2020 CVEs (page 165)
Page 165 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7255 | Low | 3.9 | 2020-04-15 | Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allo… |
CVE-2020-7250 | High | 8.2 | 2020-04-15 | Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to… |
CVE-2020-7277 | Medium | 6.8 | 2020-04-15 | Protection mechanism failure in all processes in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows local users to stop certai… |
CVE-2020-7276 | Medium | 6.4 | 2020-04-15 | Authentication bypass vulnerability in MfeUpgradeTool in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows administrator user… |
CVE-2020-7275 | Medium | 4.8 | 2020-04-15 | Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Up… |
CVE-2020-7274 | Medium | 6.6 | 2020-04-15 | Privilege escalation vulnerability in McTray.exe in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to spawn un… |
CVE-2020-7273 | Medium | 6.7 | 2020-04-15 | Accessing functionality not properly constrained by ACLs vulnerability in the autorun start-up protection in McAfee Endpoint Security (ENS) for Windows Prior t… |
CVE-2020-7261 | Medium | 6.1 | 2020-04-15 | Buffer Overflow via Environment Variables vulnerability in AMSI component in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local u… |
CVE-2020-7259 | Medium | 6.6 | 2020-04-15 | Exploitation of Privilege/Trust vulnerability in file in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local users to bypass local… |
CVE-2020-7257 | High | 8.4 | 2020-04-15 | Privilege escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to cause the deletion… |
CVE-2020-7278 | High | 7.4 | 2020-04-15 | Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 Ap… |
CVE-2020-3932 | High | 7.5 | 2020-04-15 | A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage. |
CVE-2020-10514 | High | 8.8 | 2020-04-15 | iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command. |
CVE-2020-10513 | High | 8.8 | 2020-04-15 | The file management interface of iCatch DVR firmware before 20200103 contains broken access control which allows the attacker to remotely manipulate arbitrary… |
CVE-2020-10512 | High | 8.8 | 2020-04-15 | HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allo… |
CVE-2020-10511 | Critical | 9.8 | 2020-04-15 | HGiga C&Cmail CCMAILQ before olln-base-6.0-418.i386.rpm and CCMAILN before olln-base-5.0-418.i386.rpm contains insecure configurations. Attackers can exploit t… |
CVE-2020-10507 | Critical | 9.8 | 2020-04-15 | The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Unrestricted file upload (RCE) , that would allow at… |
CVE-2020-10506 | High | 7.5 | 2020-04-15 | The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Path Traversal, allowing attackers to access arbitra… |
CVE-2020-10505 | Critical | 9.8 | 2020-04-15 | The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of SQL Injection, an attacker can use a union based inj… |
CVE-2020-11767 | Low | 3.1 | 2020-04-15 | Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection (negotiated with SNI over HTTPS) to *.example.com, a request… |
CVE-2020-5260 | Critical | 9.3 | 2020-04-14 | Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses externa… |
CVE-2020-11765 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, le… |
CVE-2020-11764 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp. |
CVE-2020-11763 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp. |
CVE-2020-11762 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling th… |
CVE-2020-11761 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfF… |
CVE-2020-11760 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp. |
CVE-2020-11759 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineB… |
CVE-2020-11758 | Medium | 5.5 | 2020-04-14 | An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h. |
CVE-2020-11005 | Medium | 5.1 | 2020-04-14 | The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could p… |
CVE-2020-11003 | Medium | 4.8 | 2020-04-14 | Oasis before version 2.15.0 has a potential DNS rebinding or CSRF vulnerability. If you're running a vulnerable application on your computer and an attacker ca… |
CVE-2020-11001 | Medium | 5.8 | 2020-04-14 | In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin int… |
CVE-2020-8327 | High | 7.3 | 2020-04-14 | A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bundled in Lenovo Vantage prior to versio… |
CVE-2020-8324 | Medium | 5.0 | 2020-04-14 | A vulnerability was reported in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation prior to version 1.2.184.31 that could allow unsigned DLL… |
CVE-2020-8319 | High | 7.3 | 2020-04-14 | A privilege escalation vulnerability was reported in Lenovo System Interface Foundation prior to version 1.1.19.3 that could allow an authenticated user to exe… |
CVE-2020-8318 | High | 7.3 | 2020-04-14 | A privilege escalation vulnerability was reported in the LenovoSystemUpdatePlugin for Lenovo System Interface Foundation prior to version that could allow an a… |
CVE-2020-8316 | Medium | 4.4 | 2020-04-14 | A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to read files on the system with elevated p… |
CVE-2020-9384 | High | 8.8 | 2020-04-14 | An Insecure Direct Object Reference (IDOR) vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users… |
CVE-2020-7575 | Medium | 6.1 | 2020-04-14 | A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cr… |
CVE-2020-7574 | Medium | 6.1 | 2020-04-14 | A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cr… |
CVE-2020-6225 | High | 8.8 | 2020-04-14 | SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.31, 7.40, 7.50), does not sufficiently va… |
CVE-2020-6217 | Medium | 6.1 | 2020-04-14 | SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode… |
CVE-2020-6215 | Medium | 6.1 | 2020-04-14 | SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redire… |
CVE-2020-6211 | Medium | 6.1 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious site due to insufficie… |
CVE-2020-6195 | Critical | 9.8 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It in… |
CVE-2020-11723 | Medium | 5.5 | 2020-04-14 | Cellebrite UFED 5.0 through 7.29 uses four hardcoded RSA private keys to authenticate to the ADB daemon on target devices. Extracted keys can be used to place… |
CVE-2020-6238 | Critical | 9.3 | 2020-04-14 | SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Valida… |
CVE-2020-6237 | High | 7.5 | 2020-04-14 | Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attacker to access informa… |
