2020 CVEs (page 189)
Page 189 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7909 | High | 7.5 | 2020-01-30 | In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI. |
CVE-2020-7908 | Medium | 4.3 | 2020-01-30 | In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages. |
CVE-2020-7906 | High | 7.5 | 2020-01-30 | In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release ve… |
CVE-2020-7905 | High | 7.5 | 2020-01-30 | Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network. |
CVE-2020-7904 | High | 7.4 | 2020-01-30 | In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS. |
CVE-2020-1931 | High | 8.1 | 2020-01-30 | A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run syste… |
CVE-2020-1930 | High | 8.1 | 2020-01-30 | A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run… |
CVE-2020-8448 | Medium | 5.5 | 2020-01-30 | In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a denial of service (NULL pointer derefer… |
CVE-2020-8447 | Critical | 9.8 | 2020-01-30 | In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free during processing of sys… |
CVE-2020-8446 | Medium | 5.5 | 2020-01-30 | In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to path traversal (with write access) via cr… |
CVE-2020-8445 | Critical | 9.8 | 2020-01-30 | In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed lo… |
CVE-2020-8444 | Critical | 9.8 | 2020-01-30 | In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free during processing of oss… |
CVE-2020-8443 | Critical | 9.8 | 2020-01-30 | In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-based buffer overflow… |
CVE-2020-8442 | High | 8.8 | 2020-01-30 | In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a heap-based buffer overflow in the rootc… |
CVE-2020-8438 | High | 7.2 | 2020-01-29 | Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as dem… |
CVE-2020-8432 | Critical | 9.8 | 2020-01-29 | In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where co… |
CVE-2020-3758 | Medium | 6.1 | 2020-01-29 | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Success… |
CVE-2020-3719 | High | 7.5 | 2020-01-29 | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitat… |
CVE-2020-3718 | Critical | 9.8 | 2020-01-29 | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. Successful exploita… |
CVE-2020-3717 | Medium | 5.3 | 2020-01-29 | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitat… |
CVE-2020-3716 | Critical | 9.8 | 2020-01-29 | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. S… |
CVE-2020-3715 | Medium | 6.1 | 2020-01-29 | Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Success… |
CVE-2020-3714 | High | 7.8 | 2020-01-29 | Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-3713 | High | 7.8 | 2020-01-29 | Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-3712 | High | 7.8 | 2020-01-29 | Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-3711 | High | 7.8 | 2020-01-29 | Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-3710 | High | 7.8 | 2020-01-29 | Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2020-8416 | High | 7.5 | 2020-01-29 | IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port. |
CVE-2020-7247 | Critical | 9.8 | 2020-01-29 | smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via… |
CVE-2020-2108 | High | 7.6 | 2020-01-29 | Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configur… |
CVE-2020-2107 | Medium | 4.3 | 2020-01-29 | Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by… |
CVE-2020-2106 | Medium | 5.4 | 2020-01-29 | Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerabilit… |
CVE-2020-2105 | Medium | 5.4 | 2020-01-29 | REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks. |
CVE-2020-2104 | Medium | 4.3 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart. |
CVE-2020-2103 | Medium | 5.4 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page. |
CVE-2020-2102 | Medium | 5.3 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC. |
CVE-2020-2101 | Medium | 5.3 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially a… |
CVE-2020-2100 | Medium | 5.8 | 2020-01-29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848. |
CVE-2020-2099 | High | 8.6 | 2020-01-29 | Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attac… |
CVE-2020-7965 | High | 8.8 | 2020-01-29 | flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is va… |
CVE-2020-8428 | High | 7.1 | 2020-01-29 | fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause a denial of service (OOPS) or possibly o… |
CVE-2020-8426 | Medium | 5.4 | 2020-01-28 | The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeti… |
CVE-2020-8425 | Medium | 6.5 | 2020-01-28 | Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php. |
CVE-2020-8424 | High | 8.8 | 2020-01-28 | Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php. |
CVE-2020-5227 | Medium | 4.4 | 2020-01-28 | Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the av… |
CVE-2020-5215 | Medium | 5.0 | 2020-01-28 | In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format chec… |
CVE-2020-8421 | Medium | 6.1 | 2020-01-28 | An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs. |
CVE-2020-8420 | High | 8.8 | 2020-01-28 | An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability. |
CVE-2020-8419 | High | 8.8 | 2020-01-28 | An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities. |
CVE-2020-8417 | High | 8.8 | 2020-01-28 | The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu. |
CVE-2020-8315 | Medium | 5.5 | 2020-01-28 | In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacke… |
CVE-2020-5211 | Medium | 5.0 | 2020-01-28 | In NetHack before 3.6.5, an invalid extended command in value for the AUTOCOMPLETE configuration file option can cause a buffer overflow resulting in a crash o… |
CVE-2020-4207 | Critical | 9.8 | 2020-01-28 | IBM Watson IoT Message Gateway 2.0.0.x, 5.0.0.0, 5.0.0.1, and 5.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking when handling a fa… |
CVE-2020-8112 | High | 8.8 | 2020-01-28 | opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue tha… |
