2020 CVEs (page 175)
Page 175 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7601 | Critical | 9.8 | 2020-03-15 | gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command… |
CVE-2020-10594 | Critical | 9.1 | 2020-03-15 | An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via t… |
CVE-2020-0088 | Medium | 6.5 | 2020-03-15 | In parseTrackFragmentRun of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of ser… |
CVE-2020-0086 | Critical | 9.8 | 2020-03-15 | In readCString of Parcel.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to arbitrary code execution if IntSan were no… |
CVE-2020-10591 | High | 7.5 | 2020-03-15 | An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers… |
CVE-2020-10589 | High | 7.8 | 2020-03-15 | v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/config.json is owned by a low-privileged user but contains commands that are execute… |
CVE-2020-10588 | High | 7.8 | 2020-03-15 | v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/add.sh and /etc/v2rayL/remove.sh are owned by a low-privileged user but execute as r… |
CVE-2020-8141 | High | 8.8 | 2020-03-15 | The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can contro… |
CVE-2020-10587 | High | 7.8 | 2020-03-14 | antiX and MX Linux allow local users to achieve root access via "persist-config --command /bin/sh" because of the Sudo configuration. |
CVE-2020-10578 | High | 7.5 | 2020-03-14 | An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1. |
CVE-2020-10577 | Medium | 4.8 | 2020-03-14 | An issue was discovered in Janus through 0.9.1. janus.c has multiple concurrent threads that misuse the source property of a session, leading to a race conditi… |
CVE-2020-10576 | Medium | 5.9 | 2020-03-14 | An issue was discovered in Janus through 0.9.1. plugins/janus_voicemail.c in the VoiceMail plugin has a race condition that could cause a server crash. |
CVE-2020-10575 | Medium | 4.2 | 2020-03-14 | An issue was discovered in Janus through 0.9.1. plugins/janus_videocall.c in the VideoCall plugin mishandles session management because a race condition causes… |
CVE-2020-10574 | Critical | 9.8 | 2020-03-14 | An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesn't actually exist during a "query_logger" Admin API request, because of… |
CVE-2020-10573 | High | 7.5 | 2020-03-14 | An issue was discovered in Janus through 0.9.1. janus_audiobridge.c has a double mutex unlock when listing private rooms in AudioBridge. |
CVE-2020-10571 | Critical | 9.8 | 2020-03-14 | An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data. |
CVE-2020-10568 | High | 8.8 | 2020-03-14 | The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes… |
CVE-2020-10567 | Critical | 9.8 | 2020-03-14 | An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validati… |
CVE-2020-10566 | High | 7.8 | 2020-03-14 | grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a grub2.cfg file, leading to a buffer overf… |
CVE-2020-10565 | High | 7.8 | 2020-03-14 | grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, does not validate the address provided as part of a memrw command (read_* or write_*)… |
CVE-2020-10564 | Critical | 9.8 | 2020-03-13 | An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted t… |
CVE-2020-5240 | High | 7.6 | 2020-03-13 | In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not requir… |
CVE-2020-5257 | High | 7.7 | 2020-03-13 | In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated… |
CVE-2020-10563 | Critical | 9.8 | 2020-03-13 | An issue was discovered in DEVOME GRR before 3.4.1c. frmcontactlist.php mishandles a SQL query. |
CVE-2020-10562 | High | 7.2 | 2020-03-13 | An issue was discovered in DEVOME GRR before 3.4.1c. admin_edit_room.php mishandles file uploads. |
CVE-2020-10077 | Critical | 9.8 | 2020-03-13 | GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery ri… |
CVE-2020-10076 | Medium | 6.1 | 2020-03-13 | GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests. |
CVE-2020-10075 | Medium | 6.1 | 2020-03-13 | GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via u… |
CVE-2020-10074 | Critical | 9.8 | 2020-03-13 | GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be taken over through an expired link. |
CVE-2020-10073 | High | 7.5 | 2020-03-13 | GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could im… |
CVE-2020-10218 | Medium | 6.5 | 2020-03-13 | A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the HolidaydatesController.ph… |
CVE-2020-10092 | Medium | 6.1 | 2020-03-13 | GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration. |
CVE-2020-10091 | Medium | 6.1 | 2020-03-13 | GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types. |
CVE-2020-10090 | Medium | 5.3 | 2020-03-13 | GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being disclosed. |
CVE-2020-10089 | High | 7.5 | 2020-03-13 | GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother, |
CVE-2020-10088 | High | 8.1 | 2020-03-13 | GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permi… |
CVE-2020-10087 | High | 7.5 | 2020-03-13 | GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of th… |
