2020 CVEs (page 169)
Page 169 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11490 | High | 7.2 | 2020-04-02 | Manage::Certificates in Zen Load Balancer 3.10.1 allows remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the index.cgi… |
CVE-2020-11458 | Medium | 4.9 | 2020-04-02 | app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the fu… |
CVE-2020-8015 | High | 8.4 | 2020-04-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root… |
CVE-2020-1927 | Medium | 6.1 | 2020-04-02 | In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and… |
CVE-2020-8146 | High | 7.8 | 2020-04-01 | In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. T… |
CVE-2020-8145 | Medium | 6.5 | 2020-04-01 | The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implement sufficient privile… |
CVE-2020-8144 | High | 8.4 | 2020-04-01 | The UniFi Video Server v3.9.3 and prior (for Windows 7/8/10 x64) web interface Firmware Update functionality, under certain circumstances, does not validate fi… |
CVE-2020-6096 | High | 8.1 | 2020-04-01 | An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that util… |
CVE-2020-6009 | Critical | 9.8 | 2020-04-01 | LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection. |
CVE-2020-1958 | Medium | 6.5 | 2020-04-01 | When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.user… |
CVE-2020-11470 | Low | 3.3 | 2020-04-01 | Zoom Client for Meetings through 4.6.8 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to ob… |
CVE-2020-11469 | High | 7.8 | 2020-04-01 | Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during installation, which allows a local process (wi… |
CVE-2020-8966 | Medium | 6.5 | 2020-04-01 | There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS a… |
CVE-2020-1954 | Medium | 5.3 | 2020-04-01 | Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ p… |
CVE-2020-11467 | High | 7.2 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/api/style/edit-them… |
CVE-2020-11466 | Medium | 4.3 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve… |
CVE-2020-11465 | High | 8.8 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/apps/* endpoints failed to properly validate a user's privilege, allowing an attacker to control/i… |
CVE-2020-11464 | Medium | 4.3 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve s… |
CVE-2020-11463 | High | 7.5 | 2020-04-01 | An issue was discovered in Deskpro before 2019.8.0. The /api/email_accounts endpoint failed to properly validate a user's privilege, allowing an attacker to re… |
CVE-2020-10948 | Critical | 9.8 | 2020-04-01 | Jon Hedley AlienForm2 (typically installed as af.cgi or alienform.cgi) 2.0.2 is vulnerable to Remote Command Execution via eval injection, a different issue th… |
CVE-2020-10598 | Medium | 6.1 | 2020-04-01 | In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk… |
CVE-2020-5290 | Medium | 6.5 | 2020-04-01 | In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` hash when making a request to the `/verify… |
CVE-2020-1934 | Medium | 5.3 | 2020-04-01 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. |
CVE-2020-3850 | Critical | 9.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause u… |
CVE-2020-3849 | Critical | 9.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause u… |
CVE-2020-3848 | Critical | 9.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause u… |
CVE-2020-3847 | Critical | 9.8 | 2020-04-01 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to leak memory. |
CVE-2020-1949 | Medium | 6.1 | 2020-04-01 | Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles an… |
CVE-2020-1943 | Medium | 6.1 | 2020-04-01 | Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07. |
CVE-2020-10204 | High | 7.2 | 2020-04-01 | Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. |
CVE-2020-10203 | Medium | 4.8 | 2020-04-01 | Sonatype Nexus Repository before 3.21.2 allows XSS. |
CVE-2020-10199 | High | 8.8 | 2020-04-01 | Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). |
CVE-2020-9785 | High | 7.8 | 2020-04-01 | Multiple memory corruption issues were addressed with improved state management. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS… |
CVE-2020-9784 | Medium | 4.3 | 2020-04-01 | A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1. A malicious iframe may use another website’s download settings. |
CVE-2020-9783 | High | 8.8 | 2020-04-01 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windo… |
CVE-2020-9781 | Medium | 5.3 | 2020-04-01 | The issue was addressed by clearing website permission prompts after navigation. This issue is fixed in iOS 13.4 and iPadOS 13.4. A user may grant website perm… |
CVE-2020-9780 | Low | 3.3 | 2020-04-01 | The issue was resolved by clearing application previews when content is deleted. This issue is fixed in iOS 13.4 and iPadOS 13.4. A local user may be able to v… |
CVE-2020-9777 | Medium | 5.3 | 2020-04-01 | An issue existed in the selection of video file by Mail. The issue was fixed by selecting the latest version of a video. This issue is fixed in iOS 13.4 and iP… |
CVE-2020-9776 | Low | 3.3 | 2020-04-01 | This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to access a user's call his… |
CVE-2020-9775 | Medium | 5.3 | 2020-04-01 | An issue existed in the handling of tabs displaying picture in picture video. The issue was corrected with improved state handling. This issue is fixed in iOS… |
CVE-2020-9773 | Low | 3.3 | 2020-04-01 | The issue was addressed with improved handling of icon caches. This issue is fixed in iOS 14.0 and iPadOS 14.0. A malicious application may be able to identify… |
CVE-2020-9770 | Medium | 6.5 | 2020-04-01 | A logic issue was addressed with improved state management. This issue is fixed in iOS 13.4 and iPadOS 13.4. An attacker in a privileged network position may b… |
CVE-2020-9769 | Critical | 9.8 | 2020-04-01 | Multiple issues were addressed by updating to version 8.1.1850. This issue is fixed in macOS Catalina 10.15.4. Multiple issues in Vim. |
CVE-2020-9768 | High | 7.8 | 2020-04-01 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2. An application m… |
CVE-2020-3919 | High | 7.8 | 2020-04-01 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4… |
CVE-2020-3917 | Medium | 5.5 | 2020-04-01 | This issue was addressed with a new entitlement. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2. An application may be able to use an… |
