2020 CVEs (page 17)
Page 17 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-12929 | High | 7.8 | 2021-11-15 | Improper parameters validation in some trusted applications of the PSP contained in the AMD Graphics Driver may allow a local attacker to bypass security restr… |
CVE-2020-12920 | Medium | 5.5 | 2021-11-15 | A potential denial of service issue exists in the AMD Display driver Escape 0x130007 Call handler. An attacker with low privilege could potentially induce a Wi… |
CVE-2020-12904 | Medium | 5.5 | 2021-11-15 | Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004203 may lead to arbitrary information disclosure. |
CVE-2020-12902 | High | 7.8 | 2021-11-15 | Arbitrary Decrement Privilege Escalation in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service. |
CVE-2020-12900 | High | 7.8 | 2021-11-15 | An arbitrary write vulnerability in the AMD Radeon Graphics Driver for Windows 10 potentially allows unprivileged users to gain Escalation of Privileges and ca… |
CVE-2020-12899 | High | 7.1 | 2021-11-15 | Arbitrary Read in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or denial of service. |
CVE-2020-12897 | Medium | 5.5 | 2021-11-15 | Kernel Pool Address disclosure in AMD Graphics Driver for Windows 10 may lead to KASLR bypass. |
CVE-2020-12895 | High | 7.8 | 2021-11-15 | Pool/Heap Overflow in AMD Graphics Driver for Windows 10 in Escape 0x110037 may lead to escalation of privilege, information disclosure or denial of service. |
CVE-2020-12964 | High | 7.8 | 2021-11-15 | A potential privilege escalation/denial of service issue exists in the AMD Radeon Kernel Mode driver Escape 0x2000c00 Call handler. An attacker with low privil… |
CVE-2020-16152 | Critical | 9.8 | 2021-11-14 | The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP cod… |
CVE-2020-14424 | Medium | 6.1 | 2021-11-14 | Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme. |
CVE-2020-21141 | High | 8.8 | 2021-11-12 | iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add. |
CVE-2020-4146 | Medium | 5.3 | 2021-11-12 | IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A remote attacker cou… |
CVE-2020-4140 | Medium | 5.4 | 2021-11-12 | IBM Security SiteProtector System 3.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2020-23906 | Medium | 5.5 | 2021-11-10 | FFmpeg N-98388-g76a3ee996b allows attackers to cause a denial of service (DoS) via a crafted audio file due to insufficient verification of data authenticity. |
CVE-2020-23904 | Medium | 5.5 | 2021-11-10 | A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file. NOTE: the vendor states "I cann… |
CVE-2020-23903 | Medium | 5.5 | 2021-11-10 | A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file. |
CVE-2020-23902 | Medium | 5.5 | 2021-11-10 | A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. Related to Data from Faulting Address may… |
CVE-2020-23901 | Medium | 5.5 | 2021-11-10 | A User Mode Write AV in Editor+0x5d15 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. |
CVE-2020-23900 | Medium | 5.5 | 2021-11-10 | A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. Related to Data from Faulting Address cont… |
CVE-2020-23899 | Medium | 5.5 | 2021-11-10 | A User Mode Write AV in Editor+0x5f91 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. |
CVE-2020-23898 | Medium | 5.5 | 2021-11-10 | A User Mode Write AV in Editor+0x5ea2 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. |
CVE-2020-23897 | Medium | 5.5 | 2021-11-10 | A User Mode Write AV in Editor!TMethodImplementationIntercept+0x54dcec of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted… |
CVE-2020-23896 | Medium | 5.5 | 2021-11-10 | A User Mode Write AV in Editor+0x576b of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file. |
CVE-2020-23895 | Medium | 5.5 | 2021-11-10 | A User Mode Write AV in Editor+0x76af of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file. |
CVE-2020-23894 | Medium | 5.5 | 2021-11-10 | A User Mode Write AV in ntdll!RtlpCoalesceFreeBlocks+0x268 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file. |
CVE-2020-23893 | Medium | 5.5 | 2021-11-10 | A User Mode Write AV in Editor!TMethodImplementationIntercept+0x3c3682 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted… |
CVE-2020-23891 | Medium | 5.5 | 2021-11-10 | A User Mode Write AV in Editor+0x5cd7 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file. |
CVE-2020-23890 | Medium | 5.5 | 2021-11-10 | A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted JPG file. Related to Data from Faulting Address is u… |
CVE-2020-23889 | Medium | 5.5 | 2021-11-10 | A User Mode Write AV starting at Editor!TMethodImplementationIntercept+0x4189c6 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via… |
CVE-2020-23888 | Medium | 5.5 | 2021-11-10 | A User Mode Write AV in Editor!TMethodImplementationIntercept+0x53f6c3 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted… |
