2020 CVEs (page 193)
Page 193 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2092 | High | 8.8 | 2020-01-15 | Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Config… |
CVE-2020-2091 | High | 8.1 | 2020-01-15 | A missing permission check in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2020-2090 | High | 8.8 | 2020-01-15 | A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.47 and earlier allows attackers to connect to an attacker-specified URL within the AW… |
CVE-2020-1611 | Medium | 6.5 | 2020-01-15 | A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP… |
CVE-2020-1609 | High | 8.8 | 2020-01-15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay… |
CVE-2020-1608 | High | 7.5 | 2020-01-15 | Receipt of a specific MPLS or IPv6 packet on the core facing interface of an MX Series device configured for Broadband Edge (BBE) service may trigger a kernel… |
CVE-2020-1607 | High | 7.5 | 2020-01-15 | Insufficient Cross-Site Scripting (XSS) protection in J-Web may potentially allow a remote attacker to inject web script or HTML, hijack the target user's J-We… |
CVE-2020-1606 | Medium | 5.4 | 2020-01-15 | A path traversal vulnerability in the Juniper Networks Junos OS device may allow an authenticated J-web user to read files with 'world' readable permission and… |
CVE-2020-1605 | High | 8.8 | 2020-01-15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay… |
CVE-2020-1604 | Medium | 6.5 | 2020-01-15 | On EX4300, EX4600, QFX3500, and QFX5100 Series, a vulnerability in the IP firewall filter component may cause the firewall filter evaluation of certain packets… |
CVE-2020-1603 | High | 8.6 | 2020-01-15 | Specific IPv6 packets sent by clients processed by the Routing Engine (RE) are improperly handled. These IPv6 packets are designed to be blocked by the RE from… |
CVE-2020-1602 | High | 7.1 | 2020-01-15 | When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay… |
CVE-2020-1601 | Medium | 5.3 | 2020-01-15 | Certain types of malformed Path Computation Element Protocol (PCEP) packets when received and processed by a Juniper Networks Junos OS device serving as a Path… |
CVE-2020-1600 | Medium | 6.5 | 2020-01-15 | In a Point-to-Multipoint (P2MP) Label Switched Path (LSP) scenario, an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon (RPD) in… |
CVE-2020-7058 | High | 8.8 | 2020-01-15 | data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input Methods -> Unix -> Ping Host. NOTE: the… |
CVE-2020-5502 | Medium | 6.5 | 2020-01-15 | phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. |
CVE-2020-5501 | Medium | 4.3 | 2020-01-15 | phpBB 3.2.8 allows a CSRF attack that can modify a group avatar. |
CVE-2020-0656 | Medium | 5.4 | 2020-01-14 | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected… |
CVE-2020-0654 | Critical | 9.1 | 2020-01-14 | A security feature bypass vulnerability exists in Microsoft OneDrive App for Android.This could allow an attacker to bypass the passcode or fingerprint require… |
CVE-2020-0653 | High | 7.8 | 2020-01-14 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
CVE-2020-0652 | High | 7.8 | 2020-01-14 | A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office M… |
CVE-2020-0651 | High | 7.8 | 2020-01-14 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
CVE-2020-0650 | High | 7.8 | 2020-01-14 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
CVE-2020-0647 | Medium | 5.4 | 2020-01-14 | A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Spoofing Vul… |
CVE-2020-0646 | Critical | 9.8 | 2020-01-14 | A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Inje… |
CVE-2020-0644 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists when Microsoft Windows implements predictable memory section names, aka 'Windows Elevation of Privilege Vulnerab… |
CVE-2020-0643 | Medium | 5.5 | 2020-01-14 | An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface Plus (GDI+) handles objects in memory, allowing an attacke… |
CVE-2020-0642 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil… |
CVE-2020-0641 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in Windows Media Service that allows file creation in arbitrary locations.To exploit the vulnerability, an attac… |
CVE-2020-0640 | High | 7.5 | 2020-01-14 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerabili… |
CVE-2020-0639 | Medium | 5.5 | 2020-01-14 | An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects in memory, aka 'Win… |
CVE-2020-0638 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first… |
CVE-2020-0637 | Medium | 6.5 | 2020-01-14 | An information disclosure vulnerability exists when Remote Desktop Web Access improperly handles credential information, aka 'Remote Desktop Web Access Informa… |
CVE-2020-0636 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles files, aka 'Windows Subsystem for Linux Elevation of Pri… |
CVE-2020-0635 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'Windows Elevation of Pri… |
CVE-2020-0634 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common… |
CVE-2020-0633 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0632 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0631 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0630 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0629 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0628 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0627 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0626 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0625 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0624 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil… |
CVE-2020-0623 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0622 | Medium | 5.5 | 2020-01-14 | An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory, aka 'Microsoft Graphics Comp… |
CVE-2020-0621 | Medium | 4.4 | 2020-01-14 | A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password update, aka 'Windows Security Feature Bypass… |
CVE-2020-0620 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists when Microsoft Cryptographic Services improperly handles files, aka 'Microsoft Cryptographic Services Elevation… |
