2020 CVEs (page 181)
Page 181 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6794 | Medium | 6.5 | 2020-03-02 | If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is becau… |
CVE-2020-6793 | Medium | 6.5 | 2020-03-02 | When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. This vulnerability affects Thunderbird… |
CVE-2020-6792 | Medium | 4.3 | 2020-03-02 | When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 6… |
CVE-2020-9548 | Critical | 9.8 | 2020-03-02 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPC… |
CVE-2020-9547 | Critical | 9.8 | 2020-03-02 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transac… |
CVE-2020-9546 | Critical | 9.8 | 2020-03-02 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zax… |
CVE-2020-9545 | High | 7.5 | 2020-03-02 | Pale Moon 28.x before 28.8.4 has a segmentation fault related to module scripting, as demonstrated by a Lacoste web site. |
CVE-2020-9540 | High | 7.8 | 2020-03-02 | Sophos HitmanPro.Alert before build 861 allows local elevation of privilege. |
CVE-2020-9535 | High | 8.8 | 2020-03-02 | fmwlan.c on D-Link DIR-615Jx10 devices has a stack-based buffer overflow via the formWlanSetup_Wizard webpage parameter when f_radius_ip1 is malformed. |
CVE-2020-9534 | High | 8.8 | 2020-03-02 | fmwlan.c on D-Link DIR-615Jx10 devices has a stack-based buffer overflow via the formWlanSetup webpage parameter when f_radius_ip1 is malformed. |
CVE-2020-6804 | High | 8.8 | 2020-02-28 | A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. Whe… |
CVE-2020-6803 | Medium | 5.4 | 2020-02-28 | An open redirect is present on the gateway's login page, which could cause a user to be redirected to a malicious site after logging in. |
CVE-2020-9459 | Medium | 5.4 | 2020-02-28 | Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authentic… |
CVE-2020-9449 | High | 8.8 | 2020-02-28 | An insecure random number generation vulnerability in BlaB! AX, BlaB! AX Pro, BlaB! WS (client), and BlaB! WS Pro (client) version 19.11 allows an attacker (wi… |
CVE-2020-9466 | Medium | 6.1 | 2020-02-28 | The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection. |
CVE-2020-9465 | Critical | 9.8 | 2020-02-28 | An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated… |
CVE-2020-8132 | Critical | 9.8 | 2020-02-28 | Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrust… |
CVE-2020-8127 | Medium | 6.1 | 2020-02-28 | Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting atta… |
CVE-2020-1881 | High | 7.5 | 2020-02-28 | NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have have a resource management error vulnerabili… |
CVE-2020-1877 | Medium | 4.4 | 2020-02-28 | NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an invalid pointer access vulnerability. The software… |
CVE-2020-1876 | High | 7.5 | 2020-02-28 | NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds write vulnerability. An unauthentica… |
CVE-2020-1875 | Medium | 5.5 | 2020-02-28 | NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an invalid pointer access vulnerability. The soft… |
CVE-2020-1874 | Medium | 5.5 | 2020-02-28 | NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have a invalid pointer access vulnerability. The softw… |
CVE-2020-1873 | High | 7.5 | 2020-02-28 | NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds read vulnerability. An unau… |
CVE-2020-1861 | Medium | 4.4 | 2020-02-28 | CloudEngine 12800 with versions of V200R001C00SPC600,V200R001C00SPC700,V200R002C01,V200R002C50SPC800,V200R002C50SPC800PWE,V200R003C00SPC810,V200R003C00SPC810PW… |
CVE-2020-1860 | High | 7.5 | 2020-02-28 | NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an access control bypass vulnerability. Atta… |
CVE-2020-1844 | High | 7.8 | 2020-02-28 | PCManager with versions earlier than 10.0.5.51 have a privilege escalation vulnerability in Huawei PCManager products. An authenticated, local attacker can per… |
CVE-2020-1792 | Medium | 5.5 | 2020-02-28 | Honor V10 smartphones with versions earlier than BKL-AL20 10.0.0.156(C00E156R2P4) and versions earlier than BKL-L09 10.0.0.146(C432E4R1P4) have an out of bound… |
CVE-2020-9463 | High | 8.8 | 2020-02-28 | Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/intern… |
CVE-2020-5247 | Medium | 6.5 | 2020-02-28 | In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline charact… |
CVE-2020-9447 | Medium | 6.1 | 2020-02-28 | There is an XSS (cross-site scripting) vulnerability in GwtUpload 1.0.3 in the file upload functionality. Someone can upload a file with a malicious filename… |
CVE-2020-9442 | High | 7.8 | 2020-02-28 | OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privi… |
CVE-2020-9399 | Medium | 5.5 | 2020-02-28 | The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Ant… |
CVE-2020-9434 | Critical | 9.1 | 2020-02-27 | openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. |
CVE-2020-9433 | Critical | 9.1 | 2020-02-27 | openssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. |
CVE-2020-9432 | Critical | 9.1 | 2020-02-27 | openssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values. |
CVE-2020-9431 | High | 7.5 | 2020-02-27 | In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc… |
CVE-2020-9430 | High | 7.5 | 2020-02-27 | In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash. This was addressed in plugins/epan/wimax/msg_dlmap.c b… |
CVE-2020-9429 | High | 7.5 | 2020-02-27 | In Wireshark 3.2.0 to 3.2.1, the WireGuard dissector could crash. This was addressed in epan/dissectors/packet-wireguard.c by handling the situation where a ce… |
CVE-2020-9428 | High | 7.5 | 2020-02-27 | In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using mo… |
CVE-2020-6418 | High | 8.8 | 2020-02-27 | Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6407 | High | 8.8 | 2020-02-27 | Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2020-6386 | High | 8.8 | 2020-02-27 | Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6384 | High | 8.8 | 2020-02-27 | Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6383 | High | 8.8 | 2020-02-27 | Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-7063 | Medium | 5.5 | 2020-02-27 | In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the file… |
CVE-2020-7062 | High | 7.5 | 2020-02-27 | In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but… |
CVE-2020-7061 | Medium | 6.5 | 2020-02-27 | In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could l… |
