2020 CVEs (page 183)
Page 183 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6968 | High | 7.8 | 2020-02-20 | Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files. |
CVE-2020-3765 | Critical | 9.8 | 2020-02-20 | Adobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-3764 | High | 7.8 | 2020-02-20 | Adobe Media Encoder versions 14.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . |
CVE-2020-9283 | High | 7.5 | 2020-02-20 | golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A cli… |
CVE-2020-9273 | High | 8.8 | 2020-02-20 | In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c… |
CVE-2020-9272 | High | 7.5 | 2020-02-20 | ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in mod_cap via the cap_text.c cap_to_text function. |
CVE-2020-9308 | High | 8.8 | 2020-02-20 | archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero… |
CVE-2020-7942 | Medium | 6.5 | 2020-02-19 | Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate al… |
CVE-2020-6970 | Critical | 9.8 | 2020-02-19 | A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are in use) and all ver… |
CVE-2020-3945 | High | 7.5 | 2020-02-19 | vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) contains an information disclosure vulnerability due to incorrect pairi… |
CVE-2020-3944 | High | 8.6 | 2020-02-19 | vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading to authentication byp… |
CVE-2020-3943 | Critical | 9.8 | 2020-02-19 | vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configured. An unauthentic… |
CVE-2020-3163 | Medium | 5.9 | 2020-02-19 | A vulnerability in the Live Data server of Cisco Unified Contact Center Enterprise could allow an unauthenticated, remote attacker to cause a denial of service… |
CVE-2020-3160 | Medium | 5.3 | 2020-02-19 | A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) feature of Cisco Meeting Server software could allow an unauthenticated, remote attack… |
CVE-2020-3159 | Medium | 6.1 | 2020-02-19 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)… |
CVE-2020-3158 | Critical | 9.1 | 2020-02-19 | A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensi… |
CVE-2020-3156 | Medium | 6.1 | 2020-02-19 | A vulnerability in the logging component of Cisco Identity Services Engine could allow an unauthenticated remote attacker to conduct cross-site scripting attac… |
CVE-2020-3154 | Medium | 4.9 | 2020-02-19 | A vulnerability in the web UI of Cisco Cloud Web Security (CWS) could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerabili… |
CVE-2020-3153 | Medium | 6.5 | 2020-02-19 | A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supp… |
CVE-2020-3138 | Medium | 6.7 | 2020-02-19 | A vulnerability in the upgrade component of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to install a mali… |
CVE-2020-3132 | Medium | 5.9 | 2020-02-19 | A vulnerability in the email message scanning feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote… |
CVE-2020-3114 | High | 8.8 | 2020-02-19 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a… |
CVE-2020-3113 | Medium | 5.4 | 2020-02-19 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to conduct a cr… |
CVE-2020-3112 | High | 8.8 | 2020-02-19 | A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to elevate privileges on the… |
CVE-2020-6062 | High | 7.5 | 2020-02-19 | An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead… |
CVE-2020-6061 | Critical | 9.8 | 2020-02-19 | An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request ca… |
CVE-2020-8959 | High | 7.8 | 2020-02-19 | Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking. |
CVE-2020-8824 | Medium | 5.4 | 2020-02-19 | Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless > Access Control > Add Managed Device screen. |
CVE-2020-8441 | Critical | 9.8 | 2020-02-19 | JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product. |
CVE-2020-4230 | Medium | 6.7 | 2020-02-19 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 and 11.5 is vulnerable to an escalation of privilege when an authenticated local attacke… |
CVE-2020-4204 | High | 7.8 | 2020-02-19 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds… |
CVE-2020-4200 | Medium | 6.5 | 2020-02-19 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated attacker to send specially crafted commands… |
CVE-2020-4161 | Medium | 6.5 | 2020-02-19 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service due to incorrect hand… |
