2020 CVEs (page 160)
Page 160 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-0076 | Medium | 6.7 | 2020-04-17 | In get_auth_result of the FPC IRIS TrustZone app, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of… |
CVE-2020-0075 | Medium | 4.4 | 2020-04-17 | In set_shared_key of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. This could lead to local information dis… |
CVE-2020-0073 | Critical | 9.8 | 2020-04-17 | In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execut… |
CVE-2020-0072 | Critical | 9.8 | 2020-04-17 | In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execut… |
CVE-2020-0071 | Critical | 9.8 | 2020-04-17 | In rw_t2t_extract_default_locks_info of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code e… |
CVE-2020-0070 | Critical | 9.8 | 2020-04-17 | In rw_t2t_update_lock_attributes of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execu… |
CVE-2020-0068 | Medium | 4.4 | 2020-04-17 | In crus_afe_get_param of msm-cirrus-playback.c, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclos… |
CVE-2020-0067 | Medium | 4.4 | 2020-04-17 | In f2fs_xattr_generic_list of xattr.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure wi… |
CVE-2020-7085 | High | 7.8 | 2020-04-17 | A heap overflow vulnerability in the Autodesk FBX-SDK versions 2019.2 and earlier may lead to arbitrary code execution on a system running it. |
CVE-2020-7084 | Medium | 5.5 | 2020-04-17 | A NULL pointer dereference vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the application. |
CVE-2020-7083 | Medium | 6.5 | 2020-04-17 | An intager overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the application. |
CVE-2020-7082 | High | 8.8 | 2020-04-17 | A use-after-free vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to code execution on a system running it. |
CVE-2020-7081 | High | 8.8 | 2020-04-17 | A type confusion vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitary code read/write on the system running it. |
CVE-2020-7080 | High | 7.8 | 2020-04-17 | A buffer overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitrary code execution on a system running it. |
CVE-2020-7079 | High | 7.8 | 2020-04-17 | An improper signature validation vulnerability in Autodesk Dynamo BIM versions 2.5.1 and 2.5.0 may lead to code execution through maliciously crafted DLL files. |
CVE-2020-11880 | Medium | 6.5 | 2020-04-17 | An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto… |
CVE-2020-11879 | Medium | 6.5 | 2020-04-17 | An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of… |
CVE-2020-11878 | Critical | 9.8 | 2020-04-17 | The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts. |
CVE-2020-11877 | High | 7.5 | 2020-04-17 | airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC encryption. NOTE: the vendor states that… |
CVE-2020-11876 | High | 7.5 | 2020-04-17 | airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of an OpenSSL EVP AES-256 CBC context. NOTE… |
CVE-2020-9523 | High | 8.8 | 2020-04-17 | Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 1… |
CVE-2020-4277 | High | 7.5 | 2020-04-17 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-F… |
CVE-2020-11875 | High | 7.8 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10.0 (MTK chipsets) software. The MTK kernel does not properly implement except… |
CVE-2020-11874 | High | 7.5 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. Attackers can bypass Factory Reset Protection (FRP). The LG ID is LV… |
CVE-2020-11873 | Critical | 9.8 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A stack-based buffer overflow in the logging tool could allow a… |
CVE-2020-11793 | High | 8.8 | 2020-04-17 | A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary… |
CVE-2020-10947 | High | 8.8 | 2020-04-17 | Mac Endpoint for Sophos Central before 9.9.6 and Mac Endpoint for Sophos Home before 2.2.6 allow Privilege Escalation. |
CVE-2020-10813 | High | 7.5 | 2020-04-17 | A buffer overflow vulnerability in FTPDMIN 0.96 allows attackers to crash the server via a crafted packet. |
CVE-2020-10377 | Critical | 9.8 | 2020-04-17 | A weak encryption vulnerability in Mitel MiVoice Connect Client before 214.100.1214.0 could allow an unauthenticated attacker to gain access to user credential… |
CVE-2020-10211 | Critical | 9.8 | 2020-04-17 | A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbit… |
CVE-2020-11872 | High | 7.5 | 2020-04-17 | The Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions of TempID requests before an AES-256-GCM key rotation occurs. |
CVE-2020-11868 | High | 7.5 | 2020-04-17 | ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoof… |
CVE-2020-5294 | Medium | 4.1 | 2020-04-16 | PrestaShop module ps_facetedsearch versions before 2.1.0 has a reflected XSS with social networks fields The problem is fixed in 2.1.0 |
CVE-2020-5273 | Medium | 4.1 | 2020-04-16 | In PrestaShop module ps_linklist versions before 3.1.0, there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0 |
