2020 CVEs (page 161)
Page 161 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10615 | High | 7.5 | 2020-04-15 | Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers cause a denial-of-service condition due to… |
CVE-2020-10613 | High | 7.5 | 2020-04-15 | Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers to disclose sensitive information due to th… |
CVE-2020-10611 | Critical | 9.8 | 2020-04-15 | Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers to execute arbitrary code due to the lack o… |
CVE-2020-5350 | High | 7.9 | 2020-04-15 | Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authent… |
CVE-2020-5346 | Medium | 4.8 | 2020-04-15 | RSA Authentication Manager versions prior to 8.4 P11 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authenticatio… |
CVE-2020-3954 | Medium | 6.1 | 2020-04-15 | Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation. |
CVE-2020-3953 | Medium | 4.8 | 2020-04-15 | Cross Site Scripting (XSS) vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation. |
CVE-2020-11792 | High | 7.5 | 2020-04-15 | NETGEAR R8900, R9000, RAX120, and XR700 devices before 2020-01-20 are affected by Transport Layer Security (TLS) certificate private key disclosure. |
CVE-2020-11791 | Medium | 6.1 | 2020-04-15 | NETGEAR JGS516PE devices before 2.6.0.43 are affected by reflected XSS. |
CVE-2020-11790 | Critical | 9.8 | 2020-04-15 | NETGEAR R7800 devices before 1.0.2.68 are affected by remote code execution by unauthenticated attackers. |
CVE-2020-11789 | Critical | 9.8 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1.0.4.84, R6700 before 1.0.2.8, R6700v3 b… |
CVE-2020-11788 | High | 8.8 | 2020-04-15 | Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.34, D7000 before 1.0.1.68, PR2000 before 1.0.0.28, R6050 before… |
CVE-2020-11787 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-6992 | Medium | 6.7 | 2020-04-15 | A local privilege escalation vulnerability has been identified in the GE Digital CIMPLICITY HMI/SCADA product v10.0 and prior. If exploited, this vulnerability… |
CVE-2020-11786 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11785 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11784 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-10639 | High | 7.8 | 2020-04-15 | Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A specially crafted i… |
CVE-2020-10637 | Medium | 5.5 | 2020-04-15 | Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A specially crafted i… |
CVE-2020-0600 | High | 7.8 | 2020-04-15 | Improper buffer restrictions in firmware for some Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2020-0598 | High | 7.8 | 2020-04-15 | Uncontrolled search path in the installer for the Intel(R) Binary Configuration Tool for Windows, all versions, may allow an authenticated user to potentially… |
CVE-2020-0578 | High | 8.8 | 2020-04-15 | Improper conditions check for Intel(R) Modular Server MFS2600KISPP Compute Module may allow an unauthenticated user to potentially enable escalation of privile… |
CVE-2020-0577 | High | 8.8 | 2020-04-15 | Insufficient control flow for Intel(R) Modular Server MFS2600KISPP Compute Module may allow an unauthenticated user to potentially enable escalation of privile… |
CVE-2020-0576 | Medium | 6.5 | 2020-04-15 | Buffer overflow in Intel(R) Modular Server MFS2600KISPP Compute Module may allow an unauthenticated user to potentially enable denial of service via adjacent a… |
CVE-2020-0568 | Medium | 4.7 | 2020-04-15 | Race condition in the Intel(R) Driver and Support Assistant before version 20.1.5 may allow an authenticated user to potentially enable denial of service via l… |
CVE-2020-0558 | Medium | 6.5 | 2020-04-15 | Improper buffer restrictions in kernel mode driver for Intel(R) PROSet/Wireless WiFi products before version 21.70 on Windows 10 may allow an unprivileged user… |
CVE-2020-0557 | High | 7.8 | 2020-04-15 | Insecure inherited permissions in Intel(R) PROSet/Wireless WiFi products before version 21.70 on Windows 10 may allow an authenticated user to potentially enab… |
CVE-2020-0547 | High | 7.8 | 2020-04-15 | Incorrect default permissions in the installer for Intel(R) Data Migration Software versions 3.3 and earlier may allow an authenticated user to potentially ena… |
CVE-2020-8948 | High | 7.8 | 2020-04-15 | The Sierra Wireless Windows Mobile Broadband Driver Packages (MBDP) before build 5043 allows an unprivileged user to overwrite arbitrary files in arbitrary fol… |
CVE-2020-4294 | Medium | 6.3 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 is vulnerable to Server Side Request Forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests f… |
CVE-2020-4274 | Medium | 5.4 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to access data and perform unauthorized actions due to inadequate permission checks. IBM X-… |
CVE-2020-4272 | High | 8.8 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted request specify a… |
CVE-2020-4271 | Medium | 6.3 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to send a specially crafted command which would be executed as a lower privileged user. IBM… |
CVE-2020-4270 | High | 7.8 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a local user to gain escalated privileges due to weak file permissions. IBM X-ForceID: 175846. |
CVE-2020-4269 | High | 7.5 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, o… |
CVE-2020-4268 | Medium | 5.4 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2020-11783 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11782 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11781 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11780 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11779 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11729 | Critical | 9.8 | 2020-04-15 | An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not… |
CVE-2020-11728 | High | 7.5 | 2020-04-15 | An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone… |
CVE-2020-1094 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations, aka 'Windows Work Folder Service Elevat… |
CVE-2020-1050 | Medium | 6.1 | 2020-04-15 | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected… |
CVE-2020-1049 | Medium | 5.4 | 2020-04-15 | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected… |
CVE-2020-1029 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Connected User Ex… |
CVE-2020-1027 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnera… |
