2020 CVEs (page 168)
Page 168 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11595 | High | 7.5 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the upload folder path that i… |
CVE-2020-11594 | High | 7.5 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that causes a stack error to be shown pr… |
CVE-2020-11593 | High | 7.5 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is la… |
CVE-2020-11592 | High | 7.5 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the columns of a specific table… |
CVE-2020-11591 | Medium | 5.3 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the full application path alo… |
CVE-2020-11590 | Medium | 5.3 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the i… |
CVE-2020-11589 | High | 7.5 | 2020-04-06 | An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make a GET request to a cer… |
CVE-2020-11588 | Medium | 5.3 | 2020-04-06 | An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to two files that contain customer… |
CVE-2020-11585 | Medium | 4.3 | 2020-04-06 | There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A register… |
CVE-2020-11582 | High | 8.8 | 2020-04-06 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients wh… |
CVE-2020-11581 | High | 8.1 | 2020-04-06 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients wh… |
CVE-2020-11580 | Critical | 9.1 | 2020-04-06 | An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients wh… |
CVE-2020-5832 | High | 7.8 | 2020-04-06 | Symantec Data Center Security Manager Component, prior to 6.8.2 (aka 6.8 MP2), may be susceptible to a privilege escalation vulnerability, which is a type of i… |
CVE-2020-5300 | Medium | 5.8 | 2020-04-06 | In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method… |
CVE-2020-11545 | Critical | 9.8 | 2020-04-06 | Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname an… |
CVE-2020-11544 | High | 7.2 | 2020-04-06 | An issue was discovered in Project Worlds Official Car Rental System 1. It allows the admin user to run commands on the server with their account because the u… |
CVE-2020-11507 | High | 7.8 | 2020-04-06 | An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner 8.0.3 could cause arbitrary code execution with SYSTEM privileges when a malicious DLL librar… |
CVE-2020-11102 | Medium | 5.6 | 2020-04-06 | hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data length. |
CVE-2020-9473 | Medium | 6.6 | 2020-04-06 | The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 has a passwordless ftp ssh user. By using an exploit chain, an attacker with access to the network c… |
CVE-2020-7622 | Medium | 6.5 | 2020-04-06 | This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validat… |
CVE-2020-1728 | Medium | 4.8 | 2020-04-06 | A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP securit… |
CVE-2020-8004 | High | 7.5 | 2020-04-06 | STMicroelectronics STM32F1 devices have Incorrect Access Control. |
CVE-2020-7639 | Medium | 5.3 | 2020-04-06 | eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototy… |
CVE-2020-7638 | Medium | 5.3 | 2020-04-06 | confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prot… |
CVE-2020-7637 | Medium | 5.3 | 2020-04-06 | class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying pro… |
CVE-2020-7636 | Critical | 9.8 | 2020-04-06 | adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function. |
CVE-2020-7635 | Critical | 9.8 | 2020-04-06 | compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument. |
CVE-2020-7634 | Critical | 9.8 | 2020-04-06 | heroku-addonpool through 0.1.15 is vulnerable to Command Injection. |
CVE-2020-7633 | Critical | 9.8 | 2020-04-06 | apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument. |
CVE-2020-7632 | Critical | 9.8 | 2020-04-06 | node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument. |
CVE-2020-7631 | Critical | 9.8 | 2020-04-06 | diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument. |
CVE-2020-10267 | High | 7.5 | 2020-04-06 | Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual pr… |
CVE-2020-10266 | High | 8.1 | 2020-04-06 | UR+ (Universal Robots+) is a platform of hardware and software component sellers, for Universal Robots robots. When installing any of these components in the r… |
CVE-2020-10265 | Critical | 9.4 | 2020-04-06 | Universal Robots Robot Controllers Version CB2 SW Version 1.4 upwards, CB3 SW Version 3.0 and upwards, e-series SW Version 5.0 and upwards expose a service cal… |
CVE-2020-10264 | High | 8.8 | 2020-04-06 | CB3 SW Version 3.3 and upwards, e-series SW Version 5.0 and upwards allow authenticated access to the RTDE (Real-Time Data Exchange) interface on port 30004 wh… |
CVE-2020-11565 | Medium | 6.0 | 2020-04-06 | An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is… |
CVE-2020-11558 | Critical | 9.8 | 2020-04-05 | An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. audio_sample_entry_Read in isomedia/box_code_base.c does not properly decide whe… |
CVE-2020-11548 | Critical | 9.8 | 2020-04-05 | The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code e… |
CVE-2020-11547 | Medium | 5.3 | 2020-04-05 | PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, me… |
CVE-2020-11542 | Critical | 9.8 | 2020-04-04 | 3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpret… |
CVE-2020-11533 | Medium | 5.5 | 2020-04-04 | Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material). |
CVE-2020-11529 | Medium | 6.1 | 2020-04-04 | Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x. |
CVE-2020-11528 | High | 7.5 | 2020-04-04 | bit2spr 1992-06-07 has a stack-based buffer overflow (129-byte write) in conv_bitmap in bit2spr.c via a long line in a bitmap file. |
CVE-2020-11527 | High | 7.5 | 2020-04-04 | In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files. |
CVE-2020-11518 | Critical | 9.8 | 2020-04-04 | Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution. |
CVE-2020-5348 | Medium | 6.8 | 2020-04-04 | Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFI_BOOT_SERVICES in system management mode. A local unauthenticated… |
CVE-2020-5347 | Medium | 5.3 | 2020-04-04 | Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop… |
CVE-2020-8147 | Critical | 9.8 | 2020-04-03 | Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or… |
CVE-2020-8143 | Medium | 6.1 | 2020-04-03 | An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged… |
