2020 CVEs (page 172)
Page 172 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-5557 | Medium | 6.1 | 2020-03-25 | Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2020-5556 | Critical | 9.8 | 2020-03-25 | Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2020-5555 | Critical | 9.1 | 2020-03-25 | Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory where it is placed via u… |
CVE-2020-5554 | Critical | 9.1 | 2020-03-25 | Directory traversal vulnerability in Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write arbitrary files via unspecified ve… |
CVE-2020-5553 | Critical | 9.8 | 2020-03-25 | mailform version 1.04 allows remote attackers to execute arbitrary PHP code via unspecified vectors. |
CVE-2020-5552 | Medium | 6.1 | 2020-03-25 | Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2020-5261 | High | 8.2 | 2020-03-25 | Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token… |
CVE-2020-6816 | Medium | 6.1 | 2020-03-24 | In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False. |
CVE-2020-6802 | Medium | 6.1 | 2020-03-24 | In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option. |
CVE-2020-10942 | Medium | 5.3 | 2020-03-24 | In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel s… |
CVE-2020-8986 | Critical | 9.8 | 2020-03-24 | lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain admini… |
CVE-2020-8985 | High | 8.8 | 2020-03-24 | ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality. |
CVE-2020-8984 | High | 7.5 | 2020-03-24 | lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header. |
CVE-2020-7007 | Critical | 9.8 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the attacker may execute arbitrary codes or target the device, causing it to go out of service. |
CVE-2020-7001 | High | 7.5 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a weak cryptographic algorithm, which may allow confidential information to… |
CVE-2020-6997 | High | 7.5 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, sensitive information is transmitted over some web applications in cleartext. |
CVE-2020-6991 | Critical | 9.8 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force. |
CVE-2020-6982 | High | 8.8 | 2020-03-24 | In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution. |
CVE-2020-6981 | Critical | 9.8 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an attacker may gain access to the system without proper authentication. |
CVE-2020-6979 | High | 7.5 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibility that confidential… |
CVE-2020-6978 | High | 7.2 | 2020-03-24 | In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries. |
CVE-2020-6080 | High | 7.5 | 2020-03-24 | An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsin… |
CVE-2020-6079 | High | 7.5 | 2020-03-24 | An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsin… |
CVE-2020-6078 | High | 7.5 | 2020-03-24 | An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdns_r… |
CVE-2020-6077 | High | 7.5 | 2020-03-24 | An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages, the impl… |
CVE-2020-6073 | High | 7.5 | 2020-03-24 | An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing the RDATA section in… |
CVE-2020-6072 | Critical | 9.8 | 2020-03-24 | An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS me… |
CVE-2020-6071 | High | 7.5 | 2020-03-24 | An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labe… |
CVE-2020-7005 | High | 8.8 | 2020-03-24 | In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely… |
CVE-2020-6995 | Critical | 9.8 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the application utilizes weak password requirements… |
CVE-2020-6993 | High | 7.5 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, an attacker can gain access to sensitive information… |
CVE-2020-6985 | Critical | 9.8 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for acces… |
CVE-2020-10941 | Medium | 5.9 | 2020-03-24 | Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import. |
CVE-2020-6989 | Critical | 9.8 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, a buffer overflow in the web server allows remote att… |
CVE-2020-6987 | High | 7.5 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a weak cryptographic algori… |
CVE-2020-6983 | High | 7.5 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-coded cryptographic… |
CVE-2020-7003 | High | 7.5 | 2020-03-24 | In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is transmitted ov… |
CVE-2020-10855 | Medium | 4.6 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can bypass Factory Reset Protection (FRP) via AppTray. The Samsung ID is SVE-… |
CVE-2020-10854 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Kernel stack addresses are leaked to userspace. The Samsung ID is… |
CVE-2020-10853 | Medium | 5.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Gallery leaks cached data. The Samsung IDs are SVE-2019-16010, SVE-2019-16011, SVE-2019… |
CVE-2020-10852 | High | 7.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is a stack overflow in display driver. The Samsung ID is SVE… |
CVE-2020-10851 | High | 7.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. There is a stack overflow in the kperfmon driver. The Samsung ID is SVE-201… |
CVE-2020-10850 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. The secure bootloade has a buffer overflow of th… |
CVE-2020-10849 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos7885, Exynos8895, and Exynos9810 chipsets) software. The Gatekeeper t… |
CVE-2020-10848 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos 9810 chipsets) software. Arbitrary memory mapping exists in TEE. The… |
CVE-2020-10847 | Medium | 6.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) (Galaxy S8 and Note8) software. Facial recognition can be spoofed. The Samsung ID is SVE-2019-166… |
CVE-2020-10846 | Medium | 5.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.x) and Q(10.x) software. Attackers can enable the OEM unlock feature on a KG-enrolled devices, leadi… |
CVE-2020-10845 | Medium | 6.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is a race condition leading to a use-after-free in MTP. The… |
CVE-2020-10844 | Medium | 6.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.x), and Q(10.0) software. There is an out-of-bounds read vulnerability in media.audio_policy… |
CVE-2020-10843 | High | 7.0 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (S.LSI chipsets) software. There are race conditions in the hdcp2 driver. Th… |
