2020 CVEs (page 155)
Page 155 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3179 | High | 7.5 | 2020-05-06 | A vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2020-3178 | Medium | 6.1 | 2020-05-06 | Multiple vulnerabilities in the web-based GUI of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, r… |
CVE-2020-3125 | Critical | 9.8 | 2020-05-06 | A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to i… |
CVE-2020-7921 | Medium | 4.6 | 2020-05-06 | Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to by… |
CVE-2020-12108 | Medium | 6.5 | 2020-05-06 | /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. |
CVE-2020-6861 | Medium | 5.5 | 2020-05-06 | A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key… |
CVE-2020-4446 | Medium | 4.3 | 2020-05-06 | IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions… |
CVE-2020-4421 | Medium | 5.4 | 2020-05-06 | IBM WebSphere Application Liberty 19.0.0.5 through 20.0.0.4 could allow an authenticated user using openidconnect to spoof another users identify. IBM X-Force… |
CVE-2020-4384 | Medium | 5.4 | 2020-05-06 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod… |
CVE-2020-10704 | High | 7.5 | 2020-05-06 | A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Control… |
CVE-2020-10693 | Medium | 5.3 | 2020-05-06 | A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if… |
CVE-2020-7806 | High | 7.8 | 2020-05-06 | Tobesoft Xplatform 9.2.2.250 and earlier version have an arbitrary code execution vulnerability by using method supported by Xplatform ActiveX Control. It allo… |
CVE-2020-6094 | High | 8.8 | 2020-05-06 | An exploitable code execution vulnerability exists in the TIFF fillinraster function of the igcore19d.dll library of Accusoft ImageGear 19.4, 19.5 and 19.6. A… |
CVE-2020-6082 | High | 8.8 | 2020-05-06 | An exploitable out-of-bounds write vulnerability exists in the ico_read function of the igcore19d.dll library of Accusoft ImageGear 19.6.0. A specially crafted… |
CVE-2020-6076 | High | 8.8 | 2020-05-06 | An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll ICO icoread parser of the Accusoft ImageGear 19.5.0 library. A specially crafted I… |
CVE-2020-6075 | High | 8.8 | 2020-05-06 | An exploitable out-of-bounds write vulnerability exists in the store_data_buffer function of the igcore19d.dll library of Accusoft ImageGear 19.5.0. A speciall… |
CVE-2020-4092 | Medium | 5.3 | 2020-05-06 | "If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a us… |
CVE-2020-2189 | High | 8.8 | 2020-05-06 | Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote co… |
CVE-2020-2188 | Medium | 4.3 | 2020-05-06 | A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to enumerate credenti… |
CVE-2020-2187 | Medium | 5.6 | 2020-05-06 | Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-mid… |
CVE-2020-2186 | Medium | 4.3 | 2020-05-06 | A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances. |
CVE-2020-2185 | Medium | 5.6 | 2020-05-06 | Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks. |
CVE-2020-2184 | Medium | 4.3 | 2020-05-06 | A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker… |
CVE-2020-2183 | Medium | 6.5 | 2020-05-06 | Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to… |
CVE-2020-2182 | Medium | 4.3 | 2020-05-06 | Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a `$` character in some circumstances. |
CVE-2020-2181 | Medium | 6.5 | 2020-05-06 | Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build step… |
CVE-2020-12672 | High | 7.5 | 2020-05-06 | GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c. |
CVE-2020-12666 | Medium | 6.1 | 2020-05-05 | macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL. |
CVE-2020-12463 | High | 7.8 | 2020-05-05 | An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users… |
CVE-2020-12439 | Medium | 5.3 | 2020-05-05 | Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain. |
CVE-2020-11036 | High | 7.6 | 2020-05-05 | In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Kno… |
CVE-2020-11035 | High | 7.5 | 2020-05-05 | In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and M… |
CVE-2020-11034 | Medium | 6.1 | 2020-05-05 | In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in ve… |
CVE-2020-11033 | Medium | 6.6 | 2020-05-05 | In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.p… |
CVE-2020-11051 | Medium | 6.9 | 2020-05-05 | In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS p… |
CVE-2020-11032 | High | 7.6 | 2020-05-05 | In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. T… |
CVE-2020-10859 | Medium | 6.5 | 2020-05-05 | Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted… |
CVE-2020-10634 | Critical | 9.1 | 2020-05-05 | SAE IT-systems FW-50 Remote Telemetry Unit (RTU). A specially crafted request could allow an attacker to view the file structure of the affected device and acc… |
CVE-2020-10630 | Medium | 6.1 | 2020-05-05 | SAE IT-systems FW-50 Remote Telemetry Unit (RTU). The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in th… |
CVE-2020-12144 | Medium | 6.0 | 2020-05-05 | The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establish a TLS co… |
CVE-2020-12143 | Medium | 6.0 | 2020-05-05 | The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from E… |
CVE-2020-12142 | Medium | 4.8 | 2020-05-05 | 1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, wi… |
CVE-2020-8830 | High | 8.8 | 2020-05-05 | CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wir… |
CVE-2020-8829 | High | 8.8 | 2020-05-05 | CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis. |
CVE-2020-8033 | Medium | 6.1 | 2020-05-05 | Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field. |
CVE-2020-7983 | High | 8.1 | 2020-05-05 | A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks. |
CVE-2020-5517 | Medium | 6.5 | 2020-05-05 | CSRF in the /login URI in BlueOnyx 5209R allows an attacker to access the dashboard and perform scraping or other analysis. |
CVE-2020-8799 | Medium | 4.8 | 2020-05-05 | A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submit… |
CVE-2020-12104 | High | 8.8 | 2020-05-05 | The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can… |
CVE-2020-11737 | Medium | 6.1 | 2020-05-05 | A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execu… |
