2020 CVEs (page 185)
Page 185 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-0021 | Medium | 6.5 | 2020-02-13 | In removeUnusedPackagesLPw of PackageManagerService.java, there is a possible permanent denial-of-service due to a missing package dependency test. This could… |
CVE-2020-0020 | Medium | 5.5 | 2020-02-13 | In getAttributeRange of ExifInterface.java, there is a possible failure to redact location information from media files due to an incorrect bounds check. This… |
CVE-2020-0018 | Medium | 4.4 | 2020-02-13 | In MotionEntry::appendDescription of InputDispatcher.cpp, there is a possible log information disclosure. This could lead to local disclosure of user input wit… |
CVE-2020-0017 | Medium | 4.4 | 2020-02-13 | In multiple places, it was possible for the primary user’s dictionary to be visible to and modifiable by secondary users. This could lead to local information… |
CVE-2020-0015 | High | 7.8 | 2020-02-13 | In onCreate of CertInstaller.java, there is a possible way to overlay the Certificate Installation dialog by a malicious application. This could lead to local… |
CVE-2020-0014 | Medium | 5.5 | 2020-02-13 | It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of p… |
CVE-2020-0005 | Medium | 6.7 | 2020-02-13 | In btm_read_remote_ext_features_complete of btm_acl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalat… |
CVE-2020-8962 | Critical | 9.8 | 2020-02-13 | A stack-based buffer overflow was found on the D-Link DIR-842 REVC with firmware v3.13B09 HOTFIX due to the use of strcpy for LOGINPASSWORD when handling a POS… |
CVE-2020-8953 | Critical | 9.8 | 2020-02-13 | OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication). |
CVE-2020-8964 | Critical | 9.8 | 2020-02-13 | TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550… |
CVE-2020-8963 | Critical | 9.8 | 2020-02-13 | TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550… |
CVE-2020-5239 | High | 8.7 | 2020-02-13 | In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu server… |
CVE-2020-7209 | Critical | 9.8 | 2020-02-13 | LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2. |
CVE-2020-7208 | Medium | 6.1 | 2020-02-13 | LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2. |
CVE-2020-6973 | Medium | 6.2 | 2020-02-13 | Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Multiple cross-site scripting vulnerabilities exis… |
CVE-2020-5241 | High | 7.7 | 2020-02-13 | matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4. |
CVE-2020-6975 | Medium | 4.9 | 2020-02-12 | Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Successful exploitation of this vulnerability coul… |
CVE-2020-1977 | High | 7.5 | 2020-02-12 | Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of… |
CVE-2020-1976 | Medium | 4.7 | 2020-02-12 | A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS ker… |
CVE-2020-1975 | Medium | 6.8 | 2020-02-12 | Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that… |
CVE-2020-8955 | Critical | 9.8 | 2020-02-12 | irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application… |
CVE-2020-5399 | High | 7.4 | 2020-02-12 | Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the… |
CVE-2020-8950 | High | 7.8 | 2020-02-12 | The AUEPLauncher service in Radeon AMD User Experience Program Launcher through 1.0.0.1 on Windows allows elevation of privilege by placing a crafted file in %… |
CVE-2020-6193 | Medium | 6.1 | 2020-02-12 | SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to R… |
CVE-2020-6192 | High | 7.2 | 2020-02-12 | SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP La… |
CVE-2020-6191 | High | 7.2 | 2020-02-12 | SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP… |
CVE-2020-6190 | Medium | 5.8 | 2020-02-12 | Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system l… |
CVE-2020-6189 | Medium | 5.3 | 2020-02-12 | Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-n… |
CVE-2020-6188 | High | 8.8 | 2020-02-12 | VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 1… |
CVE-2020-6187 | Medium | 4.9 | 2020-02-12 | SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised a… |
CVE-2020-6186 | High | 7.5 | 2020-02-12 | SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, le… |
CVE-2020-6185 | Medium | 5.4 | 2020-02-12 | Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), all… |
CVE-2020-6184 | Medium | 6.1 | 2020-02-12 | Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), do… |
CVE-2020-6183 | Medium | 6.5 | 2020-02-12 | SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL proce… |
CVE-2020-6181 | Medium | 5.8 | 2020-02-12 | Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750… |
CVE-2020-6177 | Medium | 4.3 | 2020-02-12 | SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of servic… |
CVE-2020-8949 | High | 8.8 | 2020-02-12 | Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows… |
CVE-2020-8947 | High | 7.2 | 2020-02-12 | functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/ne… |
CVE-2020-8946 | High | 8.8 | 2020-02-12 | Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi… |
CVE-2020-8945 | High | 7.5 | 2020-02-12 | The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This le… |
CVE-2020-7957 | Medium | 5.3 | 2020-02-12 | The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a traili… |
CVE-2020-7046 | High | 7.5 | 2020-02-12 | lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthentic… |
CVE-2020-8839 | Medium | 6.1 | 2020-02-12 | Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field. |
CVE-2020-8815 | High | 7.5 | 2020-02-12 | Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of service via a Slowlor… |
CVE-2020-8595 | High | 7.3 | 2020-02-12 | Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matc… |
