2020 CVEs (page 158)
Page 158 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-12245 | Medium | 6.1 | 2020-04-24 | Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip. |
CVE-2020-11004 | High | 7.7 | 2020-04-24 | SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitiza… |
CVE-2020-11013 | High | 8.5 | 2020-04-24 | Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v… |
CVE-2020-7134 | Medium | 6.5 | 2020-04-24 | A remote access to sensitive data vulnerability was discovered in HPE IOT + GCP version(s): 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. |
CVE-2020-7133 | Critical | 9.8 | 2020-04-24 | A unauthorized remote access vulnerability was discovered in HPE IOT + GCP version(s): 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. |
CVE-2020-1741 | Medium | 5.9 | 2020-04-24 | A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installati… |
CVE-2020-7131 | Critical | 9.0 | 2020-04-24 | This document describes a security vulnerability in Blade Maintenance Entity, Integrated Maintenance Entity and Maintenance Entity products. All J/H-series Non… |
CVE-2020-6828 | High | 7.5 | 2020-04-24 | A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the u… |
CVE-2020-6827 | Medium | 4.7 | 2020-04-24 | When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorre… |
CVE-2020-6826 | Critical | 9.8 | 2020-04-24 | Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some of these bugs showed evidence of memory… |
CVE-2020-6825 | Critical | 9.8 | 2020-04-24 | Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these… |
CVE-2020-6824 | Low | 2.8 | 2020-04-24 | Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequ… |
CVE-2020-6823 | Critical | 9.8 | 2020-04-24 | A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain… |
CVE-2020-6822 | High | 8.8 | 2020-04-24 | On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is possible that with… |
CVE-2020-6821 | High | 7.5 | 2020-04-24 | When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returne… |
CVE-2020-6820 | High | 8.1 | 2020-04-24 | Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing thi… |
CVE-2020-6819 | High | 8.1 | 2020-04-24 | Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abu… |
CVE-2020-4267 | Medium | 6.5 | 2020-04-24 | IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD could allow an authenticated user cause a denial of service due to a memory leak. IBM X-Force ID: 175840. |
CVE-2020-5870 | High | 8.1 | 2020-04-24 | In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization mechanisms do not use any form of authentication for connecting to the peer. |
CVE-2020-5869 | Critical | 9.1 | 2020-04-24 | In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization is not secure by TLS and may allow on-path attackers to read / modify confidential data in transi… |
CVE-2020-5868 | Critical | 9.8 | 2020-04-24 | In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems using HTTP… |
CVE-2020-12137 | Medium | 6.1 | 2020-04-24 | GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against lis… |
CVE-2020-12063 | Medium | 5.3 | 2020-04-24 | A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the sim… |
CVE-2020-12135 | Medium | 5.5 | 2020-04-24 | bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter byt… |
CVE-2020-12134 | Critical | 9.8 | 2020-04-24 | Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.20 mishandle access control for the syslog log. |
CVE-2020-12132 | Medium | 6.1 | 2020-04-24 | Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request. |
CVE-2020-12131 | Medium | 6.1 | 2020-04-24 | The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo). |
CVE-2020-12130 | Medium | 6.1 | 2020-04-24 | The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function. |
CVE-2020-12129 | Medium | 6.1 | 2020-04-24 | The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function. |
CVE-2020-12128 | High | 7.5 | 2020-04-24 | DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path. |
CVE-2020-12118 | High | 8.2 | 2020-04-23 | The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing r… |
CVE-2020-11012 | Critical | 9.3 | 2020-04-23 | MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to per… |
CVE-2020-5867 | High | 8.1 | 2020-04-23 | In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages |
CVE-2020-8798 | Medium | 5.5 | 2020-04-23 | httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint fr… |
CVE-2020-5866 | Medium | 5.5 | 2020-04-23 | In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as… |
CVE-2020-5865 | Medium | 4.8 | 2020-04-23 | In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communica… |
CVE-2020-5864 | High | 7.4 | 2020-04-23 | In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default. |
CVE-2020-8797 | Medium | 6.7 | 2020-04-23 | Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux subsystem via an unsanitized exec call (aka Command Line Injection), if the un… |
CVE-2020-7132 | Medium | 5.4 | 2020-04-23 | A potential security vulnerability has been identified in HPE Onboard Administrator. The vulnerability could be remotely exploited to allow Reflected Cross Sit… |
CVE-2020-12113 | Medium | 6.1 | 2020-04-23 | BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used. |
CVE-2020-12112 | High | 7.5 | 2020-04-23 | BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion. |
CVE-2020-12105 | Medium | 5.9 | 2020-04-23 | OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-in-the-middle attack… |
CVE-2020-7643 | Medium | 5.3 | 2020-04-23 | paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifyin… |
CVE-2020-4415 | Critical | 9.8 | 2020-04-23 | IBM Spectrum Protect 7.1 and 8.1 server is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker… |
