2020 CVEs (page 21)
Page 21 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-19766 | High | 7.5 | 2021-09-07 | The time check operation of PepeAuctionSale 1.0 can be rendered ineffective by assigning a large number to the _duration variable, compromising access control… |
CVE-2020-19765 | High | 7.5 | 2021-09-07 | An issue in the noReentrance() modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a reentrancy attack. |
CVE-2020-19752 | High | 7.5 | 2021-09-07 | The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference. |
CVE-2020-19751 | Critical | 9.1 | 2021-09-07 | An issue was discovered in gpac 0.8.0. The gf_odf_del_ipmp_tool function in odf_code.c has a heap-based buffer over-read. |
CVE-2020-19750 | High | 7.5 | 2021-09-07 | An issue was discovered in gpac 0.8.0. The strdup function in box_code_base.c has a heap-based buffer over-read. |
CVE-2020-7865 | High | 8.8 | 2021-09-07 | A vulnerability(improper input validation) in the ExECM CoreB2B solution allows an unauthenticated attacker to download and execute an arbitrary file via httpD… |
CVE-2020-7832 | High | 8.8 | 2021-09-07 | A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to download and execute an arbitrary file via AddUp… |
CVE-2020-7819 | Critical | 9.3 | 2021-09-07 | A SQL-Injection vulnerability in the nTracker USB Enterprise(secure USB management solution) allows a remote unauthenticated attacker to perform SQL query to a… |
CVE-2020-19131 | High | 7.5 | 2021-09-07 | Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop". |
CVE-2020-7877 | High | 8.0 | 2021-09-07 | A buffer overflow issue was discovered in ZOOK solution(remote administration tool) through processing 'ConnectMe' command while parsing a crafted OUTERIP valu… |
CVE-2020-15939 | Medium | 4.3 | 2021-09-06 | An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attack… |
CVE-2020-18048 | Critical | 9.8 | 2021-09-02 | An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field. |
CVE-2020-13929 | High | 7.5 | 2021-09-02 | Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affect… |
CVE-2020-20349 | Medium | 5.4 | 2021-09-01 | WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background links module. |
CVE-2020-20348 | Medium | 5.4 | 2021-09-01 | WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu management module. |
CVE-2020-20347 | Medium | 5.4 | 2021-09-01 | WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management module. |
CVE-2020-20345 | Medium | 5.4 | 2021-09-01 | WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows attackers to obtain cookies via a craft… |
CVE-2020-20344 | Medium | 5.4 | 2021-09-01 | WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the keyword search function under the background articles module. |
CVE-2020-20343 | Medium | 6.5 | 2021-09-01 | WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post component that allows attackers to arbitrarily a… |
CVE-2020-20341 | High | 7.5 | 2021-09-01 | YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function. |
CVE-2020-20340 | High | 7.5 | 2021-09-01 | A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database information. |
CVE-2020-9002 | High | 7.5 | 2021-09-01 | An issue was discovered in iPortalis iCS 7.1.13.0. An attacker can gain privileges by intercepting a request and changing UserRoleKey=COMPANY_ADMIN to UserRole… |
CVE-2020-9000 | High | 7.5 | 2021-09-01 | An issue was discovered in iPortalis iCS 7.1.13.0. Attackers can send a sequence of requests to rapidly cause .NET Input Validation errors. This increases the… |
CVE-2020-20495 | Critical | 9.1 | 2021-09-01 | bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter. |
CVE-2020-20490 | High | 7.5 | 2021-08-31 | A heap buffer-overflow in the client_example1.c component of libiec_iccp_mod v1.5 leads to a denial of service (DOS). |
CVE-2020-20486 | High | 7.5 | 2021-08-31 | IEC104 v1.0 contains a stack-buffer overflow in the parameter Iec10x_Sta_Addr. |
CVE-2020-19049 | Medium | 5.4 | 2021-08-31 | Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New For… |
CVE-2020-19048 | Medium | 5.4 | 2021-08-31 | Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" pa… |
CVE-2020-19047 | High | 8.8 | 2021-08-31 | Cross Site Request Forgey (CSRF) in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST request to the component '/index.php?con… |
CVE-2020-19046 | Medium | 5.4 | 2021-08-31 | Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='. |
CVE-2020-13639 | Medium | 6.1 | 2021-08-31 | A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthentica… |
