2020 CVEs (page 23)
Page 23 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-21681 | Medium | 5.5 | 2021-08-10 | A global buffer overflow in the set_color component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file… |
CVE-2020-21680 | Medium | 5.5 | 2021-08-10 | A stack-based buffer overflow in the put_arrow() component in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting… |
CVE-2020-21678 | Medium | 5.5 | 2021-08-10 | A global buffer overflow in the genmp_writefontmacro_latex component in genmp.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via conve… |
CVE-2020-21677 | Medium | 6.5 | 2021-08-10 | A heap-based buffer overflow in the sixel_encoder_output_without_macro function in encoder.c of Libsixel 1.8.4 allows attackers to cause a denial of service (D… |
CVE-2020-21676 | Medium | 5.5 | 2021-08-10 | A stack-based buffer overflow in the genpstrx_text() component in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via conve… |
CVE-2020-21675 | Medium | 5.5 | 2021-08-10 | A stack-based buffer overflow in the genptk_text component in genptk.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a x… |
CVE-2020-25082 | Low | 3.8 | 2021-08-10 | An attacker with physical access to Nuvoton Trusted Platform Module (NPCT75x 7.2.x before 7.2.2.0) could extract an Elliptic Curve Cryptography (ECC) private k… |
CVE-2020-23172 | Medium | 5.5 | 2021-08-10 | A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validatio… |
CVE-2020-23171 | Medium | 5.5 | 2021-08-10 | A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash char… |
CVE-2020-28397 | Medium | 5.3 | 2021-08-10 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS v… |
CVE-2020-23151 | Critical | 9.8 | 2021-08-09 | rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to… |
CVE-2020-23150 | High | 7.5 | 2021-08-09 | A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install… |
CVE-2020-23149 | High | 7.5 | 2021-08-09 | The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive database informat… |
CVE-2020-23148 | High | 7.5 | 2021-08-09 | The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via… |
CVE-2020-24742 | High | 7.8 | 2021-08-09 | An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arb… |
CVE-2020-36472 | Medium | 5.9 | 2021-08-08 | An issue was discovered in the max7301 crate before 0.2.0 for Rust. The ImmediateIO and TransactionalIO types implement Sync for all Expander<EI> types that th… |
CVE-2020-36471 | Medium | 5.9 | 2021-08-08 | An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds. |
CVE-2020-36470 | Medium | 5.9 | 2021-08-08 | An issue was discovered in the disrustor crate through 2020-12-17 for Rust. RingBuffer doe not properly limit the number of mutable references. |
CVE-2020-36469 | Medium | 5.9 | 2021-08-08 | An issue was discovered in the appendix crate through 2020-11-15 for Rust. For the generic K and V type parameters, Send and Sync are implemented unconditional… |
CVE-2020-36468 | Medium | 5.9 | 2021-08-08 | An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::write performs non-atomic write operations on an underlying pointer. |
CVE-2020-36467 | Medium | 5.9 | 2021-08-08 | An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::get returns more than one mutable reference to the same object. |
CVE-2020-36466 | Medium | 5.9 | 2021-08-08 | An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr implements Send and Sync for all types. |
CVE-2020-36465 | High | 7.5 | 2021-08-08 | An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes. |
CVE-2020-36464 | High | 7.5 | 2021-08-08 | An issue was discovered in the heapless crate before 0.6.1 for Rust. The IntoIter Clone implementation clones an entire underlying Vec without considering whet… |
CVE-2020-36463 | High | 8.1 | 2021-08-08 | An issue was discovered in the multiqueue crate through 2020-12-25 for Rust. There are unconditional implementations of Send for InnerSend<RW, T>, InnerRecv<RW… |
CVE-2020-36462 | High | 8.1 | 2021-08-08 | An issue was discovered in the syncpool crate before 0.1.6 for Rust. There is an unconditional implementation of Send for Bucket2. |
CVE-2020-36461 | High | 8.1 | 2021-08-08 | An issue was discovered in the noise_search crate through 2020-12-10 for Rust. There are unconditional implementations of Send and Sync for MvccRwLock. |
CVE-2020-36460 | High | 8.1 | 2021-08-08 | An issue was discovered in the model crate through 2020-11-10 for Rust. The Shared data structure has an implementation of the Send and Sync traits without reg… |
CVE-2020-36459 | High | 8.1 | 2021-08-08 | An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore. |
CVE-2020-36458 | High | 8.1 | 2021-08-08 | An issue was discovered in the lexer crate through 2020-11-10 for Rust. For ReaderResult<T, E>, there is an implementation of Sync with a trait bound of T: Sen… |