CVE-2020-4353 | Medium | 4.6 | 2020-04-23 | IBM MaaS360 6.82 could allow a user with pysical access to the device to crash the application which may enable the user to access restricted applications and… |
CVE-2020-4311 | High | 7.0 | 2020-04-23 | IBM Tivoli Monitoring 6.3.0 could allow a local attacker to execute arbitrary code on the system. By placing a specially crafted file, an attacker could exploi… |
CVE-2020-4202 | High | 8.8 | 2020-04-23 | IBM UrbanCode Deploy (UCD) 7.0.3.0 and 7.0.4.0 could allow an authenticated user to impersonate another user if the server is configured to enable Distributed… |
CVE-2020-1760 | Medium | 5.8 | 2020-04-23 | A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks du… |
CVE-2020-12054 | Medium | 6.1 | 2020-04-23 | The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is… |
CVE-2020-11945 | Critical | 9.8 | 2020-04-23 | An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwis… |
CVE-2020-11940 | High | 7.5 | 2020-04-23 | In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH… |
CVE-2020-11939 | Critical | 9.8 | 2020-04-23 | In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_s… |
CVE-2020-11806 | Medium | 5.9 | 2020-04-23 | In MailStore Outlook Add-in (and Email Archive Outlook Add-in) through 12.1.2, the login process does not validate the validity of the certificate presented by… |
CVE-2020-5571 | High | 7.5 | 2020-04-23 | SHARP AQUOS series (AQUOS SH-M02 build number 01.00.05 and earlier, AQUOS SH-RM02 build number 01.00.04 and earlier, AQUOS mini SH-M03 build number 01.00.04 an… |
CVE-2020-12079 | Critical | 10.0 | 2020-04-23 | Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefo… |
CVE-2020-12077 | High | 8.8 | 2020-04-23 | The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leadi… |
CVE-2020-12076 | High | 8.8 | 2020-04-23 | The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS. |
CVE-2020-12075 | High | 8.8 | 2020-04-23 | The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions. |
CVE-2020-12074 | High | 8.8 | 2020-04-23 | The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV. |
CVE-2020-12073 | High | 8.8 | 2020-04-23 | The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests. |
CVE-2020-12071 | Medium | 4.8 | 2020-04-23 | Anchor 0.12.7 allows admins to cause XSS via crafted post content. |
CVE-2020-8833 | Medium | 5.6 | 2020-04-22 | Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs… |
CVE-2020-8831 | Medium | 6.5 | 2020-04-22 | Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this i… |
CVE-2020-7350 | Medium | 6.1 | 2020-04-22 | Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted use… |
CVE-2020-8867 | High | 7.5 | 2020-04-22 | This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Au… |
CVE-2020-10915 | Critical | 9.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to… |
CVE-2020-10914 | Critical | 9.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to… |
CVE-2020-10913 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2020-10912 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2020-10911 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2020-10910 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2020-10909 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2020-10908 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2020-10907 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511. User interaction is required to exp… |
CVE-2020-10906 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511. User interaction is required to exp… |
CVE-2020-10905 | Low | 3.3 | 2020-04-22 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is req… |
CVE-2020-10904 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to… |
CVE-2020-10903 | Low | 3.3 | 2020-04-22 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is req… |
CVE-2020-10902 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to… |
CVE-2020-10901 | Low | 3.3 | 2020-04-22 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is req… |
CVE-2020-10900 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511. User interaction is required to exp… |
CVE-2020-10899 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511. User interaction is required to exp… |
CVE-2020-10898 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to… |
CVE-2020-10897 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to… |
CVE-2020-10896 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to… |
CVE-2020-10895 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to… |
CVE-2020-10894 | Low | 3.3 | 2020-04-22 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is req… |
CVE-2020-10893 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to… |
CVE-2020-10892 | High | 8.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2020-10891 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2020-10890 | High | 8.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2020-10889 | High | 7.8 | 2020-04-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to… |
CVE-2020-1983 | High | 7.5 | 2020-04-22 | A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. |
CVE-2020-11649 | Medium | 6.5 | 2020-04-22 | An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted. |
CVE-2020-11506 | High | 7.5 | 2020-04-22 | An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensi… |
CVE-2020-11505 | High | 7.5 | 2020-04-22 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse… |
CVE-2020-7490 | High | 7.8 | 2020-04-22 | A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior), which could c… |
CVE-2020-7489 | Critical | 9.8 | 2020-04-22 | A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert… |
CVE-2020-7488 | High | 7.5 | 2020-04-22 | A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the… |
CVE-2020-7487 | Critical | 9.8 | 2020-04-22 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M2… |