CVE-2020-6236 | High | 7.2 | 2020-04-14 | SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permiss… |
CVE-2020-6235 | High | 8.6 | 2020-04-14 | SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalities of the Collector Simulator, leading to… |
CVE-2020-6234 | High | 7.2 | 2020-04-14 | SAP Host Agent, version 7.21, allows an attacker with admin privileges to use the operation framework to gain root privileges over the underlying operating sys… |
CVE-2020-6233 | Medium | 4.3 | 2020-04-14 | SAP S/4 HANA (Financial Products Subledger and Banking Services), versions - FSAPPL 400, 450, 500 and S4FPSL 100, allows an authenticated user to run an analys… |
CVE-2020-6232 | Medium | 5.3 | 2020-04-14 | SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check. This affects conf… |
CVE-2020-6231 | Medium | 5.4 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, result… |
CVE-2020-6230 | High | 7.2 | 2020-04-14 | SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and le… |
CVE-2020-6229 | Medium | 6.1 | 2020-04-14 | SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75… |
CVE-2020-6228 | High | 7.5 | 2020-04-14 | SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain conditions to modify… |
CVE-2020-6227 | High | 7.5 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP packets to several ser… |
CVE-2020-6226 | Medium | 5.4 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, result… |
CVE-2020-6224 | Medium | 6.2 | 2020-04-14 | SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensit… |
CVE-2020-6223 | Medium | 6.1 | 2020-04-14 | The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malici… |
CVE-2020-6222 | Medium | 5.4 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user-controlled inputs… |
CVE-2020-6221 | Medium | 5.4 | 2020-04-14 | Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs… |
CVE-2020-6219 | High | 8.8 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an atta… |
CVE-2020-6218 | Medium | 5.0 | 2020-04-14 | Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should o… |
CVE-2020-6216 | Medium | 6.1 | 2020-04-14 | SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cr… |
CVE-2020-6214 | Medium | 4.7 | 2020-04-14 | SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. Although the affected reports are protected wi… |
CVE-2020-10384 | High | 7.8 | 2020-04-14 | An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. There is a local privilege escalation from… |
CVE-2020-7802 | Medium | 5.3 | 2020-04-14 | The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Incorrect Default Permissions (CWE-276) vulnerability. T… |
CVE-2020-7801 | Medium | 5.3 | 2020-04-14 | The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Exposure of Sensitive Information to an Unauthorized Act… |
CVE-2020-7800 | High | 8.2 | 2020-04-14 | The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Improper Check for Unusual or Exceptional Conditions (CW… |
CVE-2020-10383 | Critical | 9.8 | 2020-04-14 | An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an unauthenticated remote code ex… |
CVE-2020-10382 | High | 8.8 | 2020-04-14 | An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an authenticated remote code exec… |
CVE-2020-10381 | Medium | 5.3 | 2020-04-14 | An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an unauthenticated SQL injection… |
CVE-2020-7958 | Medium | 6.0 | 2020-04-14 | An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user (root) in… |
CVE-2020-9461 | Medium | 5.4 | 2020-04-14 | Octech Oempro 4.7 through 4.11 allow stored XSS by an authenticated user. The FolderName parameter of the Media.CreateFolder command is vulnerable. |
CVE-2020-9460 | Medium | 5.4 | 2020-04-14 | Octech Oempro 4.7 through 4.11 allow XSS by an authenticated user. The parameter CampaignName in Campaign.Create is vulnerable. |
CVE-2020-9004 | High | 8.8 | 2020-04-14 | A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the admini… |
CVE-2020-4151 | Medium | 6.5 | 2020-04-14 | IBM QRadar SIEM 7.3.0 through 7.3.3 could allow an authenticated attacker to perform unauthorized actions due to improper input validation. IBM X-Force ID: 174… |
CVE-2020-5739 | High | 8.8 | 2020-04-14 | Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to t… |
CVE-2020-5738 | High | 8.8 | 2020-04-14 | Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted ta… |
CVE-2020-11743 | Medium | 5.5 | 2020-04-14 | An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant ta… |
CVE-2020-11742 | Medium | 5.5 | 2020-04-14 | An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in GNTTABOP_copy. Gran… |
CVE-2020-11741 | High | 8.8 | 2020-04-14 | An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests… |
CVE-2020-11740 | Medium | 5.5 | 2020-04-14 | An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guest… |
CVE-2020-11739 | High | 7.8 | 2020-04-14 | An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barri… |
CVE-2020-11738 | High | 7.5 | 2020-04-13 | The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to du… |
CVE-2020-1730 | Medium | 5.3 | 2020-04-13 | A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could… |
CVE-2020-11736 | Low | 3.9 | 2020-04-13 | fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is… |
CVE-2020-10646 | High | 7.8 | 2020-04-13 | Fuji Electric V-Server Lite all versions prior to 4.0.9.0 contains a heap based buffer overflow. The buffer allocated to read data, when parsing VPR files, is… |
CVE-2020-10642 | High | 7.8 | 2020-04-13 | In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registry key, which could lead to the executio… |
CVE-2020-6456 | Medium | 6.5 | 2020-04-13 | Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isolation via crafted cl… |
CVE-2020-6455 | High | 8.8 | 2020-04-13 | Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6454 | High | 8.8 | 2020-04-13 | Use after free in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to potentially ex… |
CVE-2020-6452 | High | 8.8 | 2020-04-13 | Heap buffer overflow in media in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6451 | High | 8.8 | 2020-04-13 | Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6450 | High | 8.8 | 2020-04-13 | Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6448 | High | 8.8 | 2020-04-13 | Use after free in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6447 | High | 8.8 | 2020-04-13 | Inappropriate implementation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to… |
CVE-2020-6446 | Medium | 6.5 | 2020-04-13 | Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a craft… |