2020 CVEs (page 16)
Page 16 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-23986 | Medium | 6.1 | 2022-01-06 | Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the fun… |
CVE-2020-5956 | High | 7.5 | 2022-01-05 | An issue was discovered in SdLegacySmm in Insyde InsydeH2O with kernel 5.1 before 05.15.11, 5.2 before 05.25.11, 5.3 before 05.34.11, and 5.4 before 05.42.11… |
CVE-2020-15933 | Medium | 5.3 | 2022-01-05 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versi… |
CVE-2020-23026 | High | 7.5 | 2022-01-03 | A NULL pointer dereference in the main() function dhry_1.c of dhrystone 2.1 causes a denial of service (DoS). |
CVE-2020-11263 | High | 7.3 | 2022-01-03 | An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Co… |
CVE-2020-29292 | Medium | 6.5 | 2021-12-30 | iBall WRD12EN 1.0.0 devices allow cross-site request forgery (CSRF) attacks as demonstrated by enabling DNS settings or modifying the range for IP addresses. |
CVE-2020-7883 | Critical | 9.8 | 2021-12-28 | Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the ar… |
CVE-2020-7878 | Critical | 9.8 | 2021-12-28 | An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue is due to missing sup… |
CVE-2020-22061 | High | 7.8 | 2021-12-28 | SUPERAntispyware v8.0.0.1050 was discovered to contain an issue in the component saskutil64.sys. This issue allows attackers to arbitrarily write data to the d… |
CVE-2020-22057 | Critical | 9.1 | 2021-12-28 | The WinRin0x64.sys and WinRing0.sys low-level drivers in EVGA Precision XOC version v6.2.7 were discovered to be configured with the default security descripto… |
CVE-2020-21238 | Critical | 9.8 | 2021-12-27 | An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks. |
CVE-2020-21237 | Critical | 9.8 | 2021-12-27 | An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks. |
CVE-2020-21236 | High | 8.8 | 2021-12-27 | A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a use… |
CVE-2020-20948 | High | 7.5 | 2021-12-27 | An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable. |
CVE-2020-20946 | Medium | 5.4 | 2021-12-27 | Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add. |
CVE-2020-20945 | High | 8.8 | 2021-12-27 | A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts. |
CVE-2020-20944 | Critical | 9.1 | 2021-12-27 | An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files. |
CVE-2020-20943 | Medium | 4.3 | 2021-12-27 | A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing… |
CVE-2020-36514 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations. |
CVE-2020-36513 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations. |
CVE-2020-36512 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations. |
CVE-2020-36511 | High | 7.5 | 2021-12-27 | An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations. |
CVE-2020-35398 | Medium | 5.3 | 2021-12-23 | An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames determined by the err… |
CVE-2020-3896 | Medium | 5.5 | 2021-12-23 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Update 2020-… |
CVE-2020-3886 | High | 7.8 | 2021-12-23 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security… |
CVE-2020-20605 | Medium | 6.1 | 2021-12-22 | Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component. |
CVE-2020-20601 | Critical | 9.8 | 2021-12-22 | An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet. |
CVE-2020-20600 | Medium | 5.4 | 2021-12-22 | MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn. |
CVE-2020-20598 | Medium | 6.1 | 2021-12-22 | A cross-site scripting (XSS) vulnerability in the Editing component of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2020-20597 | Medium | 6.1 | 2021-12-22 | A cross-site scripting (XSS) vulnerability in the potrtalItemName parameter in \web\PortalController.java of lemon V1.10.0 allows attackers to execute arbitrar… |
CVE-2020-20595 | Medium | 6.5 | 2021-12-22 | A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add. |
CVE-2020-20593 | High | 8.0 | 2021-12-22 | A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account. |
CVE-2020-20426 | Medium | 6.1 | 2021-12-22 | S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php. |
CVE-2020-20425 | Medium | 6.1 | 2021-12-22 | S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function. |
CVE-2020-19770 | Medium | 5.4 | 2021-12-21 | A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie. |
