2020 CVEs (page 178)
Page 178 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10419 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/m… |
CVE-2020-10418 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/m… |
CVE-2020-10417 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/m… |
CVE-2020-10416 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/k… |
CVE-2020-10415 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/i… |
CVE-2020-10414 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/i… |
CVE-2020-10413 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/i… |
CVE-2020-10412 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/i… |
CVE-2020-10411 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/e… |
CVE-2020-10410 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/e… |
CVE-2020-10409 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/e… |
CVE-2020-10408 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/e… |
CVE-2020-10407 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/e… |
CVE-2020-10406 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/e… |
CVE-2020-10405 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/e… |
CVE-2020-10404 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/e… |
CVE-2020-10403 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/e… |
CVE-2020-10402 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/e… |
CVE-2020-10401 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/e… |
CVE-2020-10400 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/a… |
CVE-2020-10399 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/a… |
CVE-2020-10398 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/a… |
CVE-2020-10397 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/a… |
CVE-2020-10396 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/a… |
CVE-2020-10395 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/a… |
CVE-2020-10394 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/a… |
CVE-2020-10393 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/a… |
CVE-2020-10392 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/a… |
CVE-2020-10391 | Medium | 4.8 | 2020-03-12 | The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/a… |
CVE-2020-10390 | High | 7.2 | 2020-03-12 | OS Command Injection in export.php (vulnerable function called from include/functions-article.php) in Chadha PHPKB Standard Multi-Language 9 allows remote atta… |
CVE-2020-10389 | High | 7.2 | 2020-03-12 | admin/save-settings.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by injecting PHP code into any POST paramet… |
CVE-2020-10388 | Medium | 5.4 | 2020-03-12 | The way the Referer header in article.php is handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored (Blind) XSS (injecting arbitr… |
CVE-2020-10387 | Medium | 4.9 | 2020-03-12 | Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash… |
CVE-2020-10386 | High | 7.2 | 2020-03-12 | admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the… |
CVE-2020-10109 | Critical | 9.8 | 2020-03-12 | In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the cont… |
CVE-2020-10108 | Critical | 9.8 | 2020-03-12 | In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header… |
CVE-2020-7254 | High | 7.7 | 2020-03-12 | Privilege Escalation vulnerability in the command line interface in McAfee Advanced Threat Defense (ATD) 4.x prior to 4.8.2 allows local users to execute arbit… |
CVE-2020-7253 | Medium | 5.7 | 2020-03-12 | Improper access control vulnerability in masvc.exe in McAfee Agent (MA) prior to 5.6.4 allows local users with administrator privileges to disable self-protect… |
CVE-2020-7943 | High | 7.5 | 2020-03-11 | Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like host… |
CVE-2020-7598 | Medium | 5.6 | 2020-03-11 | minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload. |
CVE-2020-5958 | High | 7.8 | 2020-03-11 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which an attacker with local system access c… |
CVE-2020-1947 | Critical | 9.8 | 2020-03-11 | In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource… |
CVE-2020-9408 | High | 8.8 | 2020-03-11 | The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerabilit… |
CVE-2020-1981 | High | 7.0 | 2020-03-11 | A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This issue allows a local attacker who bypassed the restricted shel… |
CVE-2020-1980 | High | 7.8 | 2020-03-11 | A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. This issue… |
CVE-2020-1979 | High | 8.1 | 2020-03-11 | A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and acc… |
CVE-2020-1733 | Medium | 5.0 | 2020-03-11 | A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user… |
CVE-2020-8540 | Critical | 9.8 | 2020-03-11 | An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbit… |
CVE-2020-10181 | Critical | 9.8 | 2020-03-11 | goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a devic… |
CVE-2020-5203 | Critical | 9.8 | 2020-03-11 | In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_PO… |
CVE-2020-10376 | Critical | 9.8 | 2020-03-11 | Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header. |
CVE-2020-6210 | Medium | 6.1 | 2020-03-10 | SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the l… |
CVE-2020-6209 | High | 7.5 | 2020-03-10 | SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts… |
CVE-2020-6208 | High | 8.2 | 2020-03-10 | SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can… |
CVE-2020-6207 | Critical | 9.8 | 2020-03-10 | SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resultin… |
CVE-2020-6206 | Medium | 4.3 | 2020-03-10 | SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim t… |
CVE-2020-6205 | Medium | 6.1 | 2020-03-10 | SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; do… |
CVE-2020-6204 | Medium | 4.3 | 2020-03-10 | The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE ve… |
CVE-2020-6203 | Critical | 9.1 | 2020-03-10 | SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of pat… |
CVE-2020-6202 | High | 7.2 | 2020-03-10 | SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP dat… |
CVE-2020-6201 | Medium | 6.1 | 2020-03-10 | The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL p… |
CVE-2020-6200 | Medium | 5.4 | 2020-03-10 | The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scri… |
