2020 CVEs (page 173)
Page 173 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-8876 | Medium | 5.5 | 2020-03-23 | This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain th… |
CVE-2020-8875 | High | 8.8 | 2020-03-23 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the… |
CVE-2020-8874 | Medium | 6.7 | 2020-03-23 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the… |
CVE-2020-8873 | Medium | 6.7 | 2020-03-23 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the… |
CVE-2020-8872 | Medium | 4.4 | 2020-03-23 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.1-47117. An attacker must first… |
CVE-2020-8871 | Medium | 6.7 | 2020-03-23 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.0-47107 . An attacker must first obtain th… |
CVE-2020-9392 | High | 7.3 | 2020-03-23 | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, creat… |
CVE-2020-8838 | Medium | 6.4 | 2020-03-23 | An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not validate the source and binary downloaded… |
CVE-2020-9760 | Critical | 9.8 | 2020-03-23 | An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflo… |
CVE-2020-9759 | Medium | 4.6 | 2020-03-23 | A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wr… |
CVE-2020-8511 | High | 7.2 | 2020-03-23 | In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a different issue th… |
CVE-2020-7935 | High | 7.2 | 2020-03-23 | Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File… |
CVE-2020-6449 | High | 8.8 | 2020-03-23 | Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6429 | High | 8.8 | 2020-03-23 | Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6428 | High | 8.8 | 2020-03-23 | Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6427 | High | 8.8 | 2020-03-23 | Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6426 | Medium | 6.5 | 2020-03-23 | Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-6425 | Medium | 5.4 | 2020-03-23 | Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-6424 | High | 8.8 | 2020-03-23 | Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6422 | High | 8.8 | 2020-03-23 | Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6420 | High | 8.8 | 2020-03-23 | Insufficient policy enforcement in media in Google Chrome prior to 80.0.3987.132 allowed a remote attacker to bypass same origin policy via a crafted HTML page. |
CVE-2020-10364 | High | 7.5 | 2020-03-23 | The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and ca… |
CVE-2020-8497 | Medium | 5.3 | 2020-03-23 | In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, pri… |
CVE-2020-10793 | High | 8.8 | 2020-03-23 | CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the… |
CVE-2020-6650 | High | 8.3 | 2020-03-23 | UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax bef… |
CVE-2020-1951 | Medium | 5.5 | 2020-03-23 | A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23. |
CVE-2020-1950 | Medium | 5.5 | 2020-03-23 | A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23. |
CVE-2020-10661 | Critical | 9.1 | 2020-03-23 | HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespa… |
CVE-2020-10660 | Medium | 5.3 | 2020-03-23 | HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Gro… |
CVE-2020-10593 | High | 7.5 | 2020-03-23 | Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. T… |
CVE-2020-10592 | High | 7.5 | 2020-03-23 | Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption), aka TROVE-2020-00… |
CVE-2020-9752 | Critical | 9.8 | 2020-03-23 | Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through its named pipe. |
CVE-2020-10821 | Medium | 4.8 | 2020-03-22 | Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter. |
CVE-2020-10820 | Medium | 4.8 | 2020-03-22 | Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter. |
CVE-2020-10819 | Medium | 4.8 | 2020-03-22 | Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter. |
CVE-2020-10818 | High | 7.2 | 2020-03-22 | Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the hostname" field. |
CVE-2020-10812 | Medium | 5.5 | 2020-03-22 | An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5F_get_nrefs() located in H5Fquery.c. It allows an attacker… |
CVE-2020-10811 | Medium | 5.5 | 2020-03-22 | An issue was discovered in HDF5 through 1.12.0. A heap-based buffer over-read exists in the function H5O__layout_decode() located in H5Olayout.c. It allows an… |
CVE-2020-10810 | Medium | 5.5 | 2020-03-22 | An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5AC_unpin_entry() located in H5AC.c. It allows an attacker t… |
CVE-2020-10809 | Medium | 5.5 | 2020-03-22 | An issue was discovered in HDF5 through 1.12.0. A heap-based buffer overflow exists in the function Decompress() located in decompress.c. It can be triggered b… |
CVE-2020-10808 | High | 8.8 | 2020-03-22 | Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a… |
CVE-2020-10807 | Medium | 5.3 | 2020-03-22 | auth_svc in Caldera before 2.6.5 allows authentication bypass (for REST API requests) via a forged "localhost" string in the HTTP Host header. |
CVE-2020-10806 | Critical | 9.8 | 2020-03-22 | eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before… |
CVE-2020-10803 | Medium | 5.4 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack t… |
CVE-2020-10802 | High | 8.0 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when g… |
CVE-2020-10804 | High | 8.0 | 2020-03-22 | In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/… |
CVE-2020-10800 | High | 8.1 | 2020-03-21 | lix through 15.8.7 allows man-in-the-middle attackers to execute arbitrary code by modifying the HTTP client-server data stream so that the Location header is… |
CVE-2020-10799 | Critical | 9.8 | 2020-03-20 | The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call. |
CVE-2020-8140 | Medium | 6.7 | 2020-03-20 | A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the envi… |
CVE-2020-8139 | Medium | 6.5 | 2020-03-20 | A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to… |
CVE-2020-8138 | Medium | 6.5 | 2020-03-20 | A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability wh… |