CVE-2020-19316 | High | 8.8 | 2021-12-20 | OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. |
CVE-2020-8105 | Critical | 9.6 | 2021-12-20 | OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root acc… |
CVE-2020-8968 | High | 7.1 | 2021-12-17 | Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cy… |
CVE-2020-18081 | High | 7.5 | 2021-12-17 | The checkuser function of SEMCMS 3.8 was discovered to contain a vulnerability which allows attackers to obtain the password in plaintext through a SQL query. |
CVE-2020-18078 | Critical | 9.8 | 2021-12-17 | A vulnerability in /include/web_check.php of SEMCMS v3.8 allows attackers to reset the Administrator account's password. |
CVE-2020-18077 | High | 7.5 | 2021-12-17 | A buffer overflow vulnerability in the Virtual Path Mapping component of FTPShell v6.83 allows attackers to cause a denial of service (DoS). |
CVE-2020-35216 | Medium | 5.9 | 2021-12-16 | An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages. |
CVE-2020-35215 | Medium | 6.5 | 2021-12-16 | An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain t… |
CVE-2020-35214 | High | 8.1 | 2021-12-16 | An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations. |
CVE-2020-35213 | High | 8.1 | 2021-12-16 | An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node. |
CVE-2020-35211 | High | 7.5 | 2021-12-16 | An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster via manipulation of the variable terms in RaftContext. |
CVE-2020-35210 | Medium | 6.5 | 2021-12-16 | A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages. |
CVE-2020-35209 | High | 7.5 | 2021-12-16 | An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information. |
CVE-2020-18985 | Medium | 6.1 | 2021-12-15 | An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website of their choosing. |
CVE-2020-18984 | Medium | 6.1 | 2021-12-15 | A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticate… |
CVE-2020-23545 | High | 7.8 | 2021-12-15 | IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ReadXPM_W+0x0000000000000531. |
CVE-2020-19042 | Medium | 6.1 | 2021-12-13 | Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php. |
CVE-2020-4496 | Medium | 5.9 | 2021-12-13 | The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle atta… |
CVE-2020-16156 | High | 7.8 | 2021-12-13 | CPAN 2.28 allows Signature Verification Bypass. |
CVE-2020-16155 | Medium | 6.5 | 2021-12-13 | The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data. |
CVE-2020-16154 | High | 7.8 | 2021-12-13 | The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass. |
CVE-2020-12890 | Medium | 6.7 | 2021-12-10 | Improper handling of pointers in the System Management Mode (SMM) handling code may allow for a privileged attacker with physical or administrative access to p… |
CVE-2020-19683 | Medium | 5.4 | 2021-12-09 | A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php. |
CVE-2020-19682 | High | 8.8 | 2021-12-09 | A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php. |
CVE-2020-27416 | Critical | 9.8 | 2021-12-08 | Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users acco… |
CVE-2020-22421 | Medium | 6.1 | 2021-12-08 | 74CMS v6.0.4 was discovered to contain a cross-site scripting (XSS) vulnerability via /index.php?m=&c=help&a=help_list&key. |
CVE-2020-27356 | Medium | 5.4 | 2021-12-07 | The debug-meta-data plugin 1.1.2 for WordPress allows XSS. |
CVE-2020-12140 | High | 8.8 | 2021-12-07 | A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code via malicious L2CAP… |
CVE-2020-19611 | Medium | 6.1 | 2021-12-07 | Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter. |
CVE-2020-27413 | Medium | 4.2 | 2021-12-07 | An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password while the user is log… |
CVE-2020-29177 | Critical | 9.1 | 2021-12-02 | Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php. |
CVE-2020-29176 | High | 7.8 | 2021-12-02 | An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file. |
CVE-2020-36135 | Medium | 6.5 | 2021-12-02 | AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c. |
CVE-2020-36134 | Medium | 6.5 | 2021-12-02 | AOM v2.0.1 was discovered to contain a segmentation violation via the component aom_dsp/x86/obmc_sad_avx2.c. |
CVE-2020-36133 | High | 8.8 | 2021-12-02 | AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h. |
CVE-2020-36131 | High | 8.8 | 2021-12-02 | AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c. |
