2020 CVEs (page 171)
Page 171 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-5129 | High | 7.5 | 2020-03-26 | A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which leads to Denial of Ser… |
CVE-2020-1764 | High | 8.6 | 2020-03-26 | A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse… |
CVE-2020-10969 | High | 8.8 | 2020-03-26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane. |
CVE-2020-10968 | High | 8.8 | 2020-03-26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remo… |
CVE-2020-8923 | Medium | 5.4 | 2020-03-26 | An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniqu… |
CVE-2020-8910 | Medium | 6.5 | 2020-03-26 | A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by… |
CVE-2020-10245 | Critical | 9.8 | 2020-03-26 | CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. |
CVE-2020-10966 | Medium | 6.5 | 2020-03-25 | In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover… |
CVE-2020-10965 | High | 8.1 | 2020-03-25 | Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the default admin accoun… |
CVE-2020-6815 | Critical | 9.8 | 2020-03-25 | Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evidence of memory corruption or escalation o… |
CVE-2020-6814 | Critical | 9.8 | 2020-03-25 | Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume… |
CVE-2020-6813 | Medium | 5.3 | 2020-03-25 | When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrar… |
CVE-2020-6812 | Medium | 5.3 | 2020-03-25 | The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microp… |
CVE-2020-6811 | High | 8.8 | 2020-03-25 | The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user use… |
CVE-2020-6810 | Medium | 4.3 | 2020-03-25 | After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscre… |
CVE-2020-6809 | High | 7.5 | 2020-03-25 | When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local… |
CVE-2020-6808 | Medium | 6.5 | 2020-03-25 | When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previou… |
CVE-2020-6807 | High | 8.8 | 2020-03-25 | When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the stream was destroyed… |
CVE-2020-6806 | High | 8.8 | 2020-03-25 | By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could h… |
CVE-2020-6805 | High | 8.8 | 2020-03-25 | When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable cra… |
CVE-2020-10964 | Critical | 9.8 | 2020-03-25 | Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may… |
CVE-2020-10963 | High | 7.2 | 2020-03-25 | FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload… |
CVE-2020-9520 | Medium | 5.4 | 2020-03-25 | A stored XSS vulnerability was discovered in Micro Focus Vibe, affecting all Vibe version prior to 4.0.7. The vulnerability could allows a remote attacker to c… |
CVE-2020-3791 | Medium | 4.3 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. Successful exploita… |
CVE-2020-3790 | High | 8.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitati… |
CVE-2020-3789 | Critical | 9.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitati… |
CVE-2020-3788 | Critical | 9.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitati… |
CVE-2020-3787 | Critical | 9.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitati… |
CVE-2020-3786 | Critical | 9.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitati… |
CVE-2020-3785 | Critical | 9.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitati… |
CVE-2020-3784 | Critical | 9.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitati… |
CVE-2020-3783 | Critical | 9.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a heap corruption vulnerability. Successful exploitation… |
CVE-2020-3782 | Medium | 4.3 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. Successful exploita… |
CVE-2020-3781 | Medium | 4.3 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. Successful exploita… |
CVE-2020-3780 | High | 8.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. Successful exploitation c… |
CVE-2020-3779 | High | 8.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds write vulnerability. Successful exploit… |
CVE-2020-3778 | Medium | 4.3 | 2020-03-25 | Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Successful exploitation could lead to information disc… |
CVE-2020-3777 | High | 7.5 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. Successful exploita… |
CVE-2020-3776 | High | 8.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. Successful exploitation c… |
CVE-2020-3775 | Critical | 9.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. Successful exploitation c… |
CVE-2020-3774 | High | 8.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. Successful exploitation c… |
CVE-2020-3773 | High | 8.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds write vulnerability. Successful exploit… |
CVE-2020-3772 | High | 8.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. Successful exploitation c… |
CVE-2020-3771 | Medium | 4.3 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. Successful exploita… |
CVE-2020-3770 | High | 8.8 | 2020-03-25 | Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. Successful exploitation c… |
CVE-2020-10888 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authent… |
CVE-2020-10887 | Critical | 9.8 | 2020-03-25 | This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required… |
CVE-2020-10886 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authen… |
CVE-2020-10885 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authen… |
CVE-2020-10884 | High | 8.8 | 2020-03-25 | This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers… |
