2020 CVEs (page 22)
Page 22 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-18879 | Critical | 9.8 | 2021-08-20 | Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious files via the component 'bl-kereln/ajax/uplo… |
CVE-2020-18878 | Medium | 5.3 | 2021-08-20 | Directory Traversal in Skycaiji v1.3 allows remote attackers to obtain sensitive information via the component 'index.php?m=admin&c=Tool&a=log&file=D%3A%5CphpS… |
CVE-2020-18877 | High | 7.5 | 2021-08-20 | SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin… |
CVE-2020-18900 | Low | 3.3 | 2021-08-19 | A heap-based buffer overflow in the libexe_io_handle_read_coff_optional_header function of libyal libexe before 20181128. NOTE: the vendor has disputed this as… |
CVE-2020-18899 | Medium | 6.5 | 2021-08-19 | An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a cr… |
CVE-2020-18898 | Medium | 6.5 | 2021-08-19 | A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file. |
CVE-2020-18897 | High | 7.8 | 2021-08-19 | An use-after-free vulnerability in the libpff_item_tree_create_node function of libyal Libpff before 20180623 allows attackers to cause a denial of service (DO… |
CVE-2020-20645 | Medium | 5.4 | 2021-08-19 | Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area. |
CVE-2020-20642 | High | 8.8 | 2021-08-19 | Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=n… |
CVE-2020-18748 | Medium | 6.1 | 2021-08-19 | Cross Site Scripting (XSS) in Typora v0.9.65 allows attackers to execute arbitrary code via mathjax syntax due to a mathjax configuration error in the mathemat… |
CVE-2020-35685 | Critical | 9.1 | 2021-08-19 | An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficient… |
CVE-2020-35684 | High | 7.5 | 2021-08-19 | An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP payload size (extracted from the IP head… |
CVE-2020-35683 | High | 7.5 | 2021-08-19 | An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP payload size (extracted from the IP hea… |
CVE-2020-22345 | High | 8.8 | 2021-08-18 | /graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_… |
CVE-2020-25928 | Critical | 9.8 | 2021-08-18 | The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: DNS re… |
CVE-2020-25927 | High | 7.5 | 2021-08-18 | The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. The impact is: a denial of service (remote). The component is: DNS re… |
CVE-2020-25926 | High | 7.5 | 2021-08-18 | The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning (remote… |
CVE-2020-25767 | High | 7.5 | 2021-08-18 | An issue was discovered in HCC Embedded NicheStack IPv4 4.1. The dnc_copy_in routine for parsing DNS domain names does not check whether a domain name compress… |
CVE-2020-19669 | High | 8.8 | 2021-08-18 | Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=admin_add&lang=cn. |
CVE-2020-22124 | High | 7.5 | 2021-08-18 | A vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information. |
CVE-2020-22122 | High | 7.5 | 2021-08-18 | A SQL injection vulnerability in /oa.php?c=Staff&a=read of Find a Place LJCMS v 1.3 allows attackers to access sensitive database information via a crafted POS… |
CVE-2020-22120 | High | 8.8 | 2021-08-18 | A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticated attackers to execute arbitrary code. |
CVE-2020-28146 | Medium | 6.1 | 2021-08-18 | Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter. |
CVE-2020-23069 | Medium | 6.5 | 2021-08-18 | Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in general_serv.php, which could let a malicious user read arbitrary files. |
CVE-2020-18875 | High | 8.8 | 2021-08-18 | Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files. |
CVE-2020-18746 | High | 7.2 | 2021-08-18 | SQL Injection in AiteCMS v1.0 allows remote attackers to execute arbitrary code via the component "aitecms/login/diy_list.php". |
CVE-2020-23341 | Medium | 6.1 | 2021-08-17 | A reflected cross site scripting (XSS) vulnerability in the /header.tmpl.php component of ATutor 2.2.4 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2020-23334 | High | 7.5 | 2021-08-17 | A WRITE memory access in the AP4_NullTerminatedStringAtom::AP4_NullTerminatedStringAtom component of Bento4 version 06c39d9 can lead to a segmentation fault. |
CVE-2020-23333 | High | 7.5 | 2021-08-17 | A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9. This can lead to a denia… |
CVE-2020-23332 | High | 7.5 | 2021-08-17 | A heap-based buffer overflow exists in the AP4_StdcFileByteStream::ReadPartial component located in /StdC/Ap4StdCFileByteStream.cpp of Bento4 version 06c39d9… |
CVE-2020-23331 | High | 7.5 | 2021-08-17 | An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_DescriptorListWriter::Action component located in /Core/Ap4Desc… |
CVE-2020-23330 | High | 7.5 | 2021-08-17 | An issue was discovered in Bento4 version 06c39d9. A NULL pointer dereference exists in the AP4_Stz2Atom::GetSampleSize component located in /Core/Ap4Stz2Atom… |
