2020 CVEs (page 20)
Page 20 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-21605 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a segmentation fault in the apply_sao_internal function, which can be exploited via a crafted a file. |
CVE-2020-21604 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow fault in the _mm_loadl_epi64 function, which can be exploited via a crafted a file. |
CVE-2020-21603 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be exploited via a crafted a file. |
CVE-2020-21602 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can be exploited via a crafted a file. |
CVE-2020-21601 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a stack buffer overflow in the put_qpel_fallback function, which can be exploited via a crafted a file. |
CVE-2020-21600 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_pred_avg_16_fallback function, which can be exploited via a crafted a file. |
CVE-2020-21599 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be exploited via a crafted a file. |
CVE-2020-21598 | High | 8.8 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploited via a crafted a file. |
CVE-2020-21597 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a crafted a file. |
CVE-2020-21596 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited via a crafted a file. |
CVE-2020-21595 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow in the mc_luma function, which can be exploited via a crafted a file. |
CVE-2020-21594 | Medium | 6.5 | 2021-09-16 | libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be exploited via a crafted a file. |
CVE-2020-21535 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a segmentation fault in the gencgm_start function in gencgm.c. |
CVE-2020-21534 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a global buffer overflow in the get_line function in read.c. |
CVE-2020-21533 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a stack buffer overflow in the read_textobject function in read.c. |
CVE-2020-21532 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a global buffer overflow in the setfigfont function in genepic.c. |
CVE-2020-21531 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a global buffer overflow in the conv_pattern_index function in gencgm.c. |
CVE-2020-21530 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a segmentation fault in the read_objects function in read.c. |
CVE-2020-21529 | Medium | 5.5 | 2021-09-16 | fig2dev 3.2.7b contains a stack buffer overflow in the bezier_spline function in genepic.c. |
CVE-2020-14124 | Critical | 9.8 | 2021-09-16 | There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router AX3600 with ROM version =rom< 1.1.12. |
CVE-2020-14119 | Critical | 9.8 | 2021-09-16 | There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on Xiaomi router AX360… |
CVE-2020-14130 | Medium | 5.3 | 2021-09-16 | Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app Affected Version <3.0.210… |
CVE-2020-14109 | High | 7.2 | 2021-09-16 | There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaomi router AX3600 wit… |
CVE-2020-21483 | High | 7.2 | 2021-09-15 | An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg file which is later changed to a PHP file. |
CVE-2020-21482 | Medium | 5.4 | 2021-09-15 | A cross-site scripting (XSS) vulnerability in RGCMS v1.06 allows attackers to obtain the administrator's cookie via a crafted payload in the Name field under t… |
CVE-2020-21481 | High | 7.2 | 2021-09-15 | An arbitrary file upload vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted .txt file which is later changed to a PHP file. |
CVE-2020-21480 | High | 7.2 | 2021-09-15 | An arbitrary file write vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2020-21322 | Critical | 9.8 | 2021-09-15 | An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2020-21321 | Medium | 4.3 | 2021-09-15 | emlog v6.0 contains a Cross-Site Request Forgery (CSRF) via /admin/link.php?action=addlink, which allows attackers to arbitrarily add articles. |
CVE-2020-21127 | Critical | 9.8 | 2021-09-15 | MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel. |
CVE-2020-21126 | High | 8.8 | 2021-09-15 | MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo. |
CVE-2020-21125 | Critical | 9.8 | 2021-09-15 | An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code. |
CVE-2020-21124 | Critical | 9.8 | 2021-09-15 | UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page. |
CVE-2020-21122 | Medium | 5.3 | 2021-09-15 | UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports. |
CVE-2020-21121 | Critical | 9.8 | 2021-09-15 | Pligg CMS 2.0.2 contains a time-based SQL injection vulnerability via the $recordIDValue parameter in the admin_update_module_widgets.php file. |
CVE-2020-19159 | High | 8.8 | 2021-09-15 | Cross Site Request Forgery (CSRF) in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'. |
CVE-2020-19158 | Medium | 5.4 | 2021-09-15 | Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the componen… |
CVE-2020-19157 | Medium | 6.1 | 2021-09-15 | Cross Site Scripting (CSS) in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter for the component '/index.php?m=ucente… |
CVE-2020-19156 | Medium | 5.4 | 2021-09-15 | Cross Site Scripting (XSS) in Ari Adminer v1 allows remote attackers to execute arbitrary code via the 'Title' parameter of the 'Add New Connections' component… |
CVE-2020-19155 | High | 8.8 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary code via the 'FileMan… |
CVE-2020-19154 | Medium | 6.5 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in t… |
CVE-2020-19151 | High | 8.8 | 2021-09-15 | Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the compon… |
CVE-2020-19150 | High | 8.1 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileMana… |
CVE-2020-19148 | Medium | 5.4 | 2021-09-15 | Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter in the component '/j… |
CVE-2020-19147 | Medium | 6.5 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the componen… |
CVE-2020-19146 | Medium | 6.5 | 2021-09-15 | Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the compon… |
CVE-2020-3960 | High | 8.4 | 2021-09-15 | VMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an… |
CVE-2020-35340 | High | 7.5 | 2021-09-15 | A local file inclusion vulnerability in ExpertPDF 9.5.0 through 14.1.0 allows attackers to read the file contents from files that the running ExpertPDF process… |
CVE-2020-21082 | Medium | 6.1 | 2021-09-14 | A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and… |
CVE-2020-21081 | Medium | 6.5 | 2021-09-14 | A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL. |
CVE-2020-21050 | Medium | 6.5 | 2021-09-14 | Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c. |
CVE-2020-21049 | Medium | 6.5 | 2021-09-14 | An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file. |