CVE-2020-3878 | High | 7.8 | 2020-02-27 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watch… |
CVE-2020-3877 | High | 7.5 | 2020-02-27 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3, watchOS 6.1.2. A remote attacker may be able… |
CVE-2020-3875 | Medium | 5.5 | 2020-02-27 | A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, wa… |
CVE-2020-3874 | Medium | 5.3 | 2020-02-27 | An issued existed in the naming of screenshots. The issue was corrected with improved naming. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Screenshots… |
CVE-2020-3873 | Low | 3.3 | 2020-02-27 | This issue was addressed with improved setting propagation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Turning off "Load remote content in messages”… |
CVE-2020-3872 | Medium | 5.5 | 2020-02-27 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13… |
CVE-2020-3871 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arb… |
CVE-2020-3870 | High | 7.8 | 2020-02-27 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, w… |
CVE-2020-3869 | Medium | 5.3 | 2020-02-27 | An issue existed in the handling of the local user's self-view. The issue was corrected with improved logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3… |
CVE-2020-3868 | High | 8.8 | 2020-02-27 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5… |
CVE-2020-3867 | Medium | 6.1 | 2020-02-27 | A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows… |
CVE-2020-3866 | Medium | 5.5 | 2020-02-27 | This was addressed with additional checks by Gatekeeper on files mounted through a network share. This issue is fixed in macOS Catalina 10.15.3. Searching for… |
CVE-2020-3865 | High | 8.8 | 2020-02-27 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5… |
CVE-2020-3862 | Medium | 6.5 | 2020-02-27 | A denial of service issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes… |
CVE-2020-3861 | High | 7.1 | 2020-02-27 | The issue was addressed with improved permissions logic. This issue is fixed in iTunes for Windows 12.10.4. A user may gain access to protected parts of the fi… |
CVE-2020-3860 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, watchOS 6.1.2. An application may… |
CVE-2020-3859 | Low | 2.4 | 2020-02-27 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. A person with physical… |
CVE-2020-3858 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. An application may be able to execu… |
CVE-2020-3857 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1… |
CVE-2020-3856 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3… |
CVE-2020-3854 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arb… |
CVE-2020-3853 | High | 7.8 | 2020-02-27 | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, w… |
CVE-2020-3846 | High | 8.8 | 2020-02-27 | A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchO… |
CVE-2020-3845 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arb… |
CVE-2020-3844 | Low | 3.3 | 2020-02-27 | This issue was addressed with improved checks. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Users removed from an iMessage conversation may still be ab… |
CVE-2020-3843 | High | 8.8 | 2020-02-27 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4.7, watchOS 5.3.7. A remote attacker may be able to caus… |
CVE-2020-3842 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1… |
CVE-2020-3841 | Medium | 6.5 | 2020-02-27 | The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. A local user may unknowingly send a pass… |
CVE-2020-3840 | High | 7.8 | 2020-02-27 | An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. This issue is fixed in iO… |
CVE-2020-3839 | Medium | 5.5 | 2020-02-27 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.3. An application may be able to read restricted… |
CVE-2020-3838 | High | 7.8 | 2020-02-27 | The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1… |
CVE-2020-3837 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1… |
CVE-2020-3836 | Medium | 5.5 | 2020-02-27 | An access issue was addressed with improved memory management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchO… |
CVE-2020-3835 | Medium | 4.4 | 2020-02-27 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10… |
CVE-2020-3834 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 6.1.2. An application may be able to execute arbitrary c… |
CVE-2020-3833 | Medium | 4.3 | 2020-02-27 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.5. Visiting a malicious website may lead… |
CVE-2020-3831 | High | 7.0 | 2020-02-27 | A race condition was addressed with improved locking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. An application may be able to execute arbitrary code… |
CVE-2020-3830 | Low | 3.3 | 2020-02-27 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10… |
CVE-2020-3829 | High | 7.8 | 2020-02-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, wa… |
CVE-2020-3828 | Low | 2.4 | 2020-02-27 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 a… |
CVE-2020-3827 | High | 7.8 | 2020-02-27 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. Viewing a maliciously crafted JPEG file… |
CVE-2020-3826 | High | 7.8 | 2020-02-27 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, w… |
CVE-2020-3825 | High | 8.8 | 2020-02-27 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5… |
CVE-2020-5402 | High | 8.8 | 2020-02-27 | In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when… |
CVE-2020-5401 | Medium | 5.3 | 2020-02-27 | Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to… |
CVE-2020-5400 | Medium | 6.5 | 2020-02-27 | Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information… |
CVE-2020-7043 | Critical | 9.1 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do… |
CVE-2020-7042 | Medium | 5.3 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check ope… |
CVE-2020-7041 | Medium | 5.3 | 2020-02-27 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host neg… |
CVE-2020-6864 | Medium | 6.5 | 2020-02-27 | ZTE E8820V3 router product is impacted by an information leak vulnerability. Attackers could use this vulnerability to to gain wireless passwords. After obtain… |
CVE-2020-6863 | Medium | 6.5 | 2020-02-27 | ZTE E8820V3 router product is impacted by a permission and access control vulnerability. Attackers could use this vulnerability to tamper with DDNS parameters… |
CVE-2020-3924 | Medium | 6.4 | 2020-02-27 | DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a pat… |