CVE-2020-28594 | High | 7.8 | 2021-08-17 | A use-after-free vulnerability exists in the _3MF_Importer::_handle_end_model() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856)… |
CVE-2020-18164 | Critical | 9.8 | 2021-08-17 | SQL Injection vulnerability exists in tp-shop 2.x-3.x via the /index.php/home/api/shop fBill parameter. |
CVE-2020-13589 | High | 8.8 | 2021-08-17 | An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The entities_id parameter in t… |
CVE-2020-13588 | High | 8.8 | 2021-08-17 | An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The heading_field_id parameter… |
CVE-2020-22937 | Critical | 9.8 | 2021-08-17 | A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the install… |
CVE-2020-29548 | High | 8.1 | 2021-08-17 | An issue was discovered in SmarterTools SmarterMail through 100.0.7537. Meddler-in-the-middle attackers can pipeline commands after a POP3 STLS command, inject… |
CVE-2020-15955 | Medium | 5.9 | 2021-08-17 | In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This al… |
CVE-2020-28846 | Medium | 6.5 | 2021-08-17 | Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious user add an admin account. |
CVE-2020-4992 | Medium | 6.5 | 2021-08-17 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unautho… |
CVE-2020-4706 | Medium | 5.4 | 2021-08-17 | IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a speci… |
CVE-2020-18705 | Critical | 9.8 | 2021-08-16 | XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'. |
CVE-2020-18704 | Critical | 9.8 | 2021-08-16 | Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the componen… |
CVE-2020-18703 | Critical | 9.8 | 2021-08-16 | XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'. |
CVE-2020-18702 | Medium | 6.1 | 2021-08-16 | Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actio… |
CVE-2020-18701 | Critical | 9.8 | 2021-08-16 | Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not inva… |
CVE-2020-18699 | Medium | 6.1 | 2021-08-16 | Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the… |
CVE-2020-18698 | Critical | 9.8 | 2021-08-16 | Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in th… |
CVE-2020-36473 | Low | 3.7 | 2021-08-14 | UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP, and thus man-in-the-middle attackers can discover visited URLs. |
CVE-2020-21066 | Medium | 6.5 | 2021-08-13 | An issue was discovered in Bento4 v1.5.1.0. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a denial of service (p… |
CVE-2020-18759 | High | 7.5 | 2021-08-13 | An information disclosure vulnerability exists in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100. |
CVE-2020-18758 | Critical | 9.8 | 2021-08-13 | An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to execute arbitrary code. |
CVE-2020-18757 | High | 7.5 | 2021-08-13 | An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to cause persistent denial of service (DOS) via a crafted packet. |
CVE-2020-18756 | High | 7.5 | 2021-08-13 | An arbitrary memory access vulnerability in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to read the contents of any… |
CVE-2020-18754 | High | 7.5 | 2021-08-13 | An information disclosure vulnerability exists within Dut Computer Control Engineering Co.'s PLC MAC1100. |
CVE-2020-18753 | Critical | 9.8 | 2021-08-13 | An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to gain access to the system and escalate privileges via a crafted packet. |
CVE-2020-36363 | Critical | 9.8 | 2021-08-12 | Amazon AWS CloudFront TLSv1.2_2019 allows TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, which some entities consider to be w… |
CVE-2020-22403 | High | 8.8 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecifie… |
CVE-2020-20990 | Medium | 5.4 | 2021-08-12 | A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2020-20989 | Medium | 4.3 | 2021-08-12 | A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete logs. |
CVE-2020-20988 | Medium | 5.4 | 2021-08-12 | A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or H… |
CVE-2020-18464 | Low | 3.5 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability in AikCms 2.0.0 in video_list.php, which can let a malicious user delete movie information. |
CVE-2020-18463 | Low | 2.4 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability exists in v2.0.0 in video_list.php, which can let a malicious user delete a video message. |
CVE-2020-18462 | High | 7.2 | 2021-08-12 | File Upload vulnerabilty in AikCms v2.0.0 in poster_edit.php because the background file management office does not verify the uploaded file. |
CVE-2020-18460 | High | 8.8 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability exists in 711cms v1.0.7 that can add an admin account via admin.php?c=Admin&m=content. |
CVE-2020-18458 | High | 8.0 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd. |