CVE-2020-10194 | Medium | 6.5 | 2020-03-20 | cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the inte… |
CVE-2020-8883 | Medium | 4.3 | 2020-03-20 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is req… |
CVE-2020-8882 | High | 8.8 | 2020-03-20 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to… |
CVE-2020-8881 | High | 8.8 | 2020-03-20 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to… |
CVE-2020-8880 | High | 8.8 | 2020-03-20 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to… |
CVE-2020-8879 | Medium | 4.3 | 2020-03-20 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is req… |
CVE-2020-8878 | High | 8.8 | 2020-03-20 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to… |
CVE-2020-8877 | Medium | 4.3 | 2020-03-20 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is req… |
CVE-2020-8137 | Critical | 9.8 | 2020-03-20 | Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker. |
CVE-2020-8136 | High | 7.5 | 2020-03-20 | Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a special… |
CVE-2020-8135 | Critical | 9.8 | 2020-03-20 | The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external network or… |
CVE-2020-8134 | High | 8.1 | 2020-03-20 | Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal… |
CVE-2020-7961 | Critical | 9.8 | 2020-03-20 | Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS). |
CVE-2020-10558 | Medium | 6.5 | 2020-03-20 | The driving interface of Tesla Model 3 vehicles in any release before 2020.4.10 allows Denial of Service to occur due to improper process separation, which all… |
CVE-2020-9425 | High | 7.5 | 2020-03-20 | An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET reques… |
CVE-2020-10792 | High | 7.5 | 2020-03-20 | openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "stagi… |
CVE-2020-1879 | Low | 3.9 | 2020-03-20 | There is an improper integrity checking vulnerability on some huawei products. The software of the affected product has an improper integrity check which may a… |
CVE-2020-1878 | Medium | 5.5 | 2020-03-20 | Huawei smartphone OxfordS-AN00A with versions earlier than 10.0.1.152D(C735E152R3P3),versions earlier than 10.0.1.160(C00E160R4P1) have an improper authenticat… |
CVE-2020-1864 | High | 8.1 | 2020-03-20 | Some Huawei products have a security vulnerability due to improper authentication. A remote attacker needs to obtain some information and forge the peer device… |
CVE-2020-1862 | Low | 3.3 | 2020-03-20 | There is a double free vulnerability in some Huawei products. A local attacker with low privilege may perform some operations to exploit the vulnerability. Due… |
CVE-2020-1796 | Medium | 6.6 | 2020-03-20 | There is an improper authorization vulnerability in several smartphones. The software incorrectly performs an authorization to certain user, successful exploit… |
CVE-2020-1795 | Low | 2.4 | 2020-03-20 | There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation when the Digital Balance function is on… |
CVE-2020-1794 | Medium | 4.6 | 2020-03-20 | There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, succes… |
CVE-2020-1793 | Medium | 4.6 | 2020-03-20 | There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, succes… |
CVE-2020-1709 | High | 7.0 | 2020-03-20 | A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was fo… |
CVE-2020-1707 | High | 7.0 | 2020-03-20 | A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file w… |
CVE-2020-1696 | Medium | 4.6 | 2020-03-20 | A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cr… |
CVE-2020-10597 | High | 7.1 | 2020-03-20 | Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specially crafted… |
CVE-2020-10682 | High | 7.8 | 2020-03-20 | The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php… |
CVE-2020-10681 | Medium | 5.4 | 2020-03-20 | The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php. |
CVE-2020-9345 | Medium | 6.5 | 2020-03-20 | An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is possible to perform a Denial of Service att… |
CVE-2020-9344 | Medium | 6.1 | 2020-03-20 | Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations. |
CVE-2020-9343 | Medium | 6.5 | 2020-03-20 | An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is possible to perform a Denial of Service att… |
CVE-2020-10669 | High | 7.5 | 2020-03-19 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated att… |
CVE-2020-7006 | High | 8.4 | 2020-03-19 | Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. Successful exploitation of this vulnerability could allow infor… |
CVE-2020-10671 | High | 8.8 | 2020-03-19 | The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform a… |
CVE-2020-10670 | Medium | 6.1 | 2020-03-19 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogConten… |
CVE-2020-10668 | Medium | 6.1 | 2020-03-19 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOT… |
CVE-2020-10667 | Medium | 6.1 | 2020-03-19 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulne… |
CVE-2020-5267 | Medium | 4.0 | 2020-03-19 | In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the… |
CVE-2020-5262 | High | 7.7 | 2020-03-19 | In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`… |
CVE-2020-3266 | High | 7.8 | 2020-03-19 | A vulnerability in the CLI of Cisco SD-WAN Solution software could allow an authenticated, local attacker to inject arbitrary commands that are executed with r… |
CVE-2020-3265 | High | 7.8 | 2020-03-19 | A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system… |
CVE-2020-3264 | High | 7.1 | 2020-03-19 | A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerabil… |
CVE-2020-1705 | High | 7.0 | 2020-03-19 | A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in t… |
CVE-2020-10678 | High | 8.8 | 2020-03-19 | In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug… |
CVE-2020-4205 | Medium | 6.3 | 2020-03-19 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, and continue to access the server even a… |
CVE-2020-4203 | Medium | 4.9 | 2020-03-19 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to improper access control… |
CVE-2020-10675 | High | 7.5 | 2020-03-19 | The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call. |