CVE-2020-6199 | Medium | 5.4 | 2020-03-10 | The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Managemen… |
CVE-2020-6198 | Critical | 9.8 | 2020-03-10 | SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remo… |
CVE-2020-6197 | Low | 3.3 | 2020-03-10 | SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow attackers with local… |
CVE-2020-6196 | High | 7.5 | 2020-03-10 | SAP BusinessObjects Mobile (MobileBIService), version 4.2, allows an attacker to generate multiple requests, using which he can block all the threads resulting… |
CVE-2020-6178 | Medium | 5.4 | 2020-03-10 | SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Informati… |
CVE-2020-10372 | Medium | 5.4 | 2020-03-10 | Ramp AltitudeCDN Altimeter before 2.4.0 allows authenticated Stored XSS via the vdms/ipmapping.jsp location field to the dms/rest/services/datastore/createOrEd… |
CVE-2020-0087 | Medium | 5.5 | 2020-03-10 | In getProcessPss of ActivityManagerService.java, there is a possible side channel information disclosure. This could lead to local information disclosure with… |
CVE-2020-0085 | High | 7.8 | 2020-03-10 | In setBluetoothTethering of PanService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of pr… |
CVE-2020-0084 | High | 7.8 | 2020-03-10 | In several functions of NotificationManagerService.java, there are missing permission checks. This could lead to local escalation of privilege by creating fake… |
CVE-2020-0066 | Medium | 6.4 | 2020-03-10 | In the netlink driver, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution… |
CVE-2020-0063 | High | 7.3 | 2020-03-10 | In SurfaceFlinger, it is possible to override UI confirmation screen protected by the TEE. This could lead to local escalation of privilege with no additional… |
CVE-2020-0062 | High | 7.5 | 2020-03-10 | In Euicc, there is a possible information disclosure due to an included test Certificate. This could lead to remote information disclosure with no additional e… |
CVE-2020-0057 | Medium | 5.5 | 2020-03-10 | In btm_process_inq_results of btm_inq.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure… |
CVE-2020-0056 | Medium | 5.5 | 2020-03-10 | In btu_hcif_connection_comp_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disc… |
CVE-2020-0055 | Medium | 5.5 | 2020-03-10 | In l2c_link_process_num_completed_pkts of l2c_link.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local informati… |
CVE-2020-0054 | High | 7.8 | 2020-03-10 | In WifiNetworkSuggestionsManager of WifiNetworkSuggestionsManager.java, there is a possible permission revocation due to a missing permission check. This could… |
CVE-2020-0053 | Medium | 6.7 | 2020-03-10 | In convertHidlNanDataPathInitiatorRequestToLegacy, and convertHidlNanDataPathIndicationResponseToLegacy of hidl_struct_util.cpp, there is a possible out of bou… |
CVE-2020-0052 | Medium | 4.3 | 2020-03-10 | In smsSelected of AnswerFragment.java, there is a way to send an SMS from the lock screen due to a permissions bypass. This could lead to local escalation of p… |
CVE-2020-0051 | High | 7.8 | 2020-03-10 | In onCreate of SettingsHomepageActivity, there is a possible tapjacking attack. This could lead to local escalation of privilege in Settings with no additional… |
CVE-2020-0050 | Medium | 6.7 | 2020-03-10 | In nfa_hciu_send_msg of nfa_hci_utils.cc, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of priv… |
CVE-2020-0049 | Medium | 6.5 | 2020-03-10 | In onReadBuffer() of StreamingSource.cpp, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosur… |
CVE-2020-0048 | Medium | 5.5 | 2020-03-10 | In onTransact of IAudioFlinger.cpp, there is a possible stack information leak due to uninitialized data. This could lead to local information disclosure with… |
CVE-2020-0047 | Low | 3.3 | 2020-03-10 | In setMasterMute of AudioService.java, there is a missing permission check. This could lead to local silencing of audio with no additional execution privileges… |
CVE-2020-0046 | High | 7.8 | 2020-03-10 | In DrmPlugin::releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation o… |
CVE-2020-0045 | Medium | 6.4 | 2020-03-10 | In StatsService::command of StatsService.cpp, there is possible memory corruption due to a race condition. This could lead to local escalation of privilege wit… |
CVE-2020-9044 | High | 7.5 | 2020-03-10 | XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. T… |
CVE-2020-7579 | Medium | 6.1 | 2020-03-10 | A vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspec… |
CVE-2020-0083 | High | 7.5 | 2020-03-10 | In setRequirePmfInternal of sta_network.cpp, there is a possible default value being improperly applied due to a logic error. This could lead to remote denial… |
CVE-2020-0069 | High | 7.8 | 2020-03-10 | In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux… |
CVE-2020-0061 | Medium | 5.5 | 2020-03-10 | In Pixel Recorder, there is a possible permissions bypass allowing arbitrary apps to record audio. This could lead to local information disclosure with no addi… |
CVE-2020-0060 | Medium | 4.4 | 2020-03-10 | In query of SmsProvider.java and MmsSmsProvider.java, there is a possible permission bypass due to SQL injection. This could lead to local information disclosu… |
CVE-2020-0059 | Medium | 5.5 | 2020-03-10 | In btm_ble_batchscan_filter_track_adv_vse_cback of btm_ble_batchscan.cc, there is a possible out of bounds read due to a missing bounds check. This could lead… |
CVE-2020-0058 | Medium | 4.4 | 2020-03-10 | In l2c_rcv_acl_data of l2c_main.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure wi… |
CVE-2020-0044 | Medium | 4.4 | 2020-03-10 | In set_nonce of fpc_ta_qc_auth.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with Sy… |
CVE-2020-0043 | Medium | 4.4 | 2020-03-10 | In authorize_enrol of fpc_ta_hw_auth.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure w… |
CVE-2020-0042 | Medium | 4.4 | 2020-03-10 | In fpc_ta_hw_auth_unwrap_key of fpc_ta_hw_auth_qsee.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local informati… |
CVE-2020-0041 | High | 7.8 | 2020-03-10 | In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege w… |
CVE-2020-0039 | High | 7.5 | 2020-03-10 | In rw_i93_sm_update_ndef of rw_i93.cc, there is a possible read of uninitialized data due to a missing bounds check. This could lead to remote information disc… |