CVE-2020-10086 | Medium | 5.3 | 2020-03-13 | GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file r… |
CVE-2020-10085 | Medium | 5.3 | 2020-03-13 | GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles. |
CVE-2020-10084 | Medium | 5.3 | 2020-03-13 | GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerability_feedback endpoint could result in the exp… |
CVE-2020-10083 | Critical | 9.1 | 2020-03-13 | GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization changes were not being applied. |
CVE-2020-10082 | Medium | 5.3 | 2020-03-13 | GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered. |
CVE-2020-10081 | Medium | 6.5 | 2020-03-13 | GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS… |
CVE-2020-10080 | Medium | 5.3 | 2020-03-13 | GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group. |
CVE-2020-10079 | Medium | 5.3 | 2020-03-13 | GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication… |
CVE-2020-10078 | Medium | 6.1 | 2020-03-13 | GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability. |
CVE-2020-8571 | High | 7.5 | 2020-03-13 | StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability which allows an unau… |
CVE-2020-10196 | Medium | 6.1 | 2020-03-13 | An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an… |
CVE-2020-10195 | Medium | 6.3 | 2020-03-13 | The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admi… |
CVE-2020-1953 | Critical | 10.0 | 2020-03-13 | Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special s… |
CVE-2020-10544 | Medium | 6.1 | 2020-03-13 | An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code… |
CVE-2020-10541 | Critical | 9.8 | 2020-03-13 | Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.10… |
CVE-2020-10540 | High | 8.8 | 2020-03-13 | Untis WebUntis before 2020.9.6 allows CSRF for certain combinations of rights and modules. |
CVE-2020-1887 | Critical | 9.1 | 2020-03-13 | Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of… |
CVE-2020-8469 | High | 7.8 | 2020-03-12 | Trend Micro Password Manager for Windows version 5.0 is affected by a DLL hijacking vulnerability would could potentially allow an attacker privleged escalatio… |
CVE-2020-7600 | Medium | 5.3 | 2020-03-12 | querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users withou… |
CVE-2020-1863 | High | 7.5 | 2020-03-12 | Huawei USG6000V with versions V500R001C20SPC300, V500R003C00SPC100, and V500R005C00SPC100 have an out-of-bounds read vulnerability. Due to a logical flaw in a… |
CVE-2020-10535 | Medium | 5.3 | 2020-03-12 | GitLab 12.8.x before 12.8.6, when sign-up is enabled, allows remote attackers to bypass email domain restrictions within the two-day grace period for an unconf… |
CVE-2020-10534 | Critical | 9.8 | 2020-03-12 | In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked users re-gaining es… |
CVE-2020-9064 | Medium | 5.5 | 2020-03-12 | Huawei smartphone Honor V30 with versions earlier than OxfordS-AN00A 10.0.1.167(C00E166R4P1) have an improper authentication vulnerability. Authentication to t… |
CVE-2020-6643 | Medium | 5.4 | 2020-03-12 | An improper neutralization of input vulnerability in the URL Description in Fortinet FortiIsolator version 1.2.2 allows a remote authenticated attacker to perf… |
CVE-2020-0583 | High | 8.8 | 2020-03-12 | Improper access control in the subsystem for Intel(R) Smart Sound Technology may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2020-0551 | Medium | 5.6 | 2020-03-12 | Load value injection in some Intel(R) Processors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure v… |
CVE-2020-0550 | Medium | 5.6 | 2020-03-12 | Improper data forwarding in some data cache for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local… |
CVE-2020-0574 | Medium | 5.9 | 2020-03-12 | Improper configuration in block design for Intel(R) MAX(R) 10 FPGA all versions may allow an authenticated user to potentially enable escalation of privilege a… |
CVE-2020-0567 | Medium | 5.5 | 2020-03-12 | Improper input validation in Intel(R) Graphics Drivers before version 26.20.100.7212 may allow an authenticated user to enable denial of service via local acce… |
CVE-2020-0565 | High | 7.8 | 2020-03-12 | Uncontrolled search path in Intel(R) Graphics Drivers before version 26.20.100.7158 may allow an authenticated user to potentially enable escalation of privile… |
CVE-2020-0556 | High | 7.1 | 2020-03-12 | Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial o… |
CVE-2020-0546 | High | 7.8 | 2020-03-12 | Unquoted service path in Intel(R) Optane(TM) DC Persistent Memory Module Management Software before version 1.0.0.3461 may allow an authenticated user to poten… |
CVE-2020-0530 | High | 7.8 | 2020-03-12 | Improper buffer restrictions in firmware for Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via local access. The l… |
CVE-2020-0526 | Medium | 6.7 | 2020-03-12 | Improper input validation in firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege via local access. The list of… |