CVE-2020-5214 | Medium | 5.0 | 2020-01-28 | In NetHack before 3.6.5, detecting an unknown configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege esc… |
CVE-2020-5213 | Medium | 5.0 | 2020-01-28 | In NetHack before 3.6.5, too long of a value for the SYMBOL configuration file option can cause a buffer overflow resulting in a crash or remote code execution… |
CVE-2020-5212 | Medium | 5.0 | 2020-01-28 | In NetHack before 3.6.5, an extremely long value for the MENUCOLOR configuration file option can cause a buffer overflow resulting in a crash or remote code ex… |
CVE-2020-5210 | Medium | 5.0 | 2020-01-28 | In NetHack before 3.6.5, an invalid argument to the -w command line option can cause a buffer overflow resulting in a crash or remote code execution/privilege… |
CVE-2020-5209 | Medium | 5.0 | 2020-01-28 | In NetHack before 3.6.5, unknown options starting with -de and -i can cause a buffer overflow resulting in a crash or remote code execution/privilege escalatio… |
CVE-2020-8086 | Critical | 9.8 | 2020-01-28 | The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. T… |
CVE-2020-1940 | High | 7.5 | 2020-01-28 | The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information dis… |
CVE-2020-7934 | Medium | 5.4 | 2020-01-28 | In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a p… |
CVE-2020-7799 | High | 7.2 | 2020-01-28 | An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (H… |
CVE-2020-5523 | High | 7.4 | 2020-01-28 | Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not proper… |
CVE-2020-7998 | High | 8.8 | 2020-01-28 | An arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1 for iOS. The vulnerability is located in the developer path tha… |
CVE-2020-7997 | Medium | 6.1 | 2020-01-28 | ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature. |
CVE-2020-1933 | Medium | 6.1 | 2020-01-28 | A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in… |
CVE-2020-1932 | Medium | 6.5 | 2020-01-28 | An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other… |
CVE-2020-1928 | Medium | 5.3 | 2020-01-28 | An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This wo… |
CVE-2020-0549 | Medium | 5.5 | 2020-01-28 | Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local… |
CVE-2020-0548 | Medium | 5.5 | 2020-01-28 | Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2020-8091 | Medium | 6.1 | 2020-01-27 | svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a ta… |
CVE-2020-8090 | Medium | 4.8 | 2020-01-27 | The Username field in the Storage Service settings of A1 WLAN Box ADB VV2220v2 devices allows stored XSS (after a successful Administrator login). |
CVE-2020-5220 | Medium | 4.4 | 2020-01-27 | Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended seriali… |
CVE-2020-5218 | Medium | 4.4 | 2020-01-27 | Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be… |
CVE-2020-8088 | Critical | 9.8 | 2020-01-27 | panel_login.php in UseBB 1.0.12 allows type juggling for login bypass because != is used instead of !== for password hashes, which mishandles hashes that begin… |
CVE-2020-8087 | Critical | 9.8 | 2020-01-27 | SMC Networks D3G0804W D3GNV5M-3.5.1.6.10_GA devices allow remote command execution by leveraging access to the Network Diagnostic Tools screen, as demonstrated… |
CVE-2020-5207 | Medium | 5.4 | 2020-01-27 | In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't ha… |
CVE-2020-7952 | High | 7.8 | 2020-01-27 | rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and invitin… |
CVE-2020-7951 | High | 7.8 | 2020-01-27 | meshsystem.dll in Valve Dota 2 before 7.23e allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a v… |
CVE-2020-7950 | High | 7.8 | 2020-01-27 | meshsystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a v… |
CVE-2020-7949 | High | 7.8 | 2020-01-27 | schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a… |
CVE-2020-7238 | High | 7.5 | 2020-01-27 | Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a lat… |
CVE-2020-8009 | High | 7.5 | 2020-01-27 | AVB MOTU devices through 2020-01-22 allow /.. Directory Traversal, as demonstrated by reading the /etc/passwd file. |
CVE-2020-5522 | High | 7.4 | 2020-01-27 | The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof server… |
CVE-2020-5521 | High | 7.4 | 2020-01-27 | The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers an… |
CVE-2020-5520 | High | 7.4 | 2020-01-27 | The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtai… |
CVE-2020-8003 | Medium | 5.5 | 2020-01-27 | A double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service by triggering texture allocation f… |
CVE-2020-8002 | Medium | 5.5 | 2020-01-27 | A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service via commands that attempt to launch… |
CVE-2020-8001 | Critical | 9.8 | 2020-01-27 | The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account. |
CVE-2020-8000 | Critical | 9.8 | 2020-01-27 | Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account. |
CVE-2020-7999 | Critical | 9.8 | 2020-01-27 | The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD_API_KEY and FILE_DOWNLOAD_API_KEY. |
CVE-2020-7996 | Medium | 6.1 | 2020-01-26 | htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header. |
CVE-2020-7995 | Critical | 9.8 | 2020-01-26 | The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts. |
CVE-2020-7994 | Medium | 6.1 | 2020-01-26 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle]… |
CVE-2020-7991 | High | 8.8 | 2020-01-26 | Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password. |
CVE-2020-7990 | Medium | 6.1 | 2020-01-26 | Adive Framework 2.0.8 has admin/user/add userName XSS. |
CVE-2020-7989 | Medium | 6.1 | 2020-01-26 | Adive Framework 2.0.8 has admin/user/add userUsername XSS. |
CVE-2020-7984 | High | 7.5 | 2020-01-26 | SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe… |
CVE-2020-3142 | High | 7.5 | 2020-01-26 | A vulnerability in Cisco Webex Meetings Suite sites and Cisco Webex Meetings Online sites could allow an unauthenticated, remote attendee to join a password-pr… |