CVE-2020-3916 | Medium | 5.3 | 2020-04-01 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, watchOS 6.2. Setting an alternate app icon… |
CVE-2020-3914 | Medium | 5.5 | 2020-04-01 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4… |
CVE-2020-3913 | High | 7.8 | 2020-04-01 | A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.1… |
CVE-2020-3912 | High | 7.1 | 2020-04-01 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to cause unexpected… |
CVE-2020-3911 | Critical | 9.8 | 2020-04-01 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2… |
CVE-2020-3910 | Critical | 9.8 | 2020-04-01 | A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2… |
CVE-2020-3909 | Critical | 9.8 | 2020-04-01 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2… |
CVE-2020-3908 | High | 7.1 | 2020-04-01 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to cause unexpected… |
CVE-2020-3907 | High | 7.1 | 2020-04-01 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to cause unexpected… |
CVE-2020-3906 | High | 7.8 | 2020-04-01 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.4. A maliciously crafted application may be able to bypass… |
CVE-2020-3905 | High | 7.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to e… |
CVE-2020-3904 | High | 7.8 | 2020-04-01 | Multiple memory corruption issues were addressed with improved state management. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be… |
CVE-2020-3903 | High | 7.8 | 2020-04-01 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.4. An application may be able to execute arb… |
CVE-2020-3902 | Medium | 6.1 | 2020-04-01 | An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Win… |
CVE-2020-3901 | High | 8.8 | 2020-04-01 | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTune… |
CVE-2020-3900 | High | 8.8 | 2020-04-01 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iT… |
CVE-2020-3899 | High | 8.8 | 2020-04-01 | A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, i… |
CVE-2020-3897 | High | 8.8 | 2020-04-01 | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTune… |
CVE-2020-3895 | High | 8.8 | 2020-04-01 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iT… |
CVE-2020-3894 | Low | 3.1 | 2020-04-01 | A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5… |
CVE-2020-3893 | High | 7.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to e… |
CVE-2020-3892 | High | 7.8 | 2020-04-01 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to e… |
CVE-2020-3891 | Low | 2.4 | 2020-04-01 | A logic issue was addressed with improved state management. This issue is fixed in iOS 13.4 and iPadOS 13.4, watchOS 6.2. A person with physical access to a lo… |
CVE-2020-3890 | Medium | 5.3 | 2020-04-01 | The issue was addressed with improved deletion. This issue is fixed in iOS 13.4 and iPadOS 13.4. Deleted messages groups may still be suggested as an autocompl… |
CVE-2020-3889 | Medium | 5.5 | 2020-04-01 | A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to read arbitrary files. |
CVE-2020-3888 | Medium | 4.3 | 2020-04-01 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4. A maliciously crafted page may interfere with other we… |
CVE-2020-3887 | Medium | 4.3 | 2020-04-01 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iC… |
CVE-2020-3885 | Medium | 4.3 | 2020-04-01 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iC… |
CVE-2020-3884 | Medium | 6.1 | 2020-04-01 | An injection issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A remote attacker may be able to cause arbitrary java… |
CVE-2020-3883 | High | 8.8 | 2020-04-01 | This issue was addressed with improved checks. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. An application… |
CVE-2020-3881 | Medium | 5.5 | 2020-04-01 | A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to view sensitive user info… |
CVE-2020-10868 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to l… |
CVE-2020-10867 | Critical | 9.8 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to b… |
CVE-2020-10866 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to e… |
CVE-2020-10865 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to m… |
CVE-2020-10864 | Medium | 6.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to t… |
CVE-2020-10863 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to t… |
CVE-2020-10862 | High | 7.8 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to a… |
CVE-2020-10861 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to a… |
CVE-2020-10860 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. An Arbitrary Memory Address Overwrite vulnerability in the aswAvLog Log Library results in Denial of Serv… |
CVE-2020-11457 | Medium | 5.4 | 2020-04-01 | pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user. |
CVE-2020-11456 | Medium | 5.4 | 2020-04-01 | LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey… |
CVE-2020-11455 | Critical | 9.8 | 2020-04-01 | LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. |
CVE-2020-11449 | High | 7.5 | 2020-04-01 | An issue was discovered on Technicolor TC7337 8.89.17 devices. An attacker can discover admin credentials in the backup file, aka backupsettings.conf. |
CVE-2020-10231 | High | 7.5 | 2020-04-01 | TP-Link NC200 through 2.1.8_Build_171109, NC210 through 1.0.9_Build_171214, NC220 through 1.3.0_Build_180105, NC230 through 1.3.0_Build_171205, NC250 through 1… |
CVE-2020-7948 | High | 8.8 | 2020-04-01 | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference. |
CVE-2020-7947 | Critical | 9.8 | 2020-04-01 | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sou… |
CVE-2020-6753 | Medium | 6.1 | 2020-04-01 | The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392. |
CVE-2020-5392 | Medium | 6.1 | 2020-04-01 | A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page. |
CVE-2020-5391 | High | 8.8 | 2020-04-01 | Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field. |
CVE-2020-5548 | High | 7.5 | 2020-04-01 | Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yamaha Gigabit VPN Rou… |
CVE-2020-7263 | Medium | 6.5 | 2020-04-01 | Improper access control vulnerability in ESconfigTool.exe in McAfee Endpoint Security (ENS) for Windows all current versions allows local administrator to alte… |
CVE-2020-7066 | Medium | 5.3 | 2020-04-01 | In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) c… |
CVE-2020-7065 | High | 7.4 | 2020-04-01 | In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP… |