CVE-2020-22848 | Critical | 9.8 | 2021-08-30 | A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to execute arbitrary commands. |
CVE-2020-35635 | High | 8.8 | 2021-08-30 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface()… |
CVE-2020-35634 | High | 8.8 | 2021-08-30 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_pa… |
CVE-2020-35633 | High | 8.8 | 2021-08-30 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_pa… |
CVE-2020-18127 | Medium | 6.5 | 2021-08-30 | An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files. |
CVE-2020-18126 | Medium | 5.4 | 2021-08-30 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2020-18125 | Medium | 6.1 | 2021-08-30 | A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or… |
CVE-2020-18124 | Medium | 5.7 | 2021-08-30 | A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords. |
CVE-2020-18123 | Medium | 6.5 | 2021-08-30 | A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts. |
CVE-2020-18121 | High | 8.8 | 2021-08-30 | A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell. |
CVE-2020-15744 | Critical | 9.6 | 2021-08-30 | Stack-based Buffer Overflow vulnerability in the ONVIF server component of Victure PC420 smart camera allows an attacker to execute remote code on the target d… |
CVE-2020-18116 | High | 8.8 | 2021-08-27 | A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection. |
CVE-2020-18114 | Critical | 9.8 | 2021-08-27 | An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format. |
CVE-2020-18106 | Critical | 9.8 | 2021-08-27 | The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection. |
CVE-2020-19002 | Medium | 6.1 | 2021-08-27 | Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogp… |
CVE-2020-19001 | Critical | 9.8 | 2021-08-27 | Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/si… |
CVE-2020-19000 | Medium | 6.1 | 2021-08-27 | Cross Site Scripting (XSS) in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code via line 54 of the component 'simiki/blob/master/simi… |
CVE-2020-18999 | Medium | 6.1 | 2021-08-27 | Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/submit-articles'. |
CVE-2020-18998 | Medium | 6.1 | 2021-08-27 | Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/custom/blog-plugin/add'. |
CVE-2020-23226 | Medium | 6.1 | 2021-08-27 | Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templa… |
CVE-2020-20675 | Critical | 9.8 | 2021-08-26 | Nuishop v2.3 contains a SQL injection vulnerability in /goods/getGoodsListByConditions/. |
CVE-2020-18477 | High | 8.8 | 2021-08-26 | SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con_content field. |
CVE-2020-18476 | High | 8.8 | 2021-08-26 | SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field. |
CVE-2020-18475 | Medium | 5.4 | 2021-08-26 | Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes_title field. The first user inserts a malicious script into the header field… |
CVE-2020-18470 | Medium | 5.4 | 2021-08-26 | Stored cross-site scripting (XSS) vulnerability in the Name of application field found in the General Configuration page in Rukovoditel 2.4.1 allows remote att… |
CVE-2020-18469 | Medium | 5.4 | 2021-08-26 | Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in Rukovoditel 2.4.1 all… |
CVE-2020-18468 | Medium | 5.4 | 2021-08-26 | Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name… |
CVE-2020-18467 | Medium | 5.4 | 2021-08-26 | Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website n… |
CVE-2020-14161 | Medium | 6.1 | 2021-08-26 | It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint. |
CVE-2020-14160 | High | 7.5 | 2021-08-26 | An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files… |
CVE-2020-19822 | High | 7.2 | 2021-08-26 | A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title"… |
CVE-2020-19821 | High | 8.8 | 2021-08-26 | A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders[] parameter. |
CVE-2020-19709 | Medium | 6.1 | 2021-08-26 | Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload. |
CVE-2020-19705 | Critical | 9.8 | 2021-08-26 | thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add. |
CVE-2020-19704 | Medium | 5.4 | 2021-08-26 | A stored cross-site scripting (XSS) vulnerability via ResourceController.java in spring-boot-admin as of 20190710 allows attackers to execute arbitrary web scr… |
CVE-2020-19703 | Medium | 6.1 | 2021-08-26 | A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2020-19547 | Medium | 6.5 | 2021-08-25 | Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php. |
CVE-2020-18065 | Medium | 5.4 | 2021-08-25 | Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu. |
