2020 CVEs (page 19)
Page 19 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-28145 | High | 7.5 | 2021-10-12 | Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensiti… |
CVE-2020-27372 | Critical | 9.8 | 2021-10-11 | A buffer overflow vulnerability exists in Brandy Basic V Interpreter 1.21 in the run_interpreter function. |
CVE-2020-22617 | Critical | 9.8 | 2021-10-08 | Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext. |
CVE-2020-4654 | Medium | 6.5 | 2021-10-08 | IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information due to improper permission control. IBM X-F… |
CVE-2020-21729 | Medium | 5.4 | 2021-10-07 | JEECMS x1.1 contains a stored cross-site scripting (XSS) vulnerability in the component of /member-vipcenter.htm, which allows attackers to execute arbitrary w… |
CVE-2020-21726 | Critical | 9.8 | 2021-10-07 | OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the cid parameter. |
CVE-2020-21725 | Critical | 9.8 | 2021-10-07 | OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the pid parameter. |
CVE-2020-21865 | Critical | 9.8 | 2021-10-07 | ThinkPHP50-CMS v1.0 contains a remote code execution (RCE) vulnerability in the component /public/?s=captcha. |
CVE-2020-21658 | Medium | 6.5 | 2021-10-06 | A Cross-Site Request Forgery (CSRF) in WDJA CMS v1.5.2 allows attackers to arbitrarily add administrator accounts via a crafted URL. |
CVE-2020-21656 | Medium | 5.4 | 2021-10-06 | XYHCMS v3.6 contains a stored cross-site scripting (XSS) vulnerability in the component xyhai.php?s=/Link/index. |
CVE-2020-21654 | High | 7.2 | 2021-10-06 | emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file. |
CVE-2020-21653 | Critical | 9.1 | 2021-10-06 | Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \controller\index.php, which can be exploited via the sj() method. |
CVE-2020-21652 | Critical | 9.8 | 2021-10-06 | Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the addqq() method. |
CVE-2020-21651 | Critical | 9.8 | 2021-10-06 | Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\point.php, which can be exploited via the add() method. |
CVE-2020-21650 | High | 8.8 | 2021-10-06 | Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the add() method. |
CVE-2020-21649 | High | 8.1 | 2021-10-06 | Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \controller\index.php, which can be exploited via the sql() method. |
CVE-2020-21648 | Critical | 9.1 | 2021-10-06 | WDJA CMS v1.5.2 contains an arbitrary file deletion vulnerability in the component admin/cache/manage.php. |
CVE-2020-19003 | Medium | 5.3 | 2021-10-06 | An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on… |
CVE-2020-15941 | Medium | 5.4 | 2021-10-06 | A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to inject directory tra… |
CVE-2020-21506 | Medium | 6.1 | 2021-10-05 | waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?m=Config&a=add. |
CVE-2020-21505 | Medium | 6.1 | 2021-10-05 | waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php/Link/addsave. |
CVE-2020-21504 | Medium | 6.1 | 2021-10-05 | waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?&m=Public&a=login. |
CVE-2020-21503 | High | 7.5 | 2021-10-05 | waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the… |
CVE-2020-21496 | Medium | 6.1 | 2021-10-04 | A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HT… |
CVE-2020-21495 | Medium | 6.1 | 2021-10-04 | A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HT… |
CVE-2020-21494 | Medium | 6.1 | 2021-10-04 | A cross-site scripting (XSS) vulnerability in the component install\install.sql of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2020-21493 | Medium | 5.3 | 2021-10-04 | An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames. |
CVE-2020-21434 | Medium | 5.4 | 2021-10-04 | Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted pa… |
CVE-2020-21431 | Medium | 6.5 | 2021-10-04 | HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit. |
CVE-2020-21387 | Medium | 6.1 | 2021-10-04 | A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges vi… |
CVE-2020-21386 | High | 8.8 | 2021-10-04 | A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges. |
CVE-2020-28119 | Medium | 6.1 | 2021-10-04 | Cross site scripting vulnerability in 53KF < 2.0.0.2 that allows for arbitrary code to be executed via crafted HTML statement inserted into chat window. |
CVE-2020-21228 | Medium | 6.1 | 2021-10-01 | JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administra… |