CVE-2020-10883 | High | 7.8 | 2020-03-25 | This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. An attacke… |
CVE-2020-10882 | High | 8.8 | 2020-03-25 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 route… |
CVE-2020-10881 | Critical | 9.8 | 2020-03-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authen… |
CVE-2020-9552 | High | 7.8 | 2020-03-25 | Adobe Bridge versions 10.0 have a heap-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-9551 | High | 7.8 | 2020-03-25 | Adobe Bridge versions 10.0 have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-3808 | Medium | 5.9 | 2020-03-25 | Creative Cloud Desktop Application versions 5.0 and earlier have a time-of-check to time-of-use (toctou) race condition vulnerability. Successful exploitation… |
CVE-2020-3794 | Critical | 9.8 | 2020-03-25 | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrary code execution of… |
CVE-2020-3769 | High | 7.5 | 2020-03-25 | Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive info… |
CVE-2020-3761 | High | 7.5 | 2020-03-25 | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability. Successful exploitation could lead to arbitrary file read from… |
CVE-2020-5282 | High | 7.2 | 2020-03-25 | In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the `npm` command which is part of this software package. This allows arbitrary shell ex… |
CVE-2020-5277 | Medium | 4.1 | 2020-03-25 | PrestaShop module ps_facetedsearch versions before 3.5.0 has a reflected XSS with `url_name` parameter. The problem is fixed in 3.5.0 |
CVE-2020-5281 | Medium | 6.2 | 2020-03-25 | In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3… |
CVE-2020-5280 | High | 7.6 | 2020-03-25 | http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.stat… |
CVE-2020-3807 | Critical | 9.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3806 | High | 7.5 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3805 | Critical | 9.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3804 | High | 7.5 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3803 | High | 7.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3802 | High | 8.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3801 | Critical | 9.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3800 | High | 7.5 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3766 | High | 7.8 | 2020-03-25 | Adobe Genuine Integrity Service versions Version 6.4 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privile… |
CVE-2020-2171 | High | 8.8 | 2020-03-25 | Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2170 | Medium | 5.4 | 2020-03-25 | Jenkins RapidDeploy Plugin 4.2 and earlier does not escape package names in the table of packages obtained from a remote server, resulting in a stored XSS vuln… |
CVE-2020-2169 | Medium | 6.1 | 2020-03-25 | A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting… |
CVE-2020-2168 | High | 8.8 | 2020-03-25 | Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a rem… |
CVE-2020-2167 | High | 8.8 | 2020-03-25 | Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote… |
CVE-2020-2166 | High | 8.8 | 2020-03-25 | Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote c… |
CVE-2020-2165 | High | 7.5 | 2020-03-25 | Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulti… |
CVE-2020-2164 | Medium | 6.5 | 2020-03-25 | Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it… |
CVE-2020-2163 | Medium | 5.4 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability explo… |
CVE-2020-2162 | Medium | 5.4 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in… |
CVE-2020-2161 | Medium | 5.4 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job conf… |
CVE-2020-2160 | High | 8.8 | 2020-03-25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassi… |
CVE-2020-10649 | High | 7.8 | 2020-03-25 | DevActSvc.exe in ASUS Device Activation before 1.0.7.0 for Windows 10 notebooks and PCs could lead to unsigned code execution with no additional restrictions w… |
CVE-2020-3799 | Critical | 9.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3797 | Critical | 9.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3795 | Critical | 9.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3793 | Critical | 9.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-3792 | Critical | 9.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-1957 | Critical | 9.8 | 2020-03-25 | Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass. |
CVE-2020-9375 | High | 7.5 | 2020-03-25 | TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexp… |
CVE-2020-10788 | Critical | 9.1 | 2020-03-25 | openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections. |
CVE-2020-10791 | Medium | 6.5 | 2020-03-25 | app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP… |
CVE-2020-10790 | Medium | 5.4 | 2020-03-25 | openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS. |
CVE-2020-10789 | Critical | 9.8 | 2020-03-25 | openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an s… |
CVE-2020-5561 | Critical | 9.8 | 2020-03-25 | Keijiban Tsumiki v1.15 allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2020-5560 | Critical | 9.8 | 2020-03-25 | WL-Enq 1.11 and 1.12 allows remote attackers to execute arbitrary OS commands with the administrative privilege via unspecified vectors. |
CVE-2020-5559 | Medium | 6.1 | 2020-03-25 | Cross-site scripting vulnerability in WL-Enq 1.11 and 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2020-5558 | High | 8.8 | 2020-03-25 | CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors. |