CVE-2020-18457 | Medium | 6.8 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability exists in bycms v1.3.0 that can add an admin account via admin.php/ucenter/add.html. |
CVE-2020-18456 | Medium | 4.8 | 2021-08-12 | Cross Site Scripting (XSS) vulnerability exists in PbootCMS v1.3.7 via the title parameter in the mod function in SingleController.php. |
CVE-2020-18455 | Medium | 4.8 | 2021-08-12 | Cross Site Scripting (XSS) vulnerability exists in bycms v3.0.4 via the title parameter in the edit function in Document.php. |
CVE-2020-18454 | Medium | 6.8 | 2021-08-12 | Cross Site Request Forgery (CSRF) vulnerability in bycms v1.3 via admin.php/systems/index/module_id/70/group_id/1.html. |
CVE-2020-18451 | Medium | 4.8 | 2021-08-12 | Cross Site Scripting (XSS) vulnerability exists in DamiCMS v6.0.6 via the title parameter in the doadd function in LabelAction.class.php. |
CVE-2020-18449 | Medium | 5.4 | 2021-08-12 | Cross Site Scripting (XSS) vulnerability exists in UKCMS v1.1.10 via data in the index function in Single.php |
CVE-2020-18446 | Medium | 4.8 | 2021-08-12 | Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the param parameter in the insertContent function in ContentModel.php. |
CVE-2020-18445 | Medium | 6.1 | 2021-08-12 | Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php. |
CVE-2020-20981 | High | 7.5 | 2021-08-12 | A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information. |
CVE-2020-20979 | Critical | 9.8 | 2021-08-12 | An arbitrary file upload vulnerability in the move_uploaded_file() function of LJCMS v4.3 allows attackers to execute arbitrary code. |
CVE-2020-20977 | Medium | 5.4 | 2021-08-12 | A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2020-20975 | Critical | 9.8 | 2021-08-12 | In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter. |
CVE-2020-28165 | Critical | 9.8 | 2021-08-12 | The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by usin… |
CVE-2020-24576 | High | 8.8 | 2021-08-12 | Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM. |
CVE-2020-25566 | Critical | 9.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to take over an account by sending a request to the Save_Password form as shown in POC. Notice that we do not require a JSES… |
CVE-2020-25565 | Critical | 9.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the acces… |
CVE-2020-25564 | High | 8.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to create local administrator on any client with credentials of a non-privileged user by directly accessing RemoteMgmtTaskSa… |
CVE-2020-25563 | Critical | 9.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to create local administrator on any client without requiring any credentials by directly accessing RemoteMgmtTaskSave (Auto… |
CVE-2020-25562 | Medium | 6.5 | 2021-08-11 | In SapphireIMS 5.0, there is no CSRF token present in the entire application. This can lead to CSRF vulnerabilities in critical application forms like account… |
CVE-2020-25561 | High | 7.8 | 2021-08-11 | SapphireIMS 5 utilized default sapphire:ims credentials to connect the client to server. This credential is saved in ServerConf.config file in the client. |
CVE-2020-25560 | Critical | 9.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the acces… |
CVE-2020-21363 | Medium | 6.5 | 2021-08-11 | An arbitrary file deletion vulnerability exists within Maccms10. |
CVE-2020-21362 | Medium | 5.4 | 2021-08-11 | A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd'… |
CVE-2020-21359 | Critical | 9.8 | 2021-08-11 | An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitra… |
CVE-2020-21976 | High | 8.8 | 2021-08-11 | An arbitrary file upload in the <input type="file" name="user_image"> component of NewsOne CMS v1.1.0 allows attackers to webshell and execute arbitrary comman… |
CVE-2020-28589 | High | 8.8 | 2021-08-11 | An improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development commit 79d4421. A… |
CVE-2020-21930 | Medium | 5.4 | 2021-08-10 | A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or… |
CVE-2020-21929 | Medium | 5.4 | 2021-08-10 | A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts… |
CVE-2020-21697 | Medium | 6.5 | 2021-08-10 | A heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service (DOS) via a crafted avi… |
CVE-2020-21688 | High | 8.8 | 2021-08-10 | A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code. |
CVE-2020-21684 | Medium | 5.5 | 2021-08-10 | A global buffer overflow in the put_font in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into p… |
CVE-2020-21683 | Medium | 5.5 | 2021-08-10 | A global buffer overflow in the shade_or_tint_name_after_declare_color in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) v… |
CVE-2020-21682 | Medium | 5.5 | 2021-08-10 | A global buffer overflow in the set_fill component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file… |