2020 CVEs (page 187)
Page 187 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6413 | High | 8.8 | 2020-02-11 | Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass HTML validators via a crafted HTML page. |
CVE-2020-6412 | Medium | 5.4 | 2020-02-11 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homog… |
CVE-2020-6411 | Medium | 5.4 | 2020-02-11 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homog… |
CVE-2020-6410 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in navigation in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to confuse the user via a crafted domain name. |
CVE-2020-6409 | High | 8.8 | 2020-02-11 | Inappropriate implementation in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker who convinced the user to enter a URI to bypass naviga… |
CVE-2020-6408 | Medium | 6.5 | 2020-02-11 | Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a craft… |
CVE-2020-6406 | High | 8.8 | 2020-02-11 | Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6405 | Medium | 6.5 | 2020-02-11 | Out of bounds read in SQLite in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2020-6404 | High | 8.8 | 2020-02-11 | Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2020-6403 | Medium | 4.3 | 2020-02-11 | Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via… |
CVE-2020-6402 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious ext… |
CVE-2020-6401 | Medium | 6.5 | 2020-02-11 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homog… |
CVE-2020-6400 | Medium | 6.5 | 2020-02-11 | Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6399 | Medium | 6.5 | 2020-02-11 | Insufficient policy enforcement in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6398 | High | 8.8 | 2020-02-11 | Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF f… |
CVE-2020-6397 | Medium | 6.5 | 2020-02-11 | Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-6396 | Medium | 4.3 | 2020-02-11 | Inappropriate implementation in Skia in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf… |
CVE-2020-6395 | Medium | 6.5 | 2020-02-11 | Out of bounds read in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memo… |
CVE-2020-6394 | Medium | 5.4 | 2020-02-11 | Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2020-6393 | Medium | 6.5 | 2020-02-11 | Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6392 | Medium | 4.3 | 2020-02-11 | Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-6391 | Medium | 4.3 | 2020-02-11 | Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a cra… |
CVE-2020-6390 | High | 8.8 | 2020-02-11 | Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2020-6389 | High | 8.8 | 2020-02-11 | Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video strea… |
CVE-2020-6388 | High | 8.8 | 2020-02-11 | Out of bounds access in WebAudio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2020-6387 | High | 8.8 | 2020-02-11 | Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video strea… |
CVE-2020-6385 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2020-6382 | High | 8.8 | 2020-02-11 | Type confusion in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6381 | High | 8.8 | 2020-02-11 | Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption… |
CVE-2020-6380 | High | 8.8 | 2020-02-11 | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2020-6379 | High | 8.8 | 2020-02-11 | Use after free in V8 in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6378 | High | 8.8 | 2020-02-11 | Use after free in speech in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-8596 | High | 7.5 | 2020-02-11 | participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the… |
CVE-2020-7217 | High | 7.5 | 2020-02-11 | An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 p… |
CVE-2020-5529 | High | 8.1 | 2020-02-11 | HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute ar… |
CVE-2020-3935 | High | 7.5 | 2020-02-11 | TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges… |
CVE-2020-3934 | Critical | 9.8 | 2020-02-11 | TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attacker… |
CVE-2020-3933 | Medium | 5.3 | 2020-02-11 | TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system. |
CVE-2020-8841 | High | 8.8 | 2020-02-10 | An issue was discovered in TestLink 1.9.19. The relation_type parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injec… |
CVE-2020-8840 | Critical | 9.8 | 2020-02-10 | FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. |
CVE-2020-8089 | Medium | 5.4 | 2020-02-10 | Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page. |
CVE-2020-1697 | Medium | 6.1 | 2020-02-10 | It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and… |
CVE-2020-8825 | Medium | 5.4 | 2020-02-10 | index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS. |
CVE-2020-7060 | Medium | 6.5 | 2020-02-10 | When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possib… |
CVE-2020-7059 | Medium | 6.5 | 2020-02-10 | When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to s… |
CVE-2020-8823 | Medium | 6.1 | 2020-02-10 | htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter. |
CVE-2020-8822 | Medium | 4.8 | 2020-02-10 | Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application. |
CVE-2020-8812 | Medium | 5.4 | 2020-02-07 | Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug. |
CVE-2020-8811 | Medium | 4.3 | 2020-02-07 | ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures. |
CVE-2020-8808 | High | 7.8 | 2020-02-07 | The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-integrity level proc… |
CVE-2020-6770 | Critical | 10.0 | 2020-02-07 | Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system… |
CVE-2020-6768 | High | 8.6 | 2020-02-07 | A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files… |
CVE-2020-1708 | High | 7.0 | 2020-02-07 | It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3, that multiple containers modify the pe… |
CVE-2020-1700 | Medium | 6.5 | 2020-02-07 | A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disco… |
CVE-2020-8796 | Critical | 9.8 | 2020-02-07 | Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server. |
