2020 CVEs (page 174)
Page 174 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10648 | High | 7.8 | 2020-03-19 | Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a s… |
CVE-2020-9423 | Critical | 9.8 | 2020-03-18 | LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc prov… |
CVE-2020-10674 | Critical | 9.8 | 2020-03-18 | PerlSpeak through 2.01 allows attackers to execute arbitrary OS commands, as demonstrated by use of system and 2-argument open. |
CVE-2020-10673 | High | 8.8 | 2020-03-18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.Resource… |
CVE-2020-10672 | High | 8.8 | 2020-03-18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms… |
CVE-2020-10365 | Medium | 6.5 | 2020-03-18 | LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by mod… |
CVE-2020-7258 | Medium | 4.8 | 2020-03-18 | Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via… |
CVE-2020-7256 | Medium | 4.8 | 2020-03-18 | Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via… |
CVE-2020-10665 | Medium | 6.7 | 2020-03-18 | Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, lead… |
CVE-2020-9326 | High | 7.5 | 2020-03-18 | BeyondTrust Privilege Management for Windows and Mac (aka PMWM; formerly Avecto Defendpoint) 5.1 through 5.5 before 5.5 SR1 mishandles command-line arguments w… |
CVE-2020-9325 | High | 7.5 | 2020-03-18 | Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary File Download. |
CVE-2020-9324 | High | 7.5 | 2020-03-18 | Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC. |
CVE-2020-9323 | Medium | 5.3 | 2020-03-18 | Aquaforest TIFF Server 4.0 allows Unauthenticated File and Directory Enumeration via tiffserver/tssp.aspx. |
CVE-2020-6976 | Medium | 5.5 | 2020-03-18 | Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. An out-of-bounds read overflow can be exploited when a valid user opens a specially craft… |
CVE-2020-4199 | Medium | 4.3 | 2020-03-18 | IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transm… |
CVE-2020-9443 | Medium | 6.1 | 2020-03-18 | Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a number of ways. This… |
CVE-2020-7002 | High | 7.8 | 2020-03-18 | Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. Multiple stack-based buffer overflows can be exploited when a valid user opens a speciall… |
CVE-2020-3922 | Critical | 9.8 | 2020-03-18 | LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation. |
CVE-2020-10659 | Medium | 4.3 | 2020-03-18 | Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validation, leading to situations where (for ex… |
CVE-2020-8600 | Critical | 9.8 | 2020-03-18 | Trend Micro Worry-Free Business Security (9.0, 9.5, 10.0) is affected by a directory traversal vulnerability that could allow an attacker to manipulate a key f… |
CVE-2020-8599 | Critical | 9.8 | 2020-03-18 | Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary p… |
CVE-2020-8598 | Critical | 9.8 | 2020-03-18 | Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow a r… |
CVE-2020-8470 | High | 7.5 | 2020-03-18 | Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow an… |
CVE-2020-8468 | High | 8.8 | 2020-03-18 | Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability w… |
CVE-2020-8467 | High | 8.8 | 2020-03-18 | A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary co… |
CVE-2020-3951 | Low | 3.8 | 2020-03-17 | VMware Workstation (15.x before 15.5.2) and Horizon Client for Windows (5.x and prior before 5.4.0) contain a denial-of-service vulnerability due to a heap-ove… |
CVE-2020-3950 | High | 7.8 | 2020-03-17 | VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contai… |
CVE-2020-1720 | Low | 3.1 | 2020-03-17 | A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use… |
CVE-2020-10596 | Medium | 5.4 | 2020-03-17 | OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section. |
CVE-2020-10122 | Medium | 6.5 | 2020-03-17 | cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547). |
CVE-2020-10121 | Critical | 9.8 | 2020-03-17 | cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). |
CVE-2020-10120 | High | 7.2 | 2020-03-17 | cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545). |
CVE-2020-10119 | Critical | 9.8 | 2020-03-17 | cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). |
CVE-2020-10118 | Critical | 9.1 | 2020-03-17 | cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). |
CVE-2020-10117 | Critical | 9.1 | 2020-03-17 | cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). |
CVE-2020-10116 | Medium | 5.3 | 2020-03-17 | cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541). |
CVE-2020-10115 | High | 7.2 | 2020-03-17 | cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537). |
CVE-2020-10114 | Medium | 6.1 | 2020-03-17 | cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535). |
CVE-2020-10113 | Medium | 6.1 | 2020-03-17 | cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515). |
CVE-2020-10380 | Critical | 9.8 | 2020-03-17 | RMySQL through 0.10.19 allows SQL Injection. |
CVE-2020-6646 | Medium | 5.4 | 2020-03-17 | An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via… |
CVE-2020-9347 | Critical | 9.8 | 2020-03-16 | Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords… |
CVE-2020-9346 | High | 8.8 | 2020-03-16 | Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's… |
CVE-2020-8787 | High | 7.5 | 2020-03-16 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted. |
CVE-2020-8786 | Critical | 9.8 | 2020-03-16 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4). |
CVE-2020-8785 | Critical | 9.8 | 2020-03-16 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4). |
CVE-2020-8784 | Critical | 9.8 | 2020-03-16 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4). |
CVE-2020-8783 | Critical | 9.8 | 2020-03-16 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4). |
CVE-2020-7982 | High | 8.1 | 2020-03-16 | An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25… |
