2020 CVEs (page 188)
Page 188 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-8506 | Medium | 5.3 | 2020-02-05 | The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics. |
CVE-2020-7978 | High | 7.5 | 2020-02-05 | GitLab EE 12.6 and later through 12.7.2 allows Denial of Service. |
CVE-2020-7977 | Medium | 5.3 | 2020-02-05 | GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions. |
CVE-2020-7976 | Medium | 5.3 | 2020-02-05 | GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control. |
CVE-2020-7974 | Medium | 5.3 | 2020-02-05 | GitLab EE 10.1 through 12.7.2 allows Information Disclosure. |
CVE-2020-7973 | Medium | 6.1 | 2020-02-05 | GitLab through 12.7.2 allows XSS. |
CVE-2020-7972 | High | 7.5 | 2020-02-05 | GitLab EE 12.2 has Insecure Permissions (issue 2 of 2). |
CVE-2020-7971 | Medium | 6.1 | 2020-02-05 | GitLab EE 11.0 and later through 12.7.2 allows XSS. |
CVE-2020-7969 | High | 7.5 | 2020-02-05 | GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure. |
CVE-2020-7968 | High | 7.5 | 2020-02-05 | GitLab EE 8.0 through 12.7.2 has Incorrect Access Control. |
CVE-2020-7967 | Medium | 4.3 | 2020-02-05 | GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2). |
CVE-2020-7966 | High | 7.5 | 2020-02-05 | GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal. |
CVE-2020-6969 | Critical | 9.8 | 2020-02-05 | It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More… |
CVE-2020-6174 | Critical | 9.8 | 2020-02-05 | TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature. |
CVE-2020-8114 | Critical | 9.8 | 2020-02-05 | GitLab EE 8.9 and later through 12.7.2 has Insecure Permission |
CVE-2020-7979 | Medium | 5.3 | 2020-02-05 | GitLab EE 8.9 and later through 12.7.2 has Insecure Permission |
CVE-2020-7216 | High | 7.5 | 2020-02-05 | An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets wit… |
CVE-2020-8632 | Medium | 5.5 | 2020-02-05 | In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to… |
CVE-2020-8631 | Medium | 5.5 | 2020-02-05 | cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudin… |
CVE-2020-5237 | High | 8.8 | 2020-02-05 | Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files o… |
CVE-2020-5208 | High | 7.7 | 2020-02-05 | It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffe… |
CVE-2020-8615 | Medium | 6.5 | 2020-02-04 | A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other ma… |
CVE-2020-8517 | High | 7.5 | 2020-02-04 | An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to me… |
CVE-2020-8450 | High | 7.3 | 2020-02-04 | An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a r… |
CVE-2020-8449 | High | 7.5 | 2020-02-04 | An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server res… |
CVE-2020-8125 | Critical | 9.8 | 2020-02-04 | Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial… |
CVE-2020-8124 | Medium | 5.3 | 2020-02-04 | Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks. |
CVE-2020-8123 | Medium | 4.9 | 2020-02-04 | A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of t… |
CVE-2020-8122 | Medium | 4.3 | 2020-02-04 | A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received. |
CVE-2020-8121 | High | 8.1 | 2020-02-04 | A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer. |
CVE-2020-8120 | Medium | 6.1 | 2020-02-04 | A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation. |
CVE-2020-8119 | Medium | 4.3 | 2020-02-04 | Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app. |
CVE-2020-8118 | Medium | 5.0 | 2020-02-04 | An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calen… |
CVE-2020-8117 | Medium | 4.3 | 2020-02-04 | Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event. |
CVE-2020-8116 | High | 7.3 | 2020-02-04 | Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to… |
CVE-2020-8115 | Medium | 6.1 | 2020-02-04 | A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are c… |
CVE-2020-6060 | High | 7.5 | 2020-02-04 | A stack buffer overflow vulnerability exists in the way MiniSNMPD version 1.4 handles multiple connections. A specially timed sequence of SNMP connections can… |
CVE-2020-6059 | High | 8.2 | 2020-02-04 | An exploitable out of bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets. A specially crafted SNMP request can trig… |
CVE-2020-6058 | Critical | 9.1 | 2020-02-04 | An exploitable out-of-bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets. A specially crafted SNMP request can trig… |
CVE-2020-7221 | High | 7.8 | 2020-02-04 | mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod are performed unsafe… |
CVE-2020-4163 | High | 7.2 | 2020-02-04 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a maliciously crafted file n… |
CVE-2020-3939 | Medium | 6.1 | 2020-02-04 | SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal information may be leaked to attackers via the… |
CVE-2020-3938 | Critical | 9.8 | 2020-02-04 | SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture… |
CVE-2020-3937 | High | 8.1 | 2020-02-04 | SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary file in the databa… |
CVE-2020-5236 | Medium | 5.7 | 2020-02-04 | Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x1… |
CVE-2020-5235 | Medium | 6.5 | 2020-02-04 | There is a potentially exploitable out of memory condition In Nanopb before 0.4.1, 0.3.9.5, and 0.2.9.4. When nanopb is compiled with PB_ENABLE_MALLOC, the mes… |
CVE-2020-8597 | Critical | 9.8 | 2020-02-03 | eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions. |
CVE-2020-8592 | Critical | 9.8 | 2020-02-03 | eG Manager 7.1.2 allows SQL Injection via the user parameter to com.eg.LoginHelperServlet (aka the Forgot Password feature). |
CVE-2020-8591 | Critical | 9.8 | 2020-02-03 | eG Manager 7.1.2 allows authentication bypass via a com.egurkha.EgLoginServlet?uname=admin&upass=&accessKey=eGm0n1t0r request. |
CVE-2020-8549 | Medium | 6.1 | 2020-02-03 | Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens. |