CVE-2020-36130 | Medium | 6.5 | 2021-12-02 | AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c. |
CVE-2020-36129 | High | 8.8 | 2021-12-02 | AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c. |
CVE-2020-27414 | Medium | 5.9 | 2021-12-02 | Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. This may lead to information disclosure if unauthorized partie… |
CVE-2020-35037 | Medium | 6.1 | 2021-12-01 | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-S… |
CVE-2020-35012 | High | 7.2 | 2021-12-01 | The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection |
CVE-2020-10627 | High | 7.3 | 2021-12-01 | Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured P… |
CVE-2020-7880 | High | 7.5 | 2021-11-30 | The vulnerabilty was discovered in ActiveX module related to NeoRS remote support program. This issue allows an remote attacker to download and execute remote… |
CVE-2020-7879 | High | 8.8 | 2021-11-30 | This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because th… |
CVE-2020-7881 | High | 7.5 | 2021-11-26 | The vulnerability function is enabled when the streamer service related to the AfreecaTV communicated through web socket using 21201 port. A stack-based buffer… |
CVE-2020-22719 | Medium | 5.4 | 2021-11-22 | Shimo Document v2.0.1 contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload… |
CVE-2020-7882 | High | 7.5 | 2021-11-22 | Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the… |
CVE-2020-8741 | High | 7.8 | 2021-11-17 | Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may allow an authenticated user to potentially… |
CVE-2020-21639 | Medium | 6.1 | 2021-11-16 | Ruijie RG-UAC 6000-E50 commit 9071227 was discovered to contain a cross-site scripting (XSS) vulnerability via the rule_name parameter. This vulnerability allo… |
CVE-2020-21627 | High | 7.5 | 2021-11-16 | Ruijie RG-UAC commit 9071227 was discovered to contain a vulnerability in the component /current_action.php?action=reboot, which allows attackers to cause a de… |
CVE-2020-12961 | High | 7.8 | 2021-11-16 | A potential vulnerability exists in AMD Platform Security Processor (PSP) that may allow an attacker to zero any privileged register on the System Management N… |
CVE-2020-12954 | Medium | 5.5 | 2021-11-16 | A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI ROM modification. |
CVE-2020-12951 | High | 7.0 | 2021-11-16 | Race condition in ASP firmware could allow less privileged x86 code to perform ASP SMM (System Management Mode) operations. |
CVE-2020-12946 | High | 7.1 | 2021-11-16 | Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service. |
CVE-2020-12944 | High | 7.8 | 2021-11-16 | Insufficient validation of BIOS image length by ASP Firmware could lead to arbitrary code execution. |
CVE-2020-12962 | High | 7.8 | 2021-11-15 | Escape call interface in the AMD Graphics Driver for Windows may cause privilege escalation. |
CVE-2020-12960 | Medium | 5.5 | 2021-11-15 | AMD Graphics Driver for Windows 10, amdfender.sys may improperly handle input validation on InputBuffer which may result in a denial of service (DoS). |
CVE-2020-12905 | Medium | 5.5 | 2021-11-15 | Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004403 may lead to arbitrary information disclosure. |
CVE-2020-12903 | High | 7.8 | 2021-11-15 | Out of Bounds Write and Read in AMD Graphics Driver for Windows 10 in Escape 0x6002d03 may lead to escalation of privilege or denial of service. |
CVE-2020-12901 | Medium | 5.5 | 2021-11-15 | Arbitrary Free After Use in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or information disclosure. |
CVE-2020-12894 | High | 7.1 | 2021-11-15 | Arbitrary Write in AMD Graphics Driver for Windows 10 in Escape 0x40010d may lead to arbitrary write to kernel memory or denial of service. |
CVE-2020-12893 | High | 7.8 | 2021-11-15 | Stack Buffer Overflow in AMD Graphics Driver for Windows 10 in Escape 0x15002a may lead to escalation of privilege or denial of service. |
CVE-2020-12898 | High | 7.8 | 2021-11-15 | Stack Buffer Overflow in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service. |
CVE-2020-12892 | High | 7.8 | 2021-11-15 | An untrusted search path in AMD Radeon settings Installer may lead to a privilege escalation or unauthorized code execution. |
CVE-2020-12963 | High | 7.8 | 2021-11-15 | An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows may allow unprivileged users to compromise the system. |