CVE-2020-36457 | High | 8.1 | 2021-08-08 | An issue was discovered in the lever crate before 0.1.1 for Rust. AtomicBox<T> implements the Send and Sync traits for all types T. |
CVE-2020-36456 | High | 8.1 | 2021-08-08 | An issue was discovered in the toolshed crate through 2020-11-15 for Rust. In CopyCell<T>, the Send trait lacks bounds on the contained type. |
CVE-2020-36455 | High | 8.1 | 2021-08-08 | An issue was discovered in the slock crate through 2020-11-17 for Rust. Slock<T> unconditionally implements Send and Sync. |
CVE-2020-36454 | High | 8.1 | 2021-08-08 | An issue was discovered in the parc crate through 2020-11-14 for Rust. LockWeak<T> has an unconditional implementation of Send without trait bounds on T. |
CVE-2020-36453 | High | 8.1 | 2021-08-08 | An issue was discovered in the scottqueue crate through 2020-11-15 for Rust. There are unconditional implementations of Send and Sync for Queue<T>. |
CVE-2020-36452 | Critical | 9.8 | 2021-08-08 | An issue was discovered in the array-tools crate before 0.3.2 for Rust. FixedCapacityDequeLike::clone() has a drop of uninitialized memory. |
CVE-2020-36451 | High | 8.1 | 2021-08-08 | An issue was discovered in the rcu_cell crate through 2020-11-14 for Rust. There are unconditional implementations of Send and Sync for RcuCell<T>. |
CVE-2020-36450 | High | 8.1 | 2021-08-08 | An issue was discovered in the bunch crate through 2020-11-12 for Rust. There are unconditional implementations of Send and Sync for Bunch<T>. |
CVE-2020-36449 | High | 8.1 | 2021-08-08 | An issue was discovered in the kekbit crate before 0.3.4 for Rust. For ShmWriter<H>, Send is implemented without requiring H: Send. |
CVE-2020-36448 | High | 8.1 | 2021-08-08 | An issue was discovered in the cache crate through 2020-11-24 for Rust. There are unconditional implementations of Send and Sync for Cache<K>. |
CVE-2020-36447 | High | 8.1 | 2021-08-08 | An issue was discovered in the v9 crate through 2020-12-18 for Rust. There is an unconditional implementation of Sync for SyncRef<T>. |
CVE-2020-36446 | High | 8.1 | 2021-08-08 | An issue was discovered in the signal-simple crate through 2020-11-15 for Rust. There are unconditional implementations of Send and Sync for SyncChannel<T>. |
CVE-2020-36445 | High | 8.1 | 2021-08-08 | An issue was discovered in the convec crate through 2020-11-24 for Rust. There are unconditional implementations of Send and Sync for ConVec<T>. |
CVE-2020-36444 | High | 8.1 | 2021-08-08 | An issue was discovered in the async-coap crate through 2020-12-08 for Rust. Send and Sync are implemented for ArcGuard<RC, T> without trait bounds on RC. |
CVE-2020-36443 | Critical | 9.8 | 2021-08-08 | An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provid… |
CVE-2020-36442 | High | 8.1 | 2021-08-08 | An issue was discovered in the beef crate before 0.5.0 for Rust. beef::Cow has no Sync bound on its Send trait. |
CVE-2020-36441 | High | 8.1 | 2021-08-08 | An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox<T> with no requirement for T: Send and T: Sync. |
CVE-2020-36440 | High | 8.1 | 2021-08-08 | An issue was discovered in the libsbc crate before 0.1.5 for Rust. For Decoder<R>, it implements Send for any R: Read. |
CVE-2020-36439 | High | 8.1 | 2021-08-08 | An issue was discovered in the ticketed_lock crate before 0.3.0 for Rust. There are unconditional implementations of Send for ReadTicket<T> and WriteTicket<T>. |
CVE-2020-36438 | High | 8.1 | 2021-08-08 | An issue was discovered in the tiny_future crate before 0.4.0 for Rust. Future<T> does not have bounds on its Send and Sync traits. |
CVE-2020-36437 | High | 8.1 | 2021-08-08 | An issue was discovered in the conqueue crate before 0.4.0 for Rust. There are unconditional implementations of Send and Sync for QueueSender<T>. |
CVE-2020-36436 | High | 8.1 | 2021-08-08 | An issue was discovered in the unicycle crate before 0.7.1 for Rust. PinSlab<T> and Unordered<T, S> do not have bounds on their Send and Sync traits. |
CVE-2020-36435 | High | 8.1 | 2021-08-08 | An issue was discovered in the ruspiro-singleton crate before 0.4.1 for Rust. In Singleton, Send and Sync do not have bounds checks. |
CVE-2020-36434 | Critical | 9.8 | 2021-08-08 | An issue was discovered in the sys-info crate before 0.8.0 for Rust. sys_info::disk_info calls can trigger a double free. |
CVE-2020-36433 | High | 7.5 | 2021-08-08 | An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement. |
CVE-2020-36432 | Critical | 9.8 | 2021-08-08 | An issue was discovered in the alg_ds crate through 2020-08-25 for Rust. There is a drop of uninitialized memory in Matrix::new(). |
CVE-2020-28088 | Critical | 9.8 | 2021-08-06 | An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code. |