CVE-2020-21014 | Medium | 6.5 | 2021-10-01 | emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php. |
CVE-2020-21013 | High | 7.2 | 2021-10-01 | emlog v6.0.0 contains a SQL injection via /admin/comment.php. |
CVE-2020-21012 | Critical | 9.8 | 2021-10-01 | Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL com… |
CVE-2020-20799 | Medium | 5.4 | 2021-09-30 | JeeCMS 1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload i… |
CVE-2020-20797 | Critical | 9.8 | 2021-09-30 | FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php. |
CVE-2020-20796 | Critical | 9.8 | 2021-09-30 | FlameCMS 3.3.5 contains a SQL injection vulnerability in /master/article.php via the "Id" parameter. |
CVE-2020-20746 | High | 7.2 | 2021-09-30 | A stack-based buffer overflow in the httpd server on Tenda AC9 V15.03.06.60_EN allows remote attackers to execute arbitrary code or cause a denial of service (… |
CVE-2020-20665 | High | 7.5 | 2021-09-30 | rudp v0.6 was discovered to contain a memory leak in the component main.c. |
CVE-2020-20664 | Medium | 6.5 | 2021-09-30 | libiec_iccp_mod v1.5 contains a segmentation violation in the component server_example1.c. |
CVE-2020-20663 | Medium | 6.5 | 2021-09-30 | libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_connection.c. |
CVE-2020-20662 | Medium | 6.5 | 2021-09-30 | libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_example1.c. |
CVE-2020-18685 | Critical | 9.8 | 2021-09-30 | Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP po… |
CVE-2020-18684 | Critical | 9.8 | 2021-09-30 | Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port number. |
CVE-2020-18683 | Critical | 9.8 | 2021-09-30 | Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined fields mishandling. |
CVE-2020-20781 | Medium | 5.4 | 2021-09-29 | A stored cross-site scripting (XSS) vulnerability in /ucms/index.php?do=list_edit of UCMS 1.4.7 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2020-20131 | Medium | 5.4 | 2021-09-29 | LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows atackers to execute arbitrary web scripts or HTML via a crafted payload… |
CVE-2020-20129 | Medium | 5.4 | 2021-09-29 | LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload… |
CVE-2020-20128 | High | 7.5 | 2021-09-29 | LaraCMS v1.0.1 transmits sensitive information in cleartext which can be intercepted by attackers. |
CVE-2020-12030 | Critical | 10.0 | 2021-09-29 | There is a flaw in the code used to configure the internal gateway firewall when the gateway's VLAN feature is enabled. If a user enables the VLAN setting, the… |
CVE-2020-20125 | Medium | 6.1 | 2021-09-28 | EARCLINK ESPCMS-P8 contains a cross-site scripting (XSS) vulnerability in espcms_web\espcms_load.php. |
CVE-2020-20124 | High | 8.8 | 2021-09-28 | Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php. |
CVE-2020-20122 | Critical | 9.8 | 2021-09-28 | Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php. |
CVE-2020-20120 | Critical | 9.8 | 2021-09-28 | ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods. |
CVE-2020-20696 | Medium | 5.4 | 2021-09-27 | A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-20695 | Medium | 5.4 | 2021-09-27 | A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file. |
CVE-2020-20693 | High | 8.8 | 2021-09-27 | A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts. |
CVE-2020-20692 | High | 7.2 | 2021-09-27 | GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $_GET parameter in /src/core/controllers/cm.php. |
CVE-2020-20691 | Medium | 6.5 | 2021-09-27 | An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML fil… |
CVE-2020-24930 | High | 8.1 | 2021-09-27 | Beijing Wuzhi Internet Technology Co., Ltd. Wuzhi CMS 4.0.1 is an open source content management system. The five fingers CMS backend in***.php file has arbitr… |
CVE-2020-20514 | High | 8.1 | 2021-09-24 | A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users. |
CVE-2020-20508 | Medium | 6.1 | 2021-09-24 | Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentia… |
CVE-2020-19951 | High | 8.8 | 2021-09-23 | A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application. |
CVE-2020-19950 | Medium | 4.8 | 2021-09-23 | A cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2020-19949 | Medium | 4.8 | 2021-09-23 | A cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2020-24327 | Medium | 5.3 | 2021-09-23 | Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload p… |