CVE-2020-7919 | High | 7.5 | 2020-03-16 | Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resul… |
CVE-2020-7248 | High | 7.5 | 2020-03-16 | libubox in OpenWrt before 18.06.7 and 19.x before 19.07.1 has a tagged binary data JSON serialization vulnerability that may cause a stack based buffer overflo… |
CVE-2020-6175 | Medium | 5.9 | 2020-03-16 | Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation. |
CVE-2020-9472 | Medium | 6.5 | 2020-03-16 | Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality. |
CVE-2020-9471 | High | 8.8 | 2020-03-16 | Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality. |
CVE-2020-7608 | Medium | 5.3 | 2020-03-16 | yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload. |
CVE-2020-9321 | High | 7.5 | 2020-03-16 | configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging. |
CVE-2020-7916 | Medium | 6.5 | 2020-03-16 | be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role v… |
CVE-2020-6582 | High | 7.5 | 2020-03-16 | Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call. |
CVE-2020-6581 | High | 7.3 | 2020-03-16 | Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline… |
CVE-2020-5849 | High | 7.5 | 2020-03-16 | Unraid 6.8.0 allows authentication bypass. |
CVE-2020-5847 | Critical | 9.8 | 2020-03-16 | Unraid through 6.8.0 allows Remote Code Execution. |
CVE-2020-5844 | High | 7.2 | 2020-03-16 | index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and exe… |
CVE-2020-3948 | High | 7.8 | 2020-03-16 | Linux Guest VMs running on VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a local privilege escalation vulnerability due to im… |
CVE-2020-3947 | High | 8.8 | 2020-03-16 | VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a use-after vulnerability in vmnetdhcp. Successful exploitation of this issue m… |
CVE-2020-6990 | Critical | 9.8 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2020-6988 | High | 7.5 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2020-6984 | High | 7.5 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2020-6980 | Low | 3.3 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2020-6586 | Medium | 5.4 | 2020-03-16 | Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with… |
CVE-2020-6585 | High | 8.8 | 2020-03-16 | Nagios Log Server 2.1.3 has CSRF. |
CVE-2020-6584 | Medium | 6.5 | 2020-03-16 | Nagios Log Server 2.1.3 has Incorrect Access Control. |
CVE-2020-1740 | Low | 3.9 | 2020-03-16 | A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same co… |
CVE-2020-1738 | Low | 3.9 | 2020-03-16 | A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a m… |
CVE-2020-1736 | Low | 2.2 | 2020-03-16 | A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world… |
CVE-2020-1735 | Medium | 4.2 | 2020-03-16 | A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destinat… |
CVE-2020-10243 | Critical | 9.8 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the Featu… |
CVE-2020-10242 | Medium | 6.1 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks. |
CVE-2020-10241 | High | 8.8 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSRF. |
CVE-2020-10240 | Medium | 5.3 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or ema… |
CVE-2020-10239 | High | 8.8 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users. |
CVE-2020-10238 | High | 7.5 | 2020-03-16 | An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors. |
CVE-2020-10230 | Critical | 9.8 | 2020-03-16 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php term parameter. |
CVE-2020-1753 | Medium | 5.0 | 2020-03-16 | A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versi… |
CVE-2020-10557 | High | 8.8 | 2020-03-16 | An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged account. The upload section in the file… |
CVE-2020-9518 | Medium | 5.3 | 2020-03-16 | Login filter can access configuration files vulnerability in Micro Focus Service Manager (Web Tier), affecting versions 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The… |
CVE-2020-9519 | Medium | 5.3 | 2020-03-16 | HTTP methods reveled in Web services vulnerability in Micro Focus Service manager (server), affecting versions 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62… |
CVE-2020-5547 | Critical | 9.8 | 2020-03-16 | Resource Management Errors vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 an… |
CVE-2020-5546 | High | 8.8 | 2020-03-16 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electri… |
CVE-2020-5545 | Critical | 9.8 | 2020-03-16 | TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote attackers to bypass… |
CVE-2020-5544 | Critical | 9.8 | 2020-03-16 | Null Pointer Dereference vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and… |
CVE-2020-5543 | Critical | 9.8 | 2020-03-16 | TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properly manage sessions… |
CVE-2020-5542 | Critical | 9.8 | 2020-03-16 | Buffer error vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allo… |
CVE-2020-9290 | High | 7.8 | 2020-03-15 | An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in w… |
CVE-2020-9287 | High | 7.8 | 2020-03-15 | An Unsafe Search Path vulnerability in FortiClient EMS online installer 6.2.1 and below may allow a local attacker with control over the directory in which For… |
CVE-2020-7607 | Critical | 9.8 | 2020-03-15 | gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users w… |
CVE-2020-7606 | Critical | 9.8 | 2020-03-15 | docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd, fnStdout… |
CVE-2020-7605 | Critical | 9.8 | 2020-03-15 | gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options. |
CVE-2020-7604 | Critical | 9.8 | 2020-03-15 | pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function u… |
CVE-2020-7603 | Critical | 9.8 | 2020-03-15 | closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled b… |
CVE-2020-7602 | Critical | 9.8 | 2020-03-15 | node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", whic… |