CVE-2020-18976 | Medium | 5.5 | 2021-08-25 | Buffer Overflow in Tcpreplay v4.3.2 allows attackers to cause a Denial of Service via the 'do_checksum' function in 'checksum.c'. It can be triggered by sendin… |
CVE-2020-18974 | Low | 3.3 | 2021-08-25 | Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause a denial of service via 'crc64i' in the component 'nasmlib/crc64'. This issue is… |
CVE-2020-18972 | Medium | 5.5 | 2021-08-25 | Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via 'IsNextToken' in the component… |
CVE-2020-18971 | Medium | 5.5 | 2021-08-25 | Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65'. |
CVE-2020-18917 | High | 8.8 | 2021-08-24 | The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typen… |
CVE-2020-18913 | High | 7.5 | 2021-08-24 | EARCLINK ESPCMS-P8 was discovered to contain a SQL injection vulnerability in the espcms_web/Search.php component via the attr_array parameter. This vulnerabil… |
CVE-2020-18778 | Medium | 6.5 | 2021-08-23 | In Libav 12.3, there is a heap-based buffer over-read in vc1_decode_p_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-service via a crafted… |
CVE-2020-18776 | Medium | 6.5 | 2021-08-23 | In Libav 12.3, there is a segmentation fault in vc1_decode_b_mb_intfr in vc1_block.c that allows an attacker to cause denial-of-service via a crafted file. |
CVE-2020-18775 | Medium | 6.5 | 2021-08-23 | In Libav 12.3, there is a heap-based buffer over-read in vc1_decode_b_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-service via a crafted… |
CVE-2020-18774 | Medium | 6.5 | 2021-08-23 | A float point exception in the printLong function in tags_int.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service (DOS) via a crafted tif file. |
CVE-2020-18773 | Medium | 6.5 | 2021-08-23 | An invalid memory access in the decode function in iptc.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service (DOS) via a crafted tif file. |
CVE-2020-18771 | High | 8.1 | 2021-08-23 | Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak. |
CVE-2020-18735 | High | 7.5 | 2021-08-23 | A heap buffer overflow in /src/dds_stream.c of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash. |
CVE-2020-18734 | High | 7.5 | 2021-08-23 | A stack buffer overflow in /ddsi/q_bitset.h of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash. |
CVE-2020-18731 | High | 7.5 | 2021-08-23 | A segmentation violation in the Iec104_Deal_FirmUpdate function of IEC104 v1.0 allows attackers to cause a denial of service (DOS). |
CVE-2020-18730 | High | 7.5 | 2021-08-23 | A segmentation violation in the Iec104_Deal_I function of IEC104 v1.0 allows attackers to cause a denial of service (DOS). |
CVE-2020-36478 | High | 7.5 | 2021-08-23 | An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array… |
CVE-2020-36477 | Medium | 5.9 | 2021-08-23 | An issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when matching the expected common name (the cn argument of mbedtls_x5… |
CVE-2020-36476 | High | 7.5 | 2021-08-23 | An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_s… |
CVE-2020-36475 | High | 7.5 | 2021-08-23 | An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limi… |
CVE-2020-24130 | High | 8.1 | 2021-08-20 | A cross site request forgery (CSRF) vulnerability in the configure.html component of Ponzu 0.11.0 allows attackers to change user and administrator credentials… |
CVE-2020-27466 | High | 7.8 | 2021-08-20 | An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a crafted file. |
CVE-2020-27464 | High | 7.8 | 2021-08-20 | An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file. |
CVE-2020-27461 | High | 8.8 | 2021-08-20 | A remote code execution vulnerability in SEOPanel 4.6.0 has been fixed for 4.7.0. This vulnerability allowed for remote code execution through an authenticated… |
CVE-2020-25359 | Critical | 9.1 | 2021-08-20 | An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers the ability to send a crafted request to… |
CVE-2020-25353 | Medium | 6.5 | 2021-08-20 | A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open… |
CVE-2020-25352 | Medium | 5.4 | 2021-08-20 | A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed rem… |
CVE-2020-25351 | Medium | 6.5 | 2021-08-20 | An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote authenticated attackers to read fi… |
CVE-2020-36474 | Critical | 9.8 | 2021-08-20 | SafeCurl before 0.9.2 has a DNS rebinding vulnerability. |
CVE-2020-18886 | High | 7.2 | 2021-08-20 | Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'. |
CVE-2020-18885 | High | 7.2 | 2021-08-20 | Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'. |