CVE-2020-12659 | Medium | 6.7 | 2020-05-05 | An issue was discovered in the Linux kernel before 5.6.7. xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write (by a user with the CAP_NET_ADMIN capab… |
CVE-2020-12657 | High | 7.8 | 2020-05-05 | An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body. |
CVE-2020-12656 | Medium | 5.5 | 2020-05-05 | gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certain domain_release ca… |
CVE-2020-12655 | Medium | 5.5 | 2020-05-05 | An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers may trigger a sync of excessive duration v… |
CVE-2020-12653 | High | 7.8 | 2020-05-05 | An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users t… |
CVE-2020-12654 | High | 7.1 | 2020-05-05 | An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a hea… |
CVE-2020-12652 | Medium | 4.1 | 2020-05-05 | The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl… |
CVE-2020-12649 | High | 7.5 | 2020-05-05 | Gurbalib through 2020-04-30 allows lib/cmds/player/help.c directory traversal for reading administrative paths. |
CVE-2020-10717 | Low | 3.3 | 2020-05-04 | A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant to share a… |
CVE-2020-10700 | Medium | 5.3 | 2020-05-04 | A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a… |
CVE-2020-10686 | Medium | 4.1 | 2020-05-04 | A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could… |
CVE-2020-8896 | Medium | 4.2 | 2020-05-04 | A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to and including 7.3.2 allows an attacker to perform a Man-in-the… |
CVE-2020-5343 | High | 7.3 | 2020-05-04 | Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insecure inherited permissions vulnerability… |
CVE-2020-5337 | Medium | 4.6 | 2020-05-04 | RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulne… |
CVE-2020-5336 | Medium | 4.6 | 2020-05-04 | RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability… |
CVE-2020-5335 | Medium | 5.0 | 2020-05-04 | RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability. A remote unauthenticated attacker could potentially exploit… |
CVE-2020-5334 | High | 8.2 | 2020-05-04 | RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contains a Document Object Model (DOM) based cross-site scripting vulnerability. A remote unauthenticated attac… |
CVE-2020-5333 | Medium | 4.3 | 2020-05-04 | RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user cou… |
CVE-2020-5332 | High | 7.2 | 2020-05-04 | RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain a command injection vulnerability. AN authenticated malicious user with administrator privileges could… |
CVE-2020-5331 | High | 8.8 | 2020-05-04 | RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability. Users’ session information could potentially be stored in cache… |
CVE-2020-10622 | High | 7.8 | 2020-05-04 | LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to arbitrary file creation by unauthorized users |
CVE-2020-10618 | Medium | 5.5 | 2020-05-04 | LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to sensitive information exposure by unauthorized users. |
CVE-2020-1732 | Medium | 4.2 | 2020-05-04 | A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads… |
CVE-2020-12642 | High | 7.5 | 2020-05-04 | An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUn… |
CVE-2020-12109 | High | 8.8 | 2020-05-04 | Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 2… |
CVE-2020-12641 | Critical | 9.8 | 2020-05-04 | rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert… |
CVE-2020-12640 | Critical | 9.8 | 2020-05-04 | Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php. |
CVE-2020-12111 | High | 8.8 | 2020-05-04 | Certain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304. |
CVE-2020-10933 | Medium | 5.3 | 2020-05-04 | An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, except… |
CVE-2020-8792 | Medium | 5.3 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an information-exposure issue. In the mobile app, an attempt to add an… |
CVE-2020-8791 | Medium | 6.5 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using authenticated but unau… |
CVE-2020-8790 | Critical | 9.8 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper restriction of excess… |
CVE-2020-4209 | Medium | 5.4 | 2020-05-04 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted… |
CVE-2020-12639 | Medium | 6.1 | 2020-05-04 | phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php. |
CVE-2020-12475 | Medium | 5.5 | 2020-05-04 | TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via com.tp_link.eap.web.portal.PortalController.getAdvertiseFile… |
CVE-2020-12110 | Critical | 9.8 | 2020-05-04 | Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0… |
CVE-2020-11671 | High | 8.1 | 2020-05-04 | Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass adminis… |
CVE-2020-11462 | High | 7.5 | 2020-05-04 | An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interface enabled, it is possible to achieve… |
CVE-2020-11443 | High | 8.1 | 2020-05-04 | The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version… |
CVE-2020-10876 | High | 7.5 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification cod… |
CVE-2020-10187 | High | 7.5 | 2020-05-04 | Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the… |
CVE-2020-1961 | Critical | 9.8 | 2020-05-04 | Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling at… |
CVE-2020-1959 | Critical | 9.8 | 2020-05-04 | A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unau… |
CVE-2020-12629 | Medium | 5.4 | 2020-05-04 | include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name. |
CVE-2020-11842 | High | 7.5 | 2020-05-04 | Information disclosure vulnerability in Micro Focus Verastream Host Integrator (VHI) product, affecting versions earlier than 7.8 Update 1 (7.8.49 or 7.8.0.49)… |
CVE-2020-8018 | High | 8.4 | 2020-05-04 | A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST-BYOS and SLES15-SP1-CAP-Deployment-BYOS images of SUSE Linux Enterprise Server 15 SP1 all… |
CVE-2020-12114 | Medium | 4.7 | 2020-05-04 | A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, a… |
CVE-2020-1631 | High | 8.8 | 2020-05-04 | A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Ze… |
CVE-2020-12627 | Critical | 9.8 | 2020-05-04 | Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key. |
CVE-2020-12626 | Medium | 6.5 | 2020-05-04 | An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered. |