CVE-2020-6769 | Critical | 10.0 | 2020-02-07 | Missing Authentication for Critical Function in the Bosch Video Streaming Gateway (VSG) allows an unauthenticated remote attacker to retrieve and set arbitrary… |
CVE-2020-1768 | Medium | 5.4 | 2020-02-07 | The external frontend system uses numerous background calls to the backend. Each background request is treated as user activity so the SessionMaxIdleTime will… |
CVE-2020-8126 | High | 7.8 | 2020-02-07 | A privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resulting in local commands execution, allow… |
CVE-2020-8788 | Medium | 6.1 | 2020-02-07 | Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference doe… |
CVE-2020-8656 | Critical | 9.8 | 2020-02-07 | An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various ta… |
CVE-2020-8655 | High | 7.8 | 2020-02-07 | An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbit… |
CVE-2020-8654 | High | 8.8 | 2020-02-07 | An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS com… |
CVE-2020-8645 | Critical | 9.8 | 2020-02-07 | An issue was discovered in Simplejobscript.com SJS through 1.66. There is an unauthenticated SQL injection via the job applications search function. The vulner… |
CVE-2020-6760 | Critical | 9.8 | 2020-02-06 | Schmid ZI 620 V400 VPN 090 routers allow an attacker to execute OS commands as root via shell metacharacters to an entry on the SSH subcommand menu, as demonst… |
CVE-2020-8657 | Critical | 9.8 | 2020-02-06 | An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4… |
CVE-2020-5319 | High | 7.5 | 2020-02-06 | Dell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS Server SSH implementa… |
CVE-2020-5318 | High | 7.5 | 2020-02-06 | Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. An attacker may exploit this vulnerability… |
CVE-2020-5317 | Medium | 4.8 | 2020-02-06 | Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious… |
CVE-2020-8772 | Critical | 9.8 | 2020-02-06 | The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the user… |
CVE-2020-8771 | Critical | 9.8 | 2020-02-06 | The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as… |
CVE-2020-8636 | Critical | 9.8 | 2020-02-06 | An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution . |
CVE-2020-8608 | Medium | 5.6 | 2020-02-06 | In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. |
CVE-2020-7954 | High | 7.8 | 2020-02-06 | An issue was discovered in OpServices OpMon 9.3.2. Starting from the apache user account, it is possible to perform privilege escalation through the lack of co… |
CVE-2020-7953 | High | 7.5 | 2020-02-06 | An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files (e.g., /etc/passwd) due to the use of the nmap -… |
CVE-2020-7920 | High | 7.5 | 2020-02-06 | pmm-server in Percona Monitoring and Management (PMM) 2.2.x before 2.2.1 allows unauthenticated denial of service. |
CVE-2020-6856 | Medium | 6.5 | 2020-02-06 | An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the serv… |
CVE-2020-6855 | Medium | 6.5 | 2020-02-06 | A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize housekeeping jobs in a… |
CVE-2020-6767 | High | 7.7 | 2020-02-06 | A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files… |
CVE-2020-5720 | Medium | 5.9 | 2020-02-06 | MikroTik WinBox before 3.21 is vulnerable to a path traversal vulnerability that allows creation of arbitrary files wherevere WinBox has write permissions. Win… |
CVE-2020-5856 | High | 7.5 | 2020-02-06 | On BIG-IP 15.0.0-15.0.1.1 and 14.1.0-14.1.2.2, while processing specifically crafted traffic using the default 'xnet' driver, Virtual Edition instances hosted… |
CVE-2020-5855 | Medium | 4.3 | 2020-02-06 | When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have physical access to an… |
CVE-2020-5854 | Medium | 5.9 | 2020-02-06 | On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certain circumstances whe… |
CVE-2020-5528 | Medium | 6.1 | 2020-02-06 | Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5… |
CVE-2020-8658 | High | 8.8 | 2020-02-06 | The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name… |
CVE-2020-8649 | Medium | 5.9 | 2020-02-06 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c. |
CVE-2020-8648 | High | 7.1 | 2020-02-06 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c. |
CVE-2020-8647 | Medium | 6.1 | 2020-02-06 | There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c. |
CVE-2020-8644 | Critical | 9.8 | 2020-02-05 | PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. |
CVE-2020-8641 | High | 8.8 | 2020-02-05 | Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter. |
CVE-2020-6854 | Medium | 5.4 | 2020-02-05 | A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or… |
CVE-2020-3149 | Medium | 4.8 | 2020-02-05 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform… |
CVE-2020-3123 | High | 7.5 | 2020-02-05 | A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remot… |
CVE-2020-3120 | Medium | 6.5 | 2020-02-05 | A vulnerability in the Cisco Discovery Protocol implementation for Cisco FXOS Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthen… |
CVE-2020-3119 | High | 8.8 | 2020-02-05 | A vulnerability in the Cisco Discovery Protocol implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary… |
CVE-2020-3118 | High | 8.8 | 2020-02-05 | A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary… |
CVE-2020-3111 | High | 8.8 | 2020-02-05 | A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute cod… |
CVE-2020-3110 | High | 8.8 | 2020-02-05 | A vulnerability in the Cisco Discovery Protocol implementation for the Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent… |
CVE-2020-6833 | High | 7.5 | 2020-02-05 | An issue was discovered in GitLab EE 11.3 and later. A GitLab Workhorse bypass could lead to package and file disclosure via request smuggling. |
CVE-2020-6754 | Critical | 9.8 | 2020-02-05 | dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOM… |
CVE-2020-8507 | High | 7.5 | 2020-02-05 | The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics. |