CVE-2020-2133 | Medium | 6.5 | 2020-02-12 | Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extend… |
CVE-2020-2132 | Medium | 6.5 | 2020-02-12 | Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed… |
CVE-2020-2131 | Medium | 6.5 | 2020-02-12 | Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with… |
CVE-2020-2130 | Medium | 6.5 | 2020-02-12 | Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by use… |
CVE-2020-2129 | Medium | 6.5 | 2020-02-12 | Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by us… |
CVE-2020-2128 | Medium | 4.3 | 2020-02-12 | Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by u… |
CVE-2020-2127 | Medium | 4.3 | 2020-02-12 | Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where t… |
CVE-2020-2126 | Medium | 4.3 | 2020-02-12 | Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with… |
CVE-2020-2125 | Medium | 4.3 | 2020-02-12 | Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it ca… |
CVE-2020-2124 | Medium | 4.3 | 2020-02-12 | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be… |
CVE-2020-2123 | High | 8.8 | 2020-02-12 | Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executio… |
CVE-2020-2122 | Medium | 5.4 | 2020-02-12 | Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting… |
CVE-2020-2121 | High | 8.8 | 2020-02-12 | Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a re… |
CVE-2020-2120 | High | 8.8 | 2020-02-12 | Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2119 | Medium | 5.3 | 2020-02-12 | Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resultin… |
CVE-2020-2118 | Medium | 4.3 | 2020-02-12 | A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to en… |
CVE-2020-2117 | Medium | 4.3 | 2020-02-12 | A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attac… |
CVE-2020-2116 | High | 8.8 | 2020-02-12 | A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified… |
CVE-2020-2115 | High | 8.8 | 2020-02-12 | Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2114 | High | 7.5 | 2020-02-12 | Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially res… |
CVE-2020-2113 | Medium | 5.4 | 2020-02-12 | Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exp… |
CVE-2020-2112 | Medium | 5.4 | 2020-02-12 | Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability ex… |
CVE-2020-2111 | Medium | 5.4 | 2020-02-12 | Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored… |
CVE-2020-2110 | High | 8.8 | 2020-02-12 | Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming an… |
CVE-2020-2109 | High | 8.8 | 2020-02-12 | Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods. |
CVE-2020-8894 | Medium | 6.5 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php. |
CVE-2020-8893 | High | 7.5 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp. |
CVE-2020-8892 | High | 8.1 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests. |
CVE-2020-8891 | Medium | 5.9 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests. |
CVE-2020-8890 | Medium | 5.9 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when… |
CVE-2020-0792 | High | 8.8 | 2020-02-11 | An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevat… |
CVE-2020-0767 | High | 7.5 | 2020-02-11 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption… |
CVE-2020-0759 | High | 8.8 | 2020-02-11 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
CVE-2020-0757 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists when Windows improperly handles Secure Socket Shell remote commands, aka 'Windows SSH Elevation of Privilege Vul… |
CVE-2020-0756 | Medium | 5.5 | 2020-02-11 | An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit… |
CVE-2020-0755 | Medium | 5.5 | 2020-02-11 | An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit… |
CVE-2020-0754 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of… |
CVE-2020-0753 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of… |
CVE-2020-0752 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0751 | Medium | 6.0 | 2020-02-11 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from a user on a guest oper… |
CVE-2020-0750 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platfor… |
CVE-2020-0749 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platfor… |
CVE-2020-0748 | Medium | 5.5 | 2020-02-11 | An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit… |
CVE-2020-0747 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data Sharing Service Elev… |
CVE-2020-0746 | Medium | 5.5 | 2020-02-11 | An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Infor… |
CVE-2020-0745 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevat… |
CVE-2020-0744 | Medium | 5.5 | 2020-02-11 | An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to r… |
CVE-2020-0743 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platfor… |
CVE-2020-0742 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platfor… |
CVE-2020-0741 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platfor… |
CVE-2020-0740 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platfor… |
CVE-2020-0739 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the way that the dssvc.dll handles file creation allowing for a file overwrite or creation in a secured locat… |
CVE-2020-0738 | High | 8.8 | 2020-02-11 | A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka 'Media Foundation Memory Corruption Vulnerabil… |
CVE-2020-0737 | High | 7.8 | 2020-02-11 | An elevation of privilege vulnerability exists in the way that the tapisrv.dll handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. T… |
CVE-2020-0736 | Medium | 5.5 | 2020-02-11 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |