-07 | GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet. |
CVE-2020-11431 | Critical | 9.1 | 2020-05-07 | The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remote unauthenticated attacker to read arbi… |
CVE-2020-6652 | High | 7.8 | 2020-05-07 | Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration… |
CVE-2020-6651 | High | 8.8 | 2020-05-07 | Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attacker… |
CVE-2020-12687 | Medium | 6.5 | 2020-05-07 | An issue was discovered in Serpico before 1.3.3. The /admin/attacments_backup endpoint can be requested by non-admin authenticated users. This means that an at… |
CVE-2020-12683 | Medium | 5.4 | 2020-05-07 | Katyshop2 before 2.12 has multiple stored XSS issues. |
CVE-2020-8983 | High | 7.5 | 2020-05-07 | An arbitrary file write issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases… |
CVE-2020-8982 | High | 7.5 | 2020-05-07 | An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent… |
CVE-2020-7473 | High | 7.5 | 2020-05-07 | In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020… |
CVE-2020-6081 | High | 8.8 | 2020-05-07 | An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially cra… |
CVE-2020-5895 | High | 7.8 | 2020-05-07 | On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local s… |
CVE-2020-5894 | High | 8.1 | 2020-05-07 | On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out. |
CVE-2020-12696 | Medium | 6.1 | 2020-05-07 | The iframe plugin before 4.5 for WordPress does not sanitize a URL. |
CVE-2020-12692 | Medium | 5.4 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can s… |
CVE-2020-12691 | High | 8.8 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that… |
CVE-2020-12690 | High | 8.8 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when… |
CVE-2020-12689 | High | 8.8 | 2020-05-07 | An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can… |
CVE-2020-12669 | High | 8.8 | 2020-05-06 | core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu paramet… |
CVE-2020-11727 | Medium | 6.1 | 2020-05-06 | A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject… |
CVE-2020-8899 | Critical | 9.8 | 2020-05-06 | There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x), P(9.0) and Q(10.0). An unauthenticated, unauthorize… |
CVE-2020-3334 | High | 7.4 | 2020-05-06 | A vulnerability in the ARP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Fi… |
CVE-2020-3329 | Medium | 4.3 | 2020-05-06 | A vulnerability in role-based access control of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for… |
CVE-2020-3318 | Critical | 9.8 | 2020-05-06 | Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensit… |
CVE-2020-3315 | Medium | 5.3 | 2020-05-06 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the config… |
CVE-2020-3313 | Medium | 6.1 | 2020-05-06 | A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scrip… |
CVE-2020-3312 | High | 7.5 | 2020-05-06 | A vulnerability in the application policy configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gai… |
CVE-2020-3311 | Medium | 6.1 | 2020-05-06 | A vulnerability in the web interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to redirect a user to… |
CVE-2020-3310 | Medium | 4.9 | 2020-05-06 | A vulnerability in the XML parser code of Cisco Firepower Device Manager On-Box software could allow an authenticated, remote attacker to cause an affected sys… |
CVE-2020-3309 | High | 7.2 | 2020-05-06 | A vulnerability in Cisco Firepower Device Manager (FDM) On-Box software could allow an authenticated, remote attacker to overwrite arbitrary files on the under… |
CVE-2020-3308 | Medium | 4.9 | 2020-05-06 | A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with… |
CVE-2020-3307 | Medium | 5.3 | 2020-05-06 | A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to write arbitrary entries to… |
CVE-2020-3306 | High | 7.5 | 2020-05-06 | A vulnerability in the DHCP module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2020-3305 | High | 7.5 | 2020-05-06 | A vulnerability in the implementation of the Border Gateway Protocol (BGP) module in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threa… |
CVE-2020-3303 | High | 7.5 | 2020-05-06 | A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (… |
CVE-2020-3302 | High | 8.1 | 2020-05-06 | A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to overwrite files on the file… |
CVE-2020-3301 | Medium | 4.4 | 2020-05-06 | Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensit… |
CVE-2020-3298 | High | 7.5 | 2020-05-06 | A vulnerability in the Open Shortest Path First (OSPF) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (F… |
CVE-2020-3285 | Medium | 5.8 | 2020-05-06 | A vulnerability in the Transport Layer Security version 1.3 (TLS 1.3) policy with URL category functionality for Cisco Firepower Threat Defense (FTD) Software… |
CVE-2020-3283 | High | 8.6 | 2020-05-06 | A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Firepower Threat Defense (FTD) Software when running on the C… |
CVE-2020-3259 | High | 7.5 | 2020-05-06 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-3256 | Medium | 4.9 | 2020-05-06 | A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) Software could allow an authenticated, remote… |
CVE-2020-3255 | High | 7.5 | 2020-05-06 | A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to caus… |
CVE-2020-3254 | High | 7.5 | 2020-05-06 | Multiple vulnerabilities in the Media Gateway Control Protocol (MGCP) inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Thre… |
CVE-2020-3253 | Medium | 6.7 | 2020-05-06 | A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell… |
CVE-2020-3246 | Medium | 4.3 | 2020-05-06 | A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection att… |
CVE-2020-3196 | High | 8.6 | 2020-05-06 | A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepowe… |
CVE-2020-3195 | High | 7.5 | 2020-05-06 | A vulnerability in the Open Shortest Path First (OSPF) implementation in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (F… |
CVE-2020-3191 | High | 8.6 | 2020-05-06 | A vulnerability in DNS over IPv6 packet processing for Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-3189 | High | 8.6 | 2020-05-06 | A vulnerability in the VPN System Logging functionality for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to ca… |
CVE-2020-3188 | Medium | 5.3 | 2020-05-06 | A vulnerability in how Cisco Firepower Threat Defense (FTD) Software handles session timeouts for management connections could allow an unauthenticated, remote… |
CVE-2020-3187 | Critical | 9.1 | 2020-05-06 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2020-3186 | Medium | 5.3 | 2020-05-06 | A vulnerability in the management access list configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to… |