CVE-2020-23887 | Medium | 5.5 | 2021-11-10 | XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service (DoS) via a crafted ico file. Related to a Read… |
CVE-2020-23886 | Medium | 5.5 | 2021-11-10 | XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service (DoS) via a crafted pict file. Related to a Use… |
CVE-2020-23884 | Medium | 5.5 | 2021-11-10 | A buffer overflow in Nomacs v3.15.0 allows attackers to cause a denial of service (DoS) via a crafted MNG file. |
CVE-2020-23879 | High | 7.5 | 2021-11-10 | pdf2json v0.71 was discovered to contain a NULL pointer dereference in the component ObjectStream::getObject. |
CVE-2020-23878 | Critical | 9.8 | 2021-11-10 | pdf2json v0.71 was discovered to contain a stack buffer overflow in the component XRef::fetch. |
CVE-2020-23877 | Critical | 9.8 | 2021-11-10 | pdf2xml v2.0 was discovered to contain a stack buffer overflow in the component getObjectStream. |
CVE-2020-23876 | High | 7.5 | 2021-11-10 | pdf2xml v2.0 was discovered to contain a memory leak in the function TextPage::testLinkedText. |
CVE-2020-23874 | Critical | 9.8 | 2021-11-10 | pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode. |
CVE-2020-23873 | Critical | 9.8 | 2021-11-10 | pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::dump. |
CVE-2020-23872 | High | 7.5 | 2021-11-10 | A NULL pointer dereference in the function TextPage::restoreState of pdf2xml v2.0 allows attackers to cause a denial of service (DoS). |
CVE-2020-28137 | Medium | 6.5 | 2021-11-10 | Cross site request forgery (CSRF) in Genexis Platinum 4410 V2-1.28, allows attackers to cause a denial of service by continuously restarting the router. |
CVE-2020-12488 | Medium | 5.5 | 2021-11-10 | The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permi… |
CVE-2020-28419 | High | 8.8 | 2021-11-09 | During installation with certain driver software or application packages an arbitrary code execution could occur. |
CVE-2020-10054 | Medium | 5.5 | 2021-11-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application does not properly handle the import of la… |
CVE-2020-10053 | Medium | 5.5 | 2021-11-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application writes sensitive data, such as database c… |
CVE-2020-10052 | Medium | 5.5 | 2021-11-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application writes sensitive data, such as usernames… |
CVE-2020-23572 | High | 8.8 | 2021-11-08 | BEESCMS v4.0 was discovered to contain an arbitrary file upload vulnerability via the component /admin/upload.php. This vulnerability allows attackers to execu… |
CVE-2020-4160 | Medium | 5.9 | 2021-11-08 | IBM QRadar Network Security 5.4.0 and 5.5.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict… |
CVE-2020-4153 | Medium | 5.4 | 2021-11-08 | IBM QRadar Network Security 5.4.0 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2020-4152 | Medium | 5.9 | 2021-11-08 | IBM QRadar Network Security 5.4.0 and 5.5.0 transmits sensitive or security-critical data in cleartext in a communication channel that can be obtained using ma… |
CVE-2020-22226 | Critical | 9.8 | 2021-11-05 | Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionSetAmount function. |
CVE-2020-22225 | Critical | 9.8 | 2021-11-05 | Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoadForm function. |
CVE-2020-22224 | Medium | 6.1 | 2021-11-05 | Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionPreview function. |
CVE-2020-22223 | Critical | 9.8 | 2021-11-05 | Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoad function. |
CVE-2020-22222 | Medium | 6.1 | 2021-11-05 | Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionLoadCss function. |
CVE-2020-23567 | Medium | 5.5 | 2021-11-05 | Irfanview v4.53 allows attackers to to cause a denial of service (DoS) via a crafted JPEG 2000 file. Related to "Integer Divide By Zero starting at JPEG2000!Sh… |
CVE-2020-23566 | Medium | 5.5 | 2021-11-05 | Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8. |
CVE-2020-23565 | High | 7.8 | 2021-11-05 | Irfanview v4.53 allows attackers to execute arbitrary code via a crafted JPEG 2000 file. Related to a "Data from Faulting Address controls Branch Selection sta… |
CVE-2020-21139 | Medium | 6.5 | 2021-11-04 | EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add admin accounts via /adm… |
CVE-2020-25368 | Critical | 9.8 | 2021-11-04 | A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbit… |
CVE-2020-25366 | Critical | 9.1 | 2021-11-04 | An issue in the component /cgi-bin/upload_firmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vec… |
CVE-2020-25367 | Critical | 9.8 | 2021-11-04 | A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbit… |
CVE-2020-6931 | High | 7.8 | 2021-11-03 | HP Print and Scan Doctor may potentially be vulnerable to local elevation of privilege. |
CVE-2020-28416 | High | 7.8 | 2021-11-03 | HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available with HP PageWide and OfficeJet printer soft… |