CVE-2020-5961 | Medium | 5.5 | 2020-03-12 | NVIDIA vGPU graphics driver for guest OS contains a vulnerability in which an incorrect resource clean up on a failure path can impact the guest VM, leading to… |
CVE-2020-5960 | Medium | 5.5 | 2020-03-12 | NVIDIA Virtual GPU Manager contains a vulnerability in the kernel module (nvidia.ko), where a null pointer dereference may occur, which may lead to denial of s… |
CVE-2020-5959 | Medium | 5.5 | 2020-03-12 | NVIDIA Virtual GPU Manager, all versions, contains a vulnerability in the vGPU plugin in which an input index value is incorrectly validated which may lead to… |
CVE-2020-0520 | High | 7.8 | 2020-03-12 | Path traversal in igdkmd64.sys for Intel(R) Graphics Drivers before versions 15.45.30.5103, 15.40.44.5107, 15.36.38.5117 and 15.33.49.5100 may allow an authent… |
CVE-2020-0519 | High | 7.8 | 2020-03-12 | Improper access control for Intel(R) Graphics Drivers before versions 15.33.49.5100 and 15.36.38.5117 may allow an authenticated user to potentially enable esc… |
CVE-2020-0517 | Medium | 5.3 | 2020-03-12 | Out-of-bounds write in Intel(R) Graphics Drivers before version 15.36.38.5117 may allow an authenticated user to potentially enable escalation of privilege or… |
CVE-2020-0516 | Medium | 5.5 | 2020-03-12 | Improper access control in Intel(R) Graphics Drivers before version 26.20.100.7463 may allow an authenticated user to potentially enable denial of service via… |
CVE-2020-0515 | High | 7.8 | 2020-03-12 | Uncontrolled search path element in the installer for Intel(R) Graphics Drivers before versions 26.20.100.7584, 15.45.30.5103, 15.40.44.5107, 15.36.38.5117, an… |
CVE-2020-0514 | High | 7.8 | 2020-03-12 | Improper default permissions in the installer for Intel(R) Graphics Drivers before versions 26.20.100.7463 and 15.45.30.5103 may allow an authenticated user to… |
CVE-2020-0511 | Medium | 5.5 | 2020-03-12 | Uncaught exception in system driver for Intel(R) Graphics Drivers before version 15.40.44.5107 may allow an authenticated user to potentially enable a denial o… |
CVE-2020-0508 | High | 7.8 | 2020-03-12 | Incorrect default permissions in the installer for Intel(R) Graphics Drivers before versions 15.33.49.5100, 15.36.38.5117, 15.40.44.5107, 15.45.30.5103, and 26… |
CVE-2020-10532 | High | 7.5 | 2020-03-12 | The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI. |
CVE-2020-10531 | High | 8.8 | 2020-03-12 | An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exi… |
CVE-2020-1739 | Low | 3.9 | 2020-03-12 | A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is use… |
CVE-2020-0507 | Medium | 4.4 | 2020-03-12 | Unquoted service path in Intel(R) Graphics Drivers before versions 15.33.49.5100, 15.36.38.5117, 15.40.44.5107, 15.45.30.5103, and 26.20.100.7212 may allow an… |
CVE-2020-0506 | Low | 2.3 | 2020-03-12 | Improper initialization in Intel(R) Graphics Drivers before versions 15.40.44.5107, 15.45.29.5077, and 26.20.100.7000 may allow a privileged user to potentiall… |
CVE-2020-0505 | Medium | 6.1 | 2020-03-12 | Improper conditions check in Intel(R) Graphics Drivers before versions 15.33.49.5100, 15.36.38.5117, 15.40.44.5107, 15.45.30.5103, and 26.20.100.7212 may allow… |
CVE-2020-0504 | High | 7.8 | 2020-03-12 | Buffer overflow in Intel(R) Graphics Drivers before versions 15.40.44.5107, 15.45.30.5103, and 26.20.100.7158 may allow an authenticated user to potentially en… |
CVE-2020-0503 | Medium | 5.5 | 2020-03-12 | Improper access control in Intel(R) Graphics Drivers before version 26.20.100.7212 may allow an authenticated user to potentially enable information disclosure… |
CVE-2020-0502 | Medium | 5.3 | 2020-03-12 | Improper access control in Intel(R) Graphics Drivers before version 26.20.100.6912 may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2020-0501 | Medium | 5.5 | 2020-03-12 | Buffer overflow in Intel(R) Graphics Drivers before version 26.20.100.6912 may allow an authenticated user to potentially enable a denial of service via local… |
CVE-2020-9543 | High | 8.3 | 2020-03-12 | OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of… |
CVE-2020-0905 | High | 8.0 | 2020-03-12 | An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'. |
CVE-2020-0903 | Medium | 5.4 | 2020-03-12 | A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exch… |
CVE-2020-0902 | Critical | 9.8 | 2020-03-12 | An elevation of privilege vulnerability exists in Service Fabric File Store Service under certain conditions, aka 'Service Fabric Elevation of Privilege'. |
CVE-2020-0898 | High | 7.8 | 2020-03-12 | An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevat… |
CVE-2020-0897 | High | 7.8 | 2020-03-12 | An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations, aka 'Windows Work Folder Service Elevat… |
CVE-2020-0896 | High | 7.8 | 2020-03-12 | An elevation of privilege vulnerability exists when Windows improperly handles hard links, aka 'Windows Hard Link Elevation of Privilege Vulnerability'. This C… |
CVE-2020-0894 | Medium | 5.4 | 2020-03-12 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |