2020 CVEs (page 182)
Page 182 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3923 | High | 8.1 | 2020-02-27 | DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crack the default passw… |
CVE-2020-3175 | High | 8.6 | 2020-02-26 | A vulnerability in the resource handling system of Cisco NX-OS Software for Cisco MDS 9000 Series Multilayer Switches could allow an unauthenticated, remote at… |
CVE-2020-3174 | Medium | 4.7 | 2020-02-26 | A vulnerability in the anycast gateway feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a device to learn invalid Add… |
CVE-2020-3173 | High | 7.8 | 2020-02-26 | A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary comman… |
CVE-2020-3172 | High | 8.8 | 2020-02-26 | A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to ex… |
CVE-2020-3171 | High | 7.8 | 2020-02-26 | A vulnerability in the local management (local-mgmt) CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to… |
CVE-2020-3170 | Medium | 5.3 | 2020-02-26 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly… |
CVE-2020-3169 | Medium | 6.7 | 2020-02-26 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating… |
CVE-2020-3168 | High | 7.5 | 2020-02-26 | A vulnerability in the Secure Login Enhancements capability of Cisco Nexus 1000V Switch for VMware vSphere could allow an unauthenticated, remote attacker to c… |
CVE-2020-3167 | High | 7.8 | 2020-02-26 | A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on… |
CVE-2020-3166 | Medium | 6.7 | 2020-02-26 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to read or write arbitrary files on the underlying operating sys… |
CVE-2020-3165 | High | 8.2 | 2020-02-26 | A vulnerability in the implementation of Border Gateway Protocol (BGP) Message Digest 5 (MD5) authentication in Cisco NX-OS Software could allow an unauthentic… |
CVE-2020-9274 | High | 7.5 | 2020-02-26 | An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(con… |
CVE-2020-8952 | Medium | 6.1 | 2020-02-26 | Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter. |
CVE-2020-8951 | Medium | 5.4 | 2020-02-26 | Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the Source or Destination field of the Configuration Manager (Configuration Par… |
CVE-2020-9337 | Medium | 6.5 | 2020-02-26 | In GolfBuddy Course Manager 1.1, passwords are sent (with base64 encoding) via a GET request. |
CVE-2020-9407 | Medium | 5.3 | 2020-02-26 | IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie. |
CVE-2020-9406 | Critical | 9.8 | 2020-02-26 | IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service. |
CVE-2020-9405 | Medium | 6.1 | 2020-02-26 | IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page. |
CVE-2020-9398 | Critical | 9.8 | 2020-02-25 | ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection. |
CVE-2020-9394 | High | 8.8 | 2020-02-25 | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF. |
CVE-2020-9393 | Medium | 6.1 | 2020-02-25 | An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS. |
CVE-2020-9379 | Medium | 6.5 | 2020-02-25 | The Software Development Kit of the MiContact Center Business with Site Based Security 8.0 through 9.0.1.0 before KB496276 allows an authenticated user to acce… |
CVE-2020-8810 | High | 8.1 | 2020-02-25 | An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OB… |
CVE-2020-8809 | High | 8.1 | 2020-02-25 | Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can p… |
CVE-2020-9391 | Medium | 5.5 | 2020-02-25 | An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk sys… |
CVE-2020-9019 | Medium | 6.1 | 2020-02-25 | The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description. |
CVE-2020-9018 | Medium | 5.3 | 2020-02-25 | LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user. |
CVE-2020-9008 | Medium | 5.4 | 2020-02-25 | Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the Peop… |
CVE-2020-9335 | Medium | 4.8 | 2020-02-25 | Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow… |
CVE-2020-9334 | Medium | 5.4 | 2020-02-25 | A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a a… |
CVE-2020-9017 | High | 8.0 | 2020-02-25 | LiteCart through 2.2.1 allows CSV injection via a customer's profile. |
CVE-2020-8794 | Critical | 9.8 | 2020-02-25 | OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerabi… |
CVE-2020-8793 | Medium | 4.7 | 2020-02-25 | OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in m… |
CVE-2020-9383 | High | 7.1 | 2020-02-25 | An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC… |
CVE-2020-8819 | High | 8.1 | 2020-02-25 | An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function i… |
CVE-2020-8818 | High | 8.1 | 2020-02-25 | An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in… |
CVE-2020-9385 | High | 7.5 | 2020-02-25 | A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upcean.c, when called from eanx in upcean… |
CVE-2020-9382 | Medium | 5.4 | 2020-02-24 | An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widge… |
CVE-2020-9381 | High | 7.5 | 2020-02-24 | controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in c… |
CVE-2020-1938 | Critical | 9.8 | 2020-02-24 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having hig… |
CVE-2020-1935 | Medium | 4.8 | 2020-02-24 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some… |
CVE-2020-1937 | High | 8.8 | 2020-02-24 | Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries. |
CVE-2020-9374 | Critical | 9.8 | 2020-02-24 | On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker sends specific shel… |
CVE-2020-9369 | High | 7.5 | 2020-02-24 | Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listma… |
CVE-2020-5245 | High | 7.9 | 2020-02-24 | Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by… |
CVE-2020-5244 | High | 8.0 | 2020-02-24 | In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has bee… |
CVE-2020-9366 | Critical | 9.8 | 2020-02-24 | A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt… |
CVE-2020-9365 | High | 7.5 | 2020-02-24 | An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c. |
CVE-2020-9363 | High | 7.8 | 2020-02-24 | The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile… |
CVE-2020-9362 | High | 7.8 | 2020-02-24 | The Quick Heal AV parsing engine (November 2019) allows virus-detection bypass via a crafted GPFLAG in a ZIP archive. This affects Total Security, Home Securit… |
CVE-2020-4222 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4213 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4212 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4211 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4210 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-8131 | High | 7.5 | 2020-02-24 | Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code e… |
CVE-2020-8130 | Medium | 6.4 | 2020-02-24 | There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`. |
CVE-2020-5188 | Medium | 6.5 | 2020-02-24 | DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions. |
CVE-2020-5187 | High | 8.8 | 2020-02-24 | DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2). |
CVE-2020-5186 | Medium | 5.4 | 2020-02-24 | DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2). |
CVE-2020-9355 | Critical | 9.8 | 2020-02-23 | danfruehauf NetworkManager-ssh before 1.2.11 allows privilege escalation because extra options are mishandled. |
CVE-2020-9354 | High | 7.5 | 2020-02-23 | An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) saveFile provided by the console functionality on the /tools/developerConsoleOpera… |
CVE-2020-9353 | High | 7.5 | 2020-02-23 | An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) loadFile provided by the console functionality on the /tools/developerConsoleOpera… |
CVE-2020-9352 | Critical | 9.8 | 2020-02-23 | An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tool… |
CVE-2020-9351 | Medium | 5.3 | 2020-02-23 | An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACal… |
CVE-2020-9350 | Medium | 5.4 | 2020-02-23 | Graph Builder in SAS Visual Analytics 8.5 allows XSS via a graph template that is accessed directly. |
CVE-2020-9342 | Medium | 5.5 | 2020-02-22 | The F-Secure AV parsing engine before 2020-02-05 allows virus-detection bypass via crafted Compression Method data in a GZIP archive. This affects versions bef… |
CVE-2020-9341 | High | 8.8 | 2020-02-22 | CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI. |
CVE-2020-9340 | High | 7.2 | 2020-02-22 | fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/op_kandidat.php id parameter. |
CVE-2020-9339 | Medium | 5.4 | 2020-02-22 | SOPlanning 1.45 allows XSS via the Name or Comment to status.php. |
CVE-2020-9338 | Medium | 5.4 | 2020-02-22 | SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field. |
CVE-2020-9336 | Medium | 5.4 | 2020-02-22 | fauzantrif eLection 2.0 has XSS via the Admin Dashboard -> Settings -> Election -> "message if election is closed" field. |
CVE-2020-9039 | Critical | 9.8 | 2020-02-22 | Couchbase Server 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0 through 4.6.5, 5.0.0, 5.1.1, 5.5.0 and 5.5.1 have Insecure Permissions for the projector and indexer… |
CVE-2020-8813 | High | 8.8 | 2020-02-22 | graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph… |
CVE-2020-8862 | High | 8.8 | 2020-02-22 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authent… |
CVE-2020-8861 | High | 8.8 | 2020-02-22 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders… |
CVE-2020-8860 | High | 8.0 | 2020-02-22 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S10 Firmware G973FXXS3ASJA, O(8.x), P(9.0), Q(… |
CVE-2020-9330 | High | 8.8 | 2020-02-21 | Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connecto… |
CVE-2020-9329 | Medium | 5.9 | 2020-02-21 | Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition. |
CVE-2020-9327 | High | 7.5 | 2020-02-21 | In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizatio… |
CVE-2020-7907 | High | 7.5 | 2020-02-21 | In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections. |
CVE-2020-6842 | High | 7.2 | 2020-02-21 | D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the media renderer n… |
CVE-2020-6841 | Critical | 9.8 | 2020-02-21 | D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName… |
CVE-2020-5326 | Medium | 6.1 | 2020-02-21 | Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (… |
CVE-2020-5324 | High | 7.1 | 2020-02-21 | Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utili… |
CVE-2020-5534 | High | 8.0 | 2020-02-21 | Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges… |
CVE-2020-5533 | Medium | 6.1 | 2020-02-21 | Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecifi… |
CVE-2020-5525 | High | 8.0 | 2020-02-21 | Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows a… |
CVE-2020-5524 | High | 8.8 | 2020-02-21 | Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows a… |
CVE-2020-5243 | Medium | 5.7 | 2020-02-21 | uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression… |
CVE-2020-8960 | Medium | 6.1 | 2020-02-20 | Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS. |
CVE-2020-8601 | High | 7.8 | 2020-02-20 | Trend Micro Vulnerability Protection 2.0 is affected by a vulnerability that could allow an attack to use the product installer to load other DLL files located… |
CVE-2020-5242 | High | 7.7 | 2020-02-20 | openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the… |
CVE-2020-9320 | Medium | 5.5 | 2020-02-20 | Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This affects versions before 8.3.54.138 of Antivirus for Endpoint, A… |
CVE-2020-9015 | Critical | 9.8 | 2020-02-20 | Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass… |
CVE-2020-9003 | Medium | 5.4 | 2020-02-20 | A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an a… |
CVE-2020-8990 | Critical | 9.1 | 2020-02-20 | Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation. |
CVE-2020-9318 | High | 7.2 | 2020-02-20 | Red Gate SQL Monitor 9.0.13 through 9.2.14 allows an administrative user to perform a SQL injection attack by configuring the SNMP alert settings in the UI. Th… |
CVE-2020-6977 | Medium | 6.8 | 2020-02-20 | A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user t… |