CVE-2020-8142 | Medium | 6.8 | 2020-04-03 | A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many othe… |
CVE-2020-8639 | High | 8.8 | 2020-04-03 | An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uploading a file with a… |
CVE-2020-8638 | Critical | 9.8 | 2020-04-03 | A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency parameter. |
CVE-2020-8637 | Critical | 9.8 | 2020-04-03 | A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter. |
CVE-2020-6994 | Critical | 9.8 | 2020-04-03 | A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing o… |
CVE-2020-7008 | High | 7.5 | 2020-04-03 | VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL that is not properly verified before use, which may allow an… |
CVE-2020-7004 | High | 8.8 | 2020-04-03 | VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow weak or insecure permissions on the VBASE directory resulting in elevation of privile… |
CVE-2020-7000 | High | 7.5 | 2020-04-03 | VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from the web server and… |
CVE-2020-10601 | High | 7.8 | 2020-04-03 | VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module allow weak hashing algorithm and insecure permissions which may allow a local attacker to bypas… |
CVE-2020-10599 | Critical | 9.8 | 2020-04-03 | VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow a vulnerable ActiveX component to be exploited resulting in a buffer overflow, which… |
CVE-2020-10960 | Medium | 5.3 | 2020-04-03 | In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface)… |
CVE-2020-10689 | Medium | 6.4 | 2020-04-03 | A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this fl… |
CVE-2020-4273 | High | 7.8 | 2020-04-03 | IBM Spectrum Scale 4.2 and 5.0 could allow a local unprivileged attacker with intimate knowledge of the enviornment to execute commands as root using specially… |
CVE-2020-11501 | High | 7.4 | 2020-04-03 | GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit… |
CVE-2020-11500 | High | 7.5 | 2020-04-03 | Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Within a meeting, all participants use a single 128-bit key. |
CVE-2020-5283 | Low | 3.1 | 2020-04-03 | ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need f… |
CVE-2020-11499 | Medium | 6.1 | 2020-04-02 | Firmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the… |
CVE-2020-11498 | High | 8.8 | 2020-04-02 | Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun… |
CVE-2020-7630 | Critical | 9.8 | 2020-04-02 | git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument. |
CVE-2020-7629 | Critical | 9.8 | 2020-04-02 | install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument. |
CVE-2020-7628 | Critical | 9.8 | 2020-04-02 | umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization. |
CVE-2020-7627 | Critical | 9.8 | 2020-04-02 | node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute()' fu… |
CVE-2020-7626 | Critical | 9.8 | 2020-04-02 | karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument. |
CVE-2020-7625 | Critical | 9.8 | 2020-04-02 | op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function. |
CVE-2020-7624 | Critical | 9.8 | 2020-04-02 | effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument. |
CVE-2020-10515 | Critical | 9.8 | 2020-04-02 | STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006. |
CVE-2020-9067 | High | 8.0 | 2020-04-02 | There is a buffer overflow vulnerability in some Huawei products. The vulnerability can be exploited by an attacker to perform remote code execution on the aff… |
CVE-2020-7623 | Critical | 9.8 | 2020-04-02 | jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument. |
CVE-2020-7621 | Critical | 9.8 | 2020-04-02 | strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function. |
CVE-2020-7620 | Critical | 9.8 | 2020-04-02 | pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params. |
CVE-2020-7619 | Critical | 9.8 | 2020-04-02 | get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data. |
CVE-2020-11494 | Medium | 4.4 | 2020-04-02 | An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attackers to read uninitialized can_frame data… |
CVE-2020-8835 | High | 7.8 | 2020-04-02 | In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to o… |
CVE-2020-7617 | Medium | 4.4 | 2020-04-02 | ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__p… |
CVE-2020-11444 | High | 8.8 | 2020-04-02 | Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control. |
CVE-2020-11107 | High | 8.8 | 2020-04-02 | An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration i… |
CVE-2020-8423 | High | 7.2 | 2020-04-02 | A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary c… |
CVE-2020-11453 | Medium | 5.3 | 2020-04-02 | Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The funct… |
CVE-2020-11452 | Medium | 4.3 | 2020-04-02 | Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an externa… |
CVE-2020-9349 | High | 7.5 | 2020-04-02 | The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password. |
CVE-2020-6852 | Critical | 9.8 | 2020-04-02 | CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any… |
CVE-2020-4325 | Medium | 6.5 | 2020-04-02 | The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not properly shutdown the thread pools that i… |
CVE-2020-4304 | Medium | 6.1 | 2020-04-02 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary… |
CVE-2020-4303 | Medium | 6.1 | 2020-04-02 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary… |
CVE-2020-11454 | Medium | 5.4 | 2020-04-02 | Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard… |
CVE-2020-11451 | High | 7.2 | 2020-04-02 | The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files with arbitrary exten… |
CVE-2020-11450 | High | 7.5 | 2020-04-02 | Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStrategyWS/happyaxis.j… |
CVE-2020-11100 | High | 8.8 | 2020-04-02 | In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain l… |
CVE-2020-8017 | Medium | 6.2 | 2020-04-02 | A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications… |
CVE-2020-8016 | Medium | 4.9 | 2020-04-02 | A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1… |
CVE-2020-11491 | Medium | 4.9 | 2020-04-02 | Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attacks, as demonstrated by a filelog=/etc/s… |