CVE-2020-0617 | Medium | 6.0 | 2020-01-14 | A denial of service vulnerability exists when Microsoft Hyper-V Virtual PCI on a host server fails to properly validate input from a privileged user on a guest… |
CVE-2020-0616 | Medium | 5.5 | 2020-01-14 | A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability'. |
CVE-2020-0615 | Medium | 5.5 | 2020-01-14 | An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects in memory, aka 'Win… |
CVE-2020-0614 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0613 | High | 7.8 | 2020-01-14 | An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of P… |
CVE-2020-0612 | High | 7.5 | 2020-01-14 | A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to the target system using RDP and sends spec… |
CVE-2020-0611 | High | 7.5 | 2020-01-14 | A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote… |
CVE-2020-0610 | Critical | 9.8 | 2020-01-14 | A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system usin… |
CVE-2020-0609 | Critical | 9.8 | 2020-01-14 | A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system usin… |
CVE-2020-0608 | Medium | 5.5 | 2020-01-14 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili… |
CVE-2020-0607 | Medium | 5.5 | 2020-01-14 | An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Infor… |
CVE-2020-0606 | High | 8.8 | 2020-01-14 | A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploit… |
CVE-2020-0605 | High | 8.8 | 2020-01-14 | A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploit… |
CVE-2020-0603 | High | 8.8 | 2020-01-14 | A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploite… |
CVE-2020-0602 | High | 7.5 | 2020-01-14 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. |
CVE-2020-0601 | High | 8.1 | 2020-01-14 | A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit t… |
CVE-2020-7057 | Medium | 5.3 | 2020-01-14 | Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depe… |
CVE-2020-7054 | High | 8.8 | 2020-01-14 | MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer overflow when parsing the MMS_BIT_STRING… |
CVE-2020-7053 | High | 7.8 | 2020-01-14 | In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free (write) in the i915_ppgtt_… |
CVE-2020-6173 | Medium | 5.3 | 2020-01-14 | TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption. |
CVE-2020-5509 | High | 7.2 | 2020-01-14 | PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image. |
CVE-2020-5505 | Critical | 9.8 | 2020-01-14 | Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"application/x-php"} to th… |
CVE-2020-5180 | High | 7.8 | 2020-01-14 | Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the… |
CVE-2020-6307 | Medium | 4.3 | 2020-01-14 | Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization… |
CVE-2020-6306 | Low | 2.7 | 2020-01-14 | Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17). |
CVE-2020-6305 | Medium | 6.1 | 2020-01-14 | PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in Cro… |
CVE-2020-6304 | High | 7.5 | 2020-01-14 | Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRN… |
CVE-2020-6303 | Medium | 5.4 | 2020-01-14 | SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting. |
CVE-2020-5193 | Medium | 6.1 | 2020-01-14 | PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdata or Doctorspecialization parameter. |
CVE-2020-5853 | Medium | 5.4 | 2020-01-14 | In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pa… |
CVE-2020-5852 | High | 7.5 | 2020-01-14 | Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM). This vulnerability affects TMM through a v… |
CVE-2020-5851 | Medium | 4.6 | 2020-01-14 | On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components. This iss… |
CVE-2020-5196 | High | 8.1 | 2020-01-14 | Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden files, list direct… |
CVE-2020-5194 | Medium | 5.4 | 2020-01-14 | The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an unrestricted API endp… |
CVE-2020-6958 | Critical | 9.1 | 2020-01-14 | An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other products, allows attackers to exfiltrate… |
CVE-2020-6955 | Medium | 6.1 | 2020-01-13 | An issue was discovered on Cayin SMP-PRO4 devices. They allow image_preview.html?filename= reflected XSS. |
CVE-2020-6954 | Medium | 6.5 | 2020-01-13 | An issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by viewing the URL after a Connection String Test. This password is sho… |
CVE-2020-6832 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. Using the project import feature, it was possible for someone to obtain issues… |
CVE-2020-5197 | Medium | 4.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. It has Incorrect Access Control. |
CVE-2020-6949 | High | 8.8 | 2020-01-13 | A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin us… |
CVE-2020-6948 | Critical | 9.8 | 2020-01-13 | A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mish… |
CVE-2020-5390 | High | 7.5 | 2020-01-13 | PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Si… |
CVE-2020-5195 | Medium | 6.1 | 2020-01-13 | Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HT… |
CVE-2020-6859 | Medium | 5.3 | 2020-01-13 | Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remo… |
CVE-2020-6860 | High | 8.8 | 2020-01-13 | libmysofa 0.9.1 has a stack-based buffer overflow in readDataVar in hdf/dataobject.c during the reading of a header message attribute. |
CVE-2020-6851 | High | 7.5 | 2020-01-13 | OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions vali… |
CVE-2020-6848 | Medium | 6.1 | 2020-01-13 | Axper Vision II 4 devices allow XSS via the DEVICE_NAME (aka Device Name) parameter to the configWebParams.cgi URI. |
CVE-2020-6847 | Medium | 5.4 | 2020-01-11 | OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript. |
CVE-2020-6840 | Critical | 9.8 | 2020-01-11 | In mruby 2.1.0, there is a use-after-free in hash_slice in mrbgems/mruby-hash-ext/src/hash-ext.c. |
CVE-2020-6839 | Critical | 9.8 | 2020-01-11 | In mruby 2.1.0, there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c. |