CVE-2020-1026 | Critical | 9.8 | 2020-04-15 | A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cry… |
CVE-2020-1022 | High | 8.0 | 2020-04-15 | A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'. |
CVE-2020-1020 | High | 8.8 | 2020-04-15 | A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-mast… |
CVE-2020-1019 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists in RMS Sharing App for Mac in the way it allows an attacker to load unsigned binaries, aka 'Microsoft RMS Sharin… |
CVE-2020-1018 | High | 7.5 | 2020-04-15 | An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when… |
CVE-2020-1017 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists in the way the Windows Push Notification Service handles objects in memory, aka 'Windows Push Notification Servi… |
CVE-2020-1016 | Medium | 5.5 | 2020-04-15 | An information disclosure vulnerability exists when the Windows Push Notification Service improperly handles objects in memory, aka 'Windows Push Notification… |
CVE-2020-1015 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists in the way that the User-Mode Power Service (UMPS) handles objects in memory, aka 'Windows Elevation of Privileg… |
CVE-2020-1014 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Windows Updat… |
CVE-2020-1011 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists when the Windows System Assessment Tool improperly handles file operations, aka 'Windows Elevation of Privilege… |
CVE-2020-1009 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists in the way that the Microsoft Store Install Service handles file operations in protected locations, aka 'Windows… |
CVE-2020-1008 | High | 7.8 | 2020-04-15 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2020-1007 | Medium | 5.5 | 2020-04-15 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2020-1006 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists in the way the Windows Push Notification Service handles objects in memory, aka 'Windows Push Notification Servi… |
CVE-2020-1005 | Medium | 5.5 | 2020-04-15 | An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory, aka 'Microsoft Graphics Comp… |
CVE-2020-1004 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevat… |
CVE-2020-1003 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2020-1002 | High | 7.1 | 2020-04-15 | An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations.To exploit the vulnerability, an… |
CVE-2020-1001 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists in the way the Windows Push Notification Service handles objects in memory, aka 'Windows Push Notification Servi… |
CVE-2020-1000 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2020-11537 | Critical | 9.8 | 2020-04-15 | A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Web… |
CVE-2020-11536 | Critical | 9.8 | 2020-04-15 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary a… |
CVE-2020-11535 | Critical | 9.8 | 2020-04-15 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-contr… |
CVE-2020-11534 | Critical | 9.8 | 2020-04-15 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass pa… |
CVE-2020-0999 | High | 7.8 | 2020-04-15 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2020-0996 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists when the Windows Update Stack fails to properly handle objects in memory, aka 'Windows Update Stack Elevation of… |
CVE-2020-0995 | High | 7.8 | 2020-04-15 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2020-0994 | High | 7.8 | 2020-04-15 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2020-0993 | Medium | 6.5 | 2020-04-15 | A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries, aka 'Windows DNS Denial of Service Vulnerability'. |
CVE-2020-0992 | High | 7.8 | 2020-04-15 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2020-0991 | High | 7.8 | 2020-04-15 | A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office R… |
CVE-2020-0988 | High | 7.8 | 2020-04-15 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2020-0987 | Medium | 5.5 | 2020-04-15 | An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory, aka 'Microsoft Graphics Comp… |
CVE-2020-0985 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists when the Windows Update Stack fails to properly handle objects in memory, aka 'Windows Update Stack Elevation of… |
CVE-2020-0984 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists when the Microsoft AutoUpdate (MAU) application for Mac improperly validates updates before executing them, aka… |
CVE-2020-0983 | High | 7.8 | 2020-04-15 | An elevation of privilege vulnerability exists when the Windows Delivery Optimization service improperly handles objects in memory, aka 'Windows Elevation of P… |
CVE-2020-0982 | Medium | 5.5 | 2020-04-15 | An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory, aka 'Microsoft Graphics Comp… |
CVE-2020-0981 | High | 8.8 | 2020-04-15 | A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker who successfully exploited the vulnerabili… |
CVE-2020-0980 | High | 7.8 | 2020-04-15 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Exe… |
CVE-2020-0979 | High | 8.8 | 2020-04-15 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
CVE-2020-0978 | Medium | 5.4 | 2020-04-15 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2020-0977 | Medium | 5.4 | 2020-04-15 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, a… |
CVE-2020-0976 | Medium | 5.4 | 2020-04-15 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, a… |
CVE-2020-0975 | Medium | 5.4 | 2020-04-15 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, a… |
CVE-2020-0974 | High | 8.8 | 2020-04-15 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso… |
CVE-2020-0973 | Medium | 5.4 | 2020-04-15 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2020-0972 | Medium | 5.4 | 2020-04-15 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, a… |
CVE-2020-0971 | High | 8.8 | 2020-04-15 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso… |
CVE-2020-0970 | High | 7.5 | 2020-04-15 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption… |
CVE-2020-0969 | High | 7.5 | 2020-04-15 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Chakra… |
CVE-2020-0968 | High | 7.5 | 2020-04-15 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory… |
CVE-2020-0967 | High | 8.8 | 2020-04-15 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'… |