CVE-2020-4941 | Medium | 4.3 | 2021-09-23 | IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM… |
CVE-2020-4809 | Low | 3.3 | 2021-09-23 | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633. |
CVE-2020-4805 | Low | 3.3 | 2021-09-23 | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539. |
CVE-2020-4803 | Low | 3.3 | 2021-09-23 | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535. |
CVE-2020-4690 | Critical | 9.8 | 2021-09-23 | IBM Security Guardium 11.3 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2020-23481 | Medium | 5.4 | 2021-09-22 | CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2020-23478 | High | 7.5 | 2021-09-22 | Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py. |
CVE-2020-23469 | High | 7.5 | 2021-09-22 | gmate v0.12+bionic contains a regular expression denial of service (ReDoS) vulnerability in the gedit3 plugin. |
CVE-2020-23273 | Medium | 5.5 | 2021-09-22 | Heap-buffer overflow in the randomize_iparp function in edit_packet.c. of Tcpreplay v4.3.2 allows attackers to cause a denial of service (DOS) via a crafted pc… |
CVE-2020-23269 | Medium | 5.5 | 2021-09-22 | An issue was discovered in gpac 0.8.0. The stbl_GetSampleSize function in isomedia/stbl_read.c has a heap-based buffer overflow which can lead to a denial of s… |
CVE-2020-23267 | High | 7.1 | 2021-09-22 | An issue was discovered in gpac 0.8.0. The gf_hinter_track_process function in isom_hinter_track_process.c has a heap-based buffer overflow which can lead to a… |
CVE-2020-23266 | Medium | 5.5 | 2021-09-22 | An issue was discovered in gpac 0.8.0. The OD_ReadUTF8String function in odf_code.c has a heap-based buffer overflow which can lead to a denial of service (DOS… |
CVE-2020-19554 | Medium | 6.1 | 2021-09-21 | Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload. |
CVE-2020-19553 | Medium | 5.4 | 2021-09-21 | Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/libs/class/ckditor.cla… |
CVE-2020-19551 | High | 8.8 | 2021-09-21 | Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong. |
CVE-2020-26301 | High | 7.5 | 2021-09-20 | ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue on… |
CVE-2020-16630 | Medium | 6.8 | 2021-09-20 | TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an… |
CVE-2020-19915 | Medium | 6.1 | 2021-09-20 | Cross Site Scripting (XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php. |
CVE-2020-8561 | Medium | 4.1 | 2021-09-20 | A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration request… |
CVE-2020-21468 | High | 7.5 | 2021-09-20 | A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS). NOTE: the vendor cannot reproduce this issue in a release… |
CVE-2020-20902 | Medium | 6.5 | 2021-09-20 | A CWE-125: Out-of-bounds read vulnerability exists in long_term_filter function in g729postfilter.c in FFmpeg 4.2.1 during computation of the denominator of ps… |
CVE-2020-20898 | High | 8.8 | 2021-09-20 | Integer Overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or o… |
CVE-2020-20896 | High | 8.8 | 2021-09-20 | An issue was discovered in function latm_write_packet in libavformat/latmenc.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecif… |
CVE-2020-20892 | High | 8.8 | 2021-09-20 | An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other uns… |
CVE-2020-20891 | High | 8.8 | 2021-09-20 | Buffer Overflow vulnerability in function config_input in libavfilter/vf_gblur.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspec… |
CVE-2020-21913 | Medium | 5.5 | 2021-09-20 | International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file to… |
CVE-2020-21548 | High | 8.8 | 2021-09-17 | Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel_encode_highcolor function in tosixel.c. |
CVE-2020-21547 | High | 8.8 | 2021-09-17 | Libsixel 1.8.2 contains a heap-based buffer overflow in the dither_func_fs function in tosixel.c. |
CVE-2020-12083 | Critical | 9.9 | 2021-09-17 | An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64). |
CVE-2020-12082 | Medium | 5.4 | 2021-09-17 | A stored cross-site scripting issue impacts certain areas of the Web UI for Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64). |
CVE-2020-12080 | High | 7.5 | 2021-09-17 | A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain message protocol can be exploited to cause… |
CVE-2020-21606 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow fault in the put_epel_16_fallback function, which can be exploited via a crafted a file. |