CVE-2020-8548 | Medium | 6.1 | 2020-02-03 | massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true). |
CVE-2020-5182 | Medium | 6.5 | 2020-02-03 | The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business website can be entered b… |
CVE-2020-4224 | Medium | 5.5 | 2020-02-03 | IBM StoredIQ 7.6.0.17 through 7.6.0.20 could disclose sensitive information to a local user due to data in certain directories not being encrypted when it cont… |
CVE-2020-8547 | Critical | 9.8 | 2020-02-03 | phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e fol… |
CVE-2020-8545 | High | 7.5 | 2020-02-03 | Global.py in AIL framework 2.8 allows path traversal. |
CVE-2020-8510 | Critical | 9.8 | 2020-02-03 | An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en (user+perms+lang), one can… |
CVE-2020-7993 | Medium | 4.3 | 2020-02-03 | Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field. |
CVE-2020-7471 | Critical | 9.8 | 2020-02-03 | Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django ap… |
CVE-2020-3927 | High | 8.3 | 2020-02-03 | An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary… |
CVE-2020-3926 | Medium | 6.1 | 2020-02-03 | An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary… |
CVE-2020-3925 | High | 8.3 | 2020-02-03 | A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers… |
CVE-2020-8508 | Critical | 9.8 | 2020-02-03 | nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers between user and kernel m… |
CVE-2020-8514 | Medium | 6.1 | 2020-02-02 | An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the web application af… |
CVE-2020-8516 | Medium | 5.3 | 2020-02-02 | The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might m… |
CVE-2020-8515 | Critical | 9.8 | 2020-02-01 | DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without… |
CVE-2020-8512 | Medium | 6.1 | 2020-02-01 | In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter. |
CVE-2020-8505 | Medium | 6.5 | 2020-01-31 | School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user. |
CVE-2020-8504 | Medium | 6.5 | 2020-01-31 | School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user. |
CVE-2020-8503 | Medium | 6.5 | 2020-01-31 | Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR) by an authenticated se… |
CVE-2020-5234 | Medium | 4.8 | 2020-01-31 | MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack… |
CVE-2020-8422 | Medium | 4.3 | 2020-01-31 | An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can… |
CVE-2020-8440 | Critical | 9.8 | 2020-01-31 | controllers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by uploading a PHP script as a resume. |
CVE-2020-7956 | Critical | 9.8 | 2020-01-31 | HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to… |
CVE-2020-7955 | Medium | 5.3 | 2020-01-31 | HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended informati… |
CVE-2020-7914 | High | 7.5 | 2020-01-31 | In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issue was fixed in 201… |
CVE-2020-7219 | High | 7.5 | 2020-01-31 | HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of servic… |
CVE-2020-7218 | High | 7.5 | 2020-01-31 | HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service… |
CVE-2020-5526 | Medium | 5.9 | 2020-01-31 | The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows man-in-the-middle attac… |
CVE-2020-5232 | High | 8.7 | 2020-01-31 | A user who owns an ENS domain can set a trapdoor, allowing them to transfer ownership to another user, and later regain ownership without the new owners consen… |
CVE-2020-8498 | Medium | 5.4 | 2020-01-30 | XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an… |
CVE-2020-8496 | Medium | 4.8 | 2020-01-30 | In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input… |
CVE-2020-8495 | High | 7.5 | 2020-01-30 | In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeepe… |
CVE-2020-8494 | High | 8.8 | 2020-01-30 | In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeepe… |
CVE-2020-8493 | Medium | 4.8 | 2020-01-30 | A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message… |
CVE-2020-5231 | Medium | 4.8 | 2020-01-30 | In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. RO… |
CVE-2020-5206 | High | 8.7 | 2020-01-30 | In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if… |
CVE-2020-8095 | Medium | 4.9 | 2020-01-30 | A vulnerability in the improper handling of junctions before deletion in Bitdefender Total Security 2020 can allow an attacker to to trigger a denial of servic… |
CVE-2020-5230 | High | 7.7 | 2020-01-30 | Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security… |
CVE-2020-5222 | Medium | 6.8 | 2020-01-30 | Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an… |
CVE-2020-5229 | High | 7.7 | 2020-01-30 | Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the… |
CVE-2020-5228 | High | 7.6 | 2020-01-30 | Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is… |
CVE-2020-8492 | Medium | 6.5 | 2020-01-30 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression… |
CVE-2020-8093 | Medium | 5.3 | 2020-01-30 | A vulnerability in the AntivirusforMac binary as used in Bitdefender Antivirus for Mac allows an attacker to inject a library using DYLD environment variable t… |
CVE-2020-5233 | Medium | 5.9 | 2020-01-30 | OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version… |
CVE-2020-3147 | High | 7.5 | 2020-01-30 | A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on… |
CVE-2020-8092 | Low | 1.6 | 2020-01-30 | A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests… |
CVE-2020-7913 | Medium | 6.1 | 2020-01-30 | JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description. |
CVE-2020-7912 | Medium | 5.3 | 2020-01-30 | In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups. |
CVE-2020-7911 | Medium | 6.1 | 2020-01-30 | In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS. |
CVE-2020-7910 | Medium | 5.4 | 2020-01-30 | JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role. |