CVE-2020-10842 | High | 7.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (S.LSI chipsets) software. There is a heap out-of-bounds write in the tsmux… |
CVE-2020-10841 | High | 7.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 9610 chipsets) software. There is an arbitrary kfree in the vipx and vertex d… |
CVE-2020-10840 | High | 7.1 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 9610 chipsets) software. There is a kernel pointer leak in the vipx driver. T… |
CVE-2020-10839 | Medium | 6.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via a SIM card… |
CVE-2020-10838 | High | 7.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. PROCA allows a use-after-free and arbitrary code execution. The Samsung ID… |
CVE-2020-10837 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. The Esecomm Trustlet allows a stack overflow and arbitrary c… |
CVE-2020-10836 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. The Widevine Trustlet allows read and write oper… |
CVE-2020-10835 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with any (before February 2020 for Exynos modem chipsets) software. There is a buffer overflow in baseband CP… |
CVE-2020-10834 | Medium | 5.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can view notifications on the lock screen via Routines. The Samsung ID is SVE… |
CVE-2020-10833 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with Q(10.0) software. The DeX Lockscreen allows attackers to access the quick panel and notifications. The S… |
CVE-2020-10832 | High | 7.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software. Kernel Wi-Fi drivers allow out-of-bounds Read or Write operations (e… |
CVE-2020-10831 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can trigger an update to arbitrary touch-screen firmware… |
CVE-2020-10830 | Low | 2.4 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Attackers can view notifications by entering many PINs in Lockdown mode. Th… |
CVE-2020-10829 | High | 7.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with O(8.0), P(9.0), and Q(10.0) (Broadcom chipsets) software. A kernel driver heap overflow leads to arbitra… |
CVE-2020-6972 | Critical | 9.1 | 2020-03-24 | In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web bro… |
CVE-2020-4309 | Medium | 5.3 | 2020-03-24 | IBM Content Navigator 3.0CD could disclose sensitive information to an unauthenticated user which could be used to aid in further attacks against the system. I… |
CVE-2020-4253 | High | 8.8 | 2020-03-24 | IBM Content Navigator 3.0CD does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-F… |
CVE-2020-10938 | Critical | 9.8 | 2020-03-24 | GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c. |
CVE-2020-10385 | Medium | 5.4 | 2020-03-24 | A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress. |
CVE-2020-1747 | Critical | 9.8 | 2020-03-24 | A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted… |
CVE-2020-10934 | High | 7.2 | 2020-03-24 | Acyba AcyMailing before 6.9.2 mishandles file uploads by admins. |
CVE-2020-10931 | High | 7.5 | 2020-03-24 | Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binar… |
CVE-2020-9359 | Medium | 5.3 | 2020-03-24 | KDE Okular before 1.10.0 allows code execution via an action link in a PDF document. |
CVE-2020-1744 | Medium | 5.6 | 2020-03-24 | A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login ev… |
CVE-2020-10684 | High | 7.9 | 2020-03-24 | A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of… |
CVE-2020-10570 | Medium | 6.1 | 2020-03-24 | The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on me… |
CVE-2020-5252 | Medium | 5.0 | 2020-03-23 | The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” co… |
CVE-2020-1944 | Critical | 9.8 | 2020-03-23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content… |
CVE-2020-10879 | Critical | 9.8 | 2020-03-23 | rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the… |
CVE-2020-10875 | High | 7.5 | 2020-03-23 | Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Server Pages files such as /include/viewta… |
CVE-2020-8868 | Critical | 9.8 | 2020-03-23 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required t… |
CVE-2020-8866 | Medium | 6.5 | 2020-03-23 | This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is req… |
CVE-2020-8865 | Medium | 6.3 | 2020-03-23 | This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is re… |
CVE-2020-8864 | High | 8.8 | 2020-03-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi… |
CVE-2020-8863 | High | 8.8 | 2020-03-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi… |
CVE-2020-8859 | High | 7.5 | 2020-03-23 | This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.4-283534d. Authenti… |
CVE-2020-6967 | Critical | 9.8 | 2020-03-23 | In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .N… |
CVE-2020-10874 | High | 7.5 | 2020-03-23 | Motorola FX9500 devices allow remote attackers to read database files. |
CVE-2020-7482 | Medium | 6.1 | 2020-03-23 | A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All versions), which coul… |
CVE-2020-7481 | Medium | 6.1 | 2020-03-23 | A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All versions), which coul… |
CVE-2020-7480 | Critical | 9.8 | 2020-03-23 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the ap… |
CVE-2020-7479 | High | 7.8 | 2020-03-23 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a… |
CVE-2020-7478 | High | 7.5 | 2020-03-23 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a… |
CVE-2020-7477 | High | 7.5 | 2020-03-23 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module 140NOE771x1 (Versions 7.0 and prior), Q… |
CVE-2020-7476 | High | 7.8 | 2020-03-23 | A CWE-426: Untrusted Search Path vulnerability exists in ZigBee Installation Kit (Versions prior to 1.0.1), which could cause execution of malicious code when… |
CVE-2020-5722 | Critical | 9.8 | 2020-03-23 | The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use thi… |
CVE-2020-10871 | Medium | 5.3 | 2020-03-23 | In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance… |
CVE-2020-10870 | Medium | 5.5 | 2020-03-23 | Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent othe… |
CVE-2020-7475 | Critical | 9.8 | 2020-03-23 | A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxu… |
CVE-2020-7474 | High | 7.8 | 2020-03-23 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator (v1.002 and prior), for the PMEPXM0100 (H) module, which could cause t… |