CVE-2020-21048 | Medium | 6.5 | 2021-09-14 | An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file. |
CVE-2020-20672 | High | 7.8 | 2021-09-13 | An arbitrary file upload vulnerability in /admin/upload/uploadfile of KiteCMS V1.1 allows attackers to getshell via a crafted PHP file. |
CVE-2020-20671 | High | 8.8 | 2021-09-13 | A cross-site request forgery (CSRF) in KiteCMS V1.1 allows attackers to arbitrarily add an administrator account. |
CVE-2020-20670 | High | 8.8 | 2021-09-13 | An arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows attackers to execute arbitrary code via a crafted HTML file. |
CVE-2020-27970 | Medium | 5.3 | 2021-09-13 | Yandex Browser before 20.10.0 allows remote attackers to spoof the address bar |
CVE-2020-27969 | High | 7.3 | 2021-09-13 | Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing |
CVE-2020-19295 | Medium | 6.1 | 2021-09-09 | A reflected cross-site scripting (XSS) vulnerability in the /weibo/topic component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2020-19294 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /article/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2020-19293 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /article/add component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2020-19292 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /question/ask component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2020-19291 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /weibo/publishdata component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2020-19290 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /weibo/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2020-19289 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /member/picture/album component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or H… |
CVE-2020-19288 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /localhost/u component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2020-19287 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /group/post component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2020-19286 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /question/detail component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2020-19285 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /group/apply component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2020-19284 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /group/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2020-19283 | Medium | 6.1 | 2021-09-09 | A reflected cross-site scripting (XSS) vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2020-19282 | Medium | 6.1 | 2021-09-09 | A reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the sys… |
CVE-2020-19281 | Medium | 5.4 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the /manage/loginusername component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or H… |
CVE-2020-19280 | High | 8.8 | 2021-09-09 | Jeesns 1.4.2 contains a cross-site request forgery (CSRF) which allows attackers to escalate privileges and perform sensitive program operations. |
CVE-2020-19268 | Medium | 5.7 | 2021-09-09 | A cross-site request forgery (CSRF) in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add administrator users. |
CVE-2020-19267 | Critical | 9.8 | 2021-09-09 | An issue in index.php/Dswjcms/Basis/resources of Dswjcms 1.6.4 allows attackers to execute arbitrary code via uploading a crafted PHP file. |
CVE-2020-19266 | Medium | 6.1 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Site/articleList component of Dswjcms 1.6.4 allows attackers to execute arbitrary we… |
CVE-2020-19265 | Medium | 6.1 | 2021-09-09 | A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Basis/links component of Dswjcms 1.6.4 allows attackers to execute arbitrary web scr… |
CVE-2020-19264 | Medium | 6.5 | 2021-09-09 | A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily add users via index.php?s=/user/ApiAdminUser/itemAdd. |
CVE-2020-19263 | High | 8.8 | 2021-09-09 | A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily escalate user privileges to administrator via index.php?s=/user/ApiAdminUs… |
CVE-2020-19515 | Medium | 6.1 | 2021-09-09 | qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php. |
CVE-2020-19144 | Medium | 6.5 | 2021-09-09 | Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'. |
CVE-2020-19143 | Medium | 6.5 | 2021-09-09 | Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "TIFFVGetField" funtion in the component 'libtiff/tif_dir.c'. |
CVE-2020-7874 | High | 8.8 | 2021-09-09 | Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file… |
CVE-2020-7873 | High | 8.8 | 2021-09-09 | Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary file download and ex… |
CVE-2020-26300 | Medium | 5.9 | 2021-09-09 | systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command… |
CVE-2020-26772 | Critical | 9.8 | 2021-09-08 | Command Injection in PPGo_Jobs v2.8.0 allows remote attackers to execute arbitrary code via the 'AjaxRun()' function. |
CVE-2020-19138 | Critical | 9.8 | 2021-09-08 | Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java… |
CVE-2020-19137 | High | 7.5 | 2021-09-08 | Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllU… |
CVE-2020-24672 | Critical | 9.8 | 2021-09-08 | A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer running the affected product. This issue aff… |
CVE-2020-27942 | High | 7.8 | 2021-09-08 | A logic issue was addressed with improved state management. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave. Processi… |
CVE-2020-27940 | Medium | 4.3 | 2021-09-08 | This issue was addressed with improved file handling. This issue is fixed in Apple TV app for Fire OS 6.1.0.6A142:7.1.0. An attacker with file system access ma… |
CVE-2020-11301 | Critical | 9.1 | 2021-09-08 | Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Comput… |
CVE-2020-11264 | Critical | 9.1 | 2021-09-08 | Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdra… |
CVE-2020-29012 | Medium | 5.6 | 2021-09-08 | An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs t… |
CVE-2020-19855 | Medium | 6.1 | 2021-09-08 | phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php. |
CVE-2020-19853 | Critical | 9.8 | 2021-09-08 | BlueCMS v1.6 contains a SQL injection vulnerability via /ad_js.php. |
CVE-2020-19769 | High | 7.5 | 2021-09-07 | A lack of target address verification in the BurnMe() function of Rob The Bank 1.0 allows attackers to steal tokens from victim users via a crafted script. |
CVE-2020-19768 | High | 7.5 | 2021-09-07 | A lack of target address verification in the selfdestructs() function of ICOVO 1.0 allows attackers to steal tokens from victim users via a crafted script. |
CVE-2020-19767 | High | 7.5 | 2021-09-07 | A lack of target address verification in the destroycontract() function of 0xRACER 1.0 allows attackers to steal tokens from victim users via a crafted script. |