CVE-2020-5266 | Medium | 4.4 | 2020-04-16 | In the ps_link module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title field. The problem is… |
CVE-2020-7486 | High | 7.5 | 2020-04-16 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability could cause TCM modules to reset when under high network load in TCM v10.4.x and in system v10.3.x. Thi… |
CVE-2020-7485 | Critical | 9.8 | 2020-04-16 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy support account in the TriStation software version v4.9.0 and earlier could cause improper access to the TriSt… |
CVE-2020-7484 | High | 7.5 | 2020-04-16 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability with the former 'password' feature could allow a denial of service attack if the user is not following… |
CVE-2020-7483 | High | 7.5 | 2020-04-16 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability could cause certain data to be visible on the network when the 'password' feature is enabled. This vuln… |
CVE-2020-7224 | Critical | 9.8 | 2020-04-16 | The Aviatrix OpenVPN client through 2.5.7 on Linux, macOS, and Windows is vulnerable when OpenSSL parameters are altered from the issued value set; the paramet… |
CVE-2020-7114 | Critical | 9.8 | 2020-04-16 | A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to certain databases in… |
CVE-2020-7113 | Medium | 4.9 | 2020-04-16 | A vulnerability was found when an attacker, while communicating with the ClearPass management interface, is able to intercept and change parameters in the HTTP… |
CVE-2020-7111 | High | 7.2 | 2020-04-16 | A server side injection vulnerability exists which could allow an authenticated administrative user to achieve Remote Code Execution in ClearPass. Resolution… |
CVE-2020-7110 | Medium | 4.8 | 2020-04-16 | ClearPass is vulnerable to Stored Cross Site Scripting by allowing a malicious administrator, or a compromised administrator account, to save malicious scripts… |
CVE-2020-2180 | High | 8.8 | 2020-04-16 | Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executi… |
CVE-2020-2179 | High | 8.8 | 2020-04-16 | Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execu… |
CVE-2020-2178 | High | 7.1 | 2020-04-16 | Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2177 | Medium | 4.3 | 2020-04-16 | Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extende… |
CVE-2020-1964 | Critical | 9.8 | 2020-04-16 | It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent th… |
CVE-2020-11826 | High | 7.5 | 2020-04-16 | Users can lock their notes with a password in Memono version 3.8. Thus, users needs to know a password to read notes. However, these notes are stored in a data… |
CVE-2020-11825 | High | 8.8 | 2020-04-16 | In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user… |
CVE-2020-11823 | Medium | 5.4 | 2020-04-16 | In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the adm… |
CVE-2020-11820 | Critical | 9.8 | 2020-04-16 | Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entities_id parameter. |
CVE-2020-11819 | Critical | 9.8 | 2020-04-16 | In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution. |
CVE-2020-11818 | High | 8.8 | 2020-04-16 | In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, a… |
CVE-2020-11816 | Critical | 9.8 | 2020-04-16 | Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reports_id (POST) parameter. |
CVE-2020-11815 | Critical | 9.8 | 2020-04-16 | In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value. As a result of that, an attacker can execute a… |
CVE-2020-11814 | Medium | 5.4 | 2020-04-16 | A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites. |
CVE-2020-11813 | Medium | 5.4 | 2020-04-16 | In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious scri… |
CVE-2020-11812 | Critical | 9.8 | 2020-04-16 | Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters[0][value] or filters[1][value] parameter. |
CVE-2020-11811 | Critical | 9.8 | 2020-04-16 | In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After… |
CVE-2020-11007 | Medium | 6.5 | 2020-04-16 | In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart… |
CVE-2020-4347 | High | 7.3 | 2020-04-16 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could be subject to attacks based on privilege escalation due to inappropriate file permissions for file… |
CVE-2020-4338 | Medium | 5.5 | 2020-04-16 | IBM MQ 9.1.4 could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data. IBM X-Force ID: 177937. |
CVE-2020-4260 | Medium | 4.3 | 2020-04-16 | IBM UrbanCode Deploy (UCD) 7.0.5 could allow a user with special permissions to obtain sensitive information via generic processes. IBM X-Force ID: 175639. |
CVE-2020-3653 | Critical | 9.1 | 2020-04-16 | Possible buffer over-read in windows wlan driver function due to lack of check of length of variable received from userspace in Snapdragon Compute, Snapdragon… |