CVE-2020-4135 | High | 7.5 | 2020-02-19 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to send specially crafted… |
CVE-2020-8633 | Medium | 5.3 | 2020-02-18 | An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed moun… |
CVE-2020-7796 | Critical | 9.8 | 2020-02-18 | Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. |
CVE-2020-9271 | Medium | 6.5 | 2020-02-18 | ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php. |
CVE-2020-9270 | High | 8.8 | 2020-02-18 | ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php. |
CVE-2020-9269 | High | 7.2 | 2020-02-18 | SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php. |
CVE-2020-9268 | High | 7.5 | 2020-02-18 | SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring. |
CVE-2020-9267 | Medium | 6.5 | 2020-02-18 | SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php. |
CVE-2020-9266 | Medium | 6.5 | 2020-02-18 | SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php. |
CVE-2020-9265 | High | 8.2 | 2020-02-18 | phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmc_username. |
CVE-2020-7450 | Critical | 9.8 | 2020-02-18 | In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE… |
CVE-2020-9264 | Medium | 5.5 | 2020-02-18 | ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive. This affects versions befor… |
CVE-2020-6845 | Medium | 6.1 | 2020-02-18 | An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS… |
CVE-2020-6844 | High | 8.8 | 2020-02-18 | In TopManage OLK 2020, login CSRF can be chained with another vulnerability in order to takeover admin and user accounts. |
CVE-2020-5530 | High | 8.8 | 2020-02-18 | Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authentication of adminis… |
CVE-2020-8012 | Critical | 9.8 | 2020-02-18 | CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) componen… |
CVE-2020-8011 | High | 7.5 | 2020-02-18 | CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a null pointer dereference vulnerability in the robot (controller)… |
CVE-2020-8010 | Critical | 9.8 | 2020-02-18 | CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) c… |
CVE-2020-1842 | Medium | 6.8 | 2020-02-18 | Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient au… |
CVE-2020-1855 | Medium | 6.1 | 2020-02-18 | Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vul… |
CVE-2020-1843 | Medium | 6.8 | 2020-02-18 | Huawei HEGE-560 version 1.0.1.20(SP2), OSCA-550 version 1.0.0.71(SP1), OSCA-550A version 1.0.0.71(SP1), OSCA-550AX version 1.0.0.71(SP2), and OSCA-550X version… |
CVE-2020-1812 | High | 7.8 | 2020-02-18 | HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. Due to improperly validation of certai… |
CVE-2020-1791 | Low | 2.4 | 2020-02-18 | HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. The system has a logic judging error… |
CVE-2020-1790 | High | 8.8 | 2020-02-18 | GaussDB 200 with version of 6.5.1 have a command injection vulnerability. The software constructs part of a command using external input from users, but the so… |
CVE-2020-1789 | Medium | 6.8 | 2020-02-18 | Huawei OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X products with version 1.0.1.21(SP3) have an insufficient authentication vulnerability. The software does… |
CVE-2020-1872 | Medium | 4.6 | 2020-02-18 | Huawei smart phones P10 Plus with versions earlier than 9.1.0.201(C01E75R1P12T8), earlier than 9.1.0.252(C185E2R1P9T8), earlier than 9.1.0.252(C432E4R1P9T8), a… |
CVE-2020-1814 | Medium | 5.3 | 2020-02-18 | Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C… |
CVE-2020-1882 | Medium | 4.6 | 2020-02-18 | Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180(C185E6R3P3), earlier than 10.0.0.180(C432E6R1P7), earlier than 10.0.0.180(C636E5R2P3); HUAWEI M… |
CVE-2020-1830 | Medium | 5.3 | 2020-02-18 | Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C… |
CVE-2020-1816 | High | 7.5 | 2020-02-18 | Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C… |
CVE-2020-1815 | High | 7.5 | 2020-02-18 | Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C… |
CVE-2020-1811 | High | 8.8 | 2020-02-18 | GaussDB 200 with version of 6.5.1 have a command injection vulnerability. Due to insufficient input validation, remote attackers with low permissions could exp… |
CVE-2020-8768 | Critical | 9.4 | 2020-02-17 | An issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L before 1.2.3 devices. There is an insecure mechanism for read… |
CVE-2020-7959 | Medium | 5.3 | 2020-02-17 | LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker m… |
CVE-2020-1856 | High | 7.5 | 2020-02-17 | Huawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Secospace USG6600, and USG9500 versions V500R001C30, V500R001C60, and V500R005C00 have an information… |
CVE-2020-1853 | Medium | 6.5 | 2020-02-17 | GaussDB 200 with version of 6.5.1 have a path traversal vulnerability. Due to insufficient input path validation, an authenticated attacker can traverse direct… |
CVE-2020-1841 | High | 7.5 | 2020-02-17 | Huawei CloudLink Board version 20.0.0; DP300 version V500R002C00; RSE6500 versions V100R001C00, V500R002C00, and V500R002C00SPC900; and TE60 versions V500R002C… |
CVE-2020-1829 | High | 7.5 | 2020-02-17 | Huawei NIP6800 versions V500R001C30 and V500R001C60SPC500; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, and V500R001C60SPC5… |
CVE-2020-1827 | High | 7.5 | 2020-02-17 | Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600… |
CVE-2020-1858 | High | 7.5 | 2020-02-17 | Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R001C60SPC500, and V5… |
CVE-2020-1857 | Medium | 5.5 | 2020-02-17 | Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600… |
CVE-2020-1828 | High | 7.5 | 2020-02-17 | Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R… |
CVE-2020-1693 | High | 8.6 | 2020-02-17 | A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote att… |
CVE-2020-7597 | High | 8.8 | 2020-02-17 | codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by… |
CVE-2020-9043 | High | 8.8 | 2020-02-17 | The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key. |
CVE-2020-1704 | High | 7.0 | 2020-02-17 | An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio… |
CVE-2020-9038 | Medium | 5.4 | 2020-02-17 | Joplin through 1.0.184 allows Arbitrary File Read via XSS. |
CVE-2020-6850 | Medium | 6.1 | 2020-02-17 | Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is r… |
CVE-2020-1692 | High | 8.1 | 2020-02-17 | Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course. |
CVE-2020-9006 | Critical | 9.8 | 2020-02-17 | The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deser… |
CVE-2020-8795 | High | 7.5 | 2020-02-17 | In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users. |
CVE-2020-8518 | Critical | 9.8 | 2020-02-17 | Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution. |
CVE-2020-8427 | Critical | 9.8 | 2020-02-17 | In Unitrends Backup before 10.4.1, an HTTP request parameter was not properly sanitized, allowing for SQL injection that resulted in an authentication bypass. |
CVE-2020-9005 | High | 7.8 | 2020-02-17 | meshsystem.dll in Valve Dota 2 through 2020-02-17 allows remote attackers to achieve code execution or denial of service by creating a gaming server with a cra… |
CVE-2020-7252 | Medium | 4.2 | 2020-02-17 | Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service… |
CVE-2020-5531 | Critical | 9.8 | 2020-02-17 | Mitsubishi Electric MELSEC C Controller Module and MELIPC Series MI5000 MELSEC-Q Series C Controller Module(Q24DHCCPU-V, Q24DHCCPU-VG User Ethernet port (CH1… |
CVE-2020-9033 | Medium | 6.5 | 2020-02-17 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to authl… |
CVE-2020-9032 | Medium | 6.5 | 2020-02-17 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to kernl… |
CVE-2020-9031 | Medium | 6.5 | 2020-02-17 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to daemo… |
CVE-2020-9030 | Medium | 6.5 | 2020-02-17 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to the s… |
CVE-2020-9029 | Medium | 6.5 | 2020-02-17 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to messa… |
CVE-2020-9028 | Medium | 6.1 | 2020-02-17 | Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User C… |
CVE-2020-9027 | Critical | 9.8 | 2020-02-17 | ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected. |
CVE-2020-9026 | Critical | 9.8 | 2020-02-17 | ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected. |
CVE-2020-9025 | Medium | 6.1 | 2020-02-17 | Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py… |
CVE-2020-9024 | Critical | 9.8 | 2020-02-17 | Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loa… |
CVE-2020-9023 | Critical | 9.8 | 2020-02-17 | Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (User bluetooth, passw… |