CVE-2020-18263 | High | 7.5 | 2021-11-03 | PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability in the component search.php via the search parameter. This vulnerability allows attackers… |
CVE-2020-18262 | Critical | 9.8 | 2021-11-03 | ED01-CMS v1.0 was discovered to contain a SQL injection in the component cposts.php via the cid parameter. |
CVE-2020-18261 | Critical | 9.8 | 2021-11-03 | An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands. |
CVE-2020-18259 | Medium | 6.1 | 2021-11-03 | ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.php. This vulnerability allows attackers… |
CVE-2020-24743 | Critical | 9.8 | 2021-11-03 | An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid para… |
CVE-2020-24000 | Critical | 9.8 | 2021-11-03 | SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to inde… |
CVE-2020-23680 | High | 7.8 | 2021-11-03 | An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial of service or possibly other undisclose… |
CVE-2020-23679 | Critical | 9.8 | 2021-11-03 | Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, via the password field. |
CVE-2020-23126 | Medium | 6.1 | 2021-11-03 | Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social network friends. |
CVE-2020-23109 | High | 8.1 | 2021-11-03 | Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and di… |
CVE-2020-20982 | Critical | 9.6 | 2021-11-03 | Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl par… |
CVE-2020-5955 | Critical | 9.8 | 2021-11-03 | An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets. A caller may be able to escalate privileges. |
CVE-2020-27820 | Medium | 4.7 | 2021-11-03 | A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remo… |
CVE-2020-6492 | Critical | 9.6 | 2021-11-02 | Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
CVE-2020-16048 | Medium | 6.5 | 2021-11-02 | Out of bounds read in ANGLE allowed a remote attacker to obtain sensitive data via a crafted HTML page. |
CVE-2020-15935 | Medium | 4.3 | 2021-11-02 | A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve… |
CVE-2020-23754 | Critical | 9.6 | 2021-11-02 | Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via t… |
CVE-2020-23719 | Critical | 9.6 | 2021-11-02 | Cross site scripting (XSS) vulnerability in application/controllers/AdminController.php in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via… |
CVE-2020-23718 | Critical | 9.6 | 2021-11-02 | Cross site scripting (XSS) vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php. |
CVE-2020-23686 | High | 8.8 | 2021-11-02 | Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified impacts. |
CVE-2020-23685 | Critical | 9.8 | 2021-11-02 | SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the username parameter to logi… |
CVE-2020-21574 | High | 7.5 | 2021-11-02 | Buffer overflow vulnerability in YotsuyaNight c-http v0.1.0, allows attackers to cause a denial of service via a long url request which is passed to the delimi… |
CVE-2020-21573 | Medium | 5.5 | 2021-11-02 | An issue was discoverered in in abhijitnathwani image-processing v0.1.0, allows local attackers to cause a denial of service via a crafted image file. |
CVE-2020-21572 | High | 7.5 | 2021-11-02 | Buffer overflow vulnerability in function src_parser_trans_stage_1_2_3 trgil gilcc before commit 803969389ca9c06237075a7f8eeb1a19e6651759, allows attackers to… |
CVE-2020-20658 | High | 7.5 | 2021-11-02 | Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denail of service when trying to calloc an unexpectiedly large spac… |
CVE-2020-20657 | High | 7.5 | 2021-11-02 | Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denial of service via an unexpected packet while trying to connect. |
CVE-2020-18440 | Critical | 9.8 | 2021-11-02 | Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code. |
CVE-2020-18439 | Critical | 9.1 | 2021-11-02 | An issue was discoverered in in function edit_save_f in framework/admin/tpl_control.php in qinggan phpok 5.1, allows attackers to write arbitrary files or get… |
CVE-2020-18438 | High | 7.5 | 2021-11-02 | Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php. |
CVE-2020-15940 | Medium | 4.1 | 2021-11-02 | An improper neutralization of input vulnerability [CWE-79] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated atta… |
CVE-2020-12814 | Medium | 4.1 | 2021-11-02 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiAnalyzer version 6.0.6 and below, version 6.4.4 allows… |
CVE-2020-35249 | Medium | 6.1 | 2021-11-02 | Cross Site Scripting (XSS) vulnerability in ElkarBackup 1.3.3, allows attackers to execute arbitrary code via the name parameter to the add client feature. |
CVE-2020-27406 | Medium | 5.4 | 2021-11-02 | Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname. |
CVE-2020-28702 | High | 7.5 | 2021-11-01 | A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information. |
CVE-2020-36505 | Medium | 6.5 | 2021-11-01 | The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attac… |