CVE-2020-3652 | Critical | 9.1 | 2020-04-16 | Possible buffer over-read issue in windows x86 wlan driver function while processing beacon or request frame due to lack of check of length of variable receive… |
CVE-2020-3651 | High | 7.5 | 2020-04-16 | Active command timeout since WM status change cmd is not removed from active queue if peer sends multiple deauth frames. in Snapdragon Auto, Snapdragon Compute… |
CVE-2020-9280 | High | 7.5 | 2020-04-15 | In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This a… |
CVE-2020-5721 | Medium | 5.5 | 2020-04-15 | MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Maste… |
CVE-2020-3273 | High | 7.5 | 2020-04-15 | A vulnerability in the 802.11 Generic Advertisement Service (GAS) frame processing function of Cisco Wireless LAN Controller (WLC) Software could allow an unau… |
CVE-2020-3262 | High | 7.5 | 2020-04-15 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol handler of Cisco Wireless LAN Controller (WLC) Software could allow… |
CVE-2020-3261 | Medium | 6.5 | 2020-04-15 | A vulnerability in the web-based management interface of Cisco Mobility Express Software could allow an unauthenticated, remote attacker to conduct a cross-sit… |
CVE-2020-3260 | Medium | 6.5 | 2020-04-15 | A vulnerability in Cisco Aironet Series Access Points Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition o… |
CVE-2020-3252 | Medium | 6.5 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3251 | High | 8.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3250 | Critical | 9.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3249 | High | 7.5 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3248 | Critical | 9.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3247 | Critical | 9.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3243 | Critical | 9.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3240 | High | 7.3 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3239 | High | 8.8 | 2020-04-15 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication… |
CVE-2020-3194 | High | 7.8 | 2020-04-15 | A vulnerability in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute a… |
CVE-2020-3177 | High | 7.5 | 2020-04-15 | A vulnerability in the Tool for Auto-Registered Phones Support (TAPS) of Cisco Unified Communications Manager (UCM) and Cisco Unified Communications Manager Se… |
CVE-2020-3162 | High | 7.5 | 2020-04-15 | A vulnerability in the Constrained Application Protocol (CoAP) implementation of Cisco IoT Field Network Director could allow an unauthenticated remote attacke… |
CVE-2020-1632 | High | 8.6 | 2020-04-15 | In a certain condition, receipt of a specific BGP UPDATE message might cause Juniper Networks Junos OS and Junos OS Evolved devices to advertise an invalid BGP… |
CVE-2020-11660 | Medium | 6.5 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view restricted sensitive information. |
CVE-2020-11659 | Medium | 4.3 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to perform a restricted user administration action. |
CVE-2020-11658 | Critical | 9.8 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier handles shared secret keys in an insecure manner, which allows attackers to bypass authorization. |
CVE-2020-3161 | Critical | 9.8 | 2020-04-15 | A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of… |
CVE-2020-11666 | High | 8.8 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows malicious users to elevate privileges. |
CVE-2020-11665 | Medium | 6.1 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier handles loginRedirect page redirects in an insecure manner, which allows attackers to perform open redirect attacks. |
CVE-2020-11664 | Medium | 6.1 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier handles homeRedirect page redirects in an insecure manner, which allows attackers to perform open redirect attacks. |
CVE-2020-11663 | Medium | 6.1 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier handles 404 requests in an insecure manner, which allows attackers to perform open redirect attacks. |
CVE-2020-11662 | High | 7.5 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier handles requests insecurely, which allows remote attackers to exploit a Cross-Origin Resource Sharing flaw and access… |
CVE-2020-11661 | High | 8.1 | 2020-04-15 | CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view and edit user data. |
CVE-2020-10951 | Medium | 4.7 | 2020-04-15 | Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages. |
CVE-2020-6996 | Critical | 9.8 | 2020-04-15 | Triangle MicroWorks DNP3 Outstation LibrariesDNP3 Outstation .NET Protocol components and DNP3 Outstation ANSI C source code libraries are affected:3.16.00 thr… |
CVE-2020-11799 | Critical | 9.8 | 2020-04-15 | Z-Cron 5.6 Build 04 allows an unprivileged attacker to elevate privileges by modifying a privileged user's task. This can also affect all users who are signed… |