CVE-2020-28087 | High | 7.5 | 2021-08-06 | A SQL injection vulnerability in /jeecg boot/sys/dict/loadtreedata of jeecg-boot CMS 2.3 allows attackers to access sensitive database information. |
CVE-2020-21358 | Medium | 6.5 | 2021-08-06 | A cross site request forgery (CSRF) in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users. |
CVE-2020-21357 | Medium | 6.1 | 2021-08-06 | A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2020-21356 | Medium | 5.3 | 2021-08-06 | An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host when 'name = "file" is deleted during file… |
CVE-2020-21353 | Medium | 5.4 | 2021-08-06 | A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2020-18694 | High | 8.8 | 2021-08-06 | Cross Site Request Forgery (CSRF) in IgnitedCMS v1.0 allows remote attackers to obtain sensitive information and gain privilege via the component "/admin/profi… |
CVE-2020-18693 | Medium | 5.4 | 2021-08-06 | Cross Site Scripting (XSS) in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Title' field of the com… |
CVE-2020-22330 | Medium | 6.1 | 2021-08-06 | Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page. |
CVE-2020-22392 | Medium | 5.4 | 2021-08-05 | Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file. |
CVE-2020-7863 | High | 8.8 | 2021-08-05 | A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulner… |
CVE-2020-22732 | Medium | 4.8 | 2021-08-05 | CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker.. |
CVE-2020-24829 | Medium | 5.5 | 2021-08-04 | An issue was discovered in GPAC from v0.5.2 to v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_section_complete in media… |
CVE-2020-22352 | Medium | 5.5 | 2021-08-04 | The gf_dash_segmenter_probe_input function in GPAC v0.8 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4B… |
CVE-2020-29011 | High | 8.8 | 2021-08-04 | Instances of SQL Injection vulnerabilities in the checksum search and MTA-quarantine modules of FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may a… |
CVE-2020-24827 | Medium | 5.5 | 2021-08-04 | A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via… |
CVE-2020-24826 | Medium | 5.5 | 2021-08-04 | A vulnerability in the elf::section::as_strtab function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a… |
CVE-2020-24825 | Medium | 5.5 | 2021-08-04 | A vulnerability in the line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a… |
CVE-2020-24824 | Medium | 5.5 | 2021-08-04 | A global buffer overflow issue in the dwarf::line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS). |
CVE-2020-24823 | Medium | 5.5 | 2021-08-04 | A vulnerability in the dwarf::to_string function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafte… |
CVE-2020-24822 | Medium | 5.5 | 2021-08-04 | A vulnerability in the dwarf::cursor::uleb function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a cra… |
CVE-2020-24821 | Medium | 5.5 | 2021-08-04 | A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via… |
CVE-2020-4707 | Medium | 5.4 | 2021-08-04 | IBM API Connect 5.0.0.0 through 5.0.8.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2020-19305 | Critical | 9.8 | 2021-08-03 | An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attacke… |
CVE-2020-19304 | High | 7.5 | 2021-08-03 | An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive informa… |
CVE-2020-19303 | High | 7.8 | 2021-08-03 | An arbitrary file upload vulnerability in /fileupload.php of hdcms 5.7 allows attackers to execute arbitrary code via a crafted file. |
CVE-2020-19302 | Critical | 9.8 | 2021-08-03 | An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing uploaded file suffixes… |
CVE-2020-19301 | Critical | 9.8 | 2021-08-03 | A vulnerability in the vae_admin_rule database table of vaeThink v1.0.1 allows attackers to execute arbitrary code via a crafted payload in the condition param… |
CVE-2020-26806 | High | 8.8 | 2021-07-31 | admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath… |
CVE-2020-26565 | High | 7.5 | 2021-07-31 | ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sens… |
CVE-2020-26564 | Medium | 6.5 | 2021-07-31 | ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey templa… |
CVE-2020-26563 | Medium | 6.1 | 2021-07-30 | ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if inpu… |
CVE-2020-22765 | Medium | 6.1 | 2021-07-30 | Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module. |
CVE-2020-22761 | High | 8.8 | 2021-07-30 | Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php. |
CVE-2020-21854 | Medium | 6.1 | 2021-07-30 | Cross Site Scripting vulnerabiity exists in WDScanner 1.1 in the system management page. |
CVE-2020-21809 | Critical | 9.8 | 2021-07-30 | SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameter… |
CVE-2020-21808 | Critical | 9.8 | 2021-07-30 | SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php. |
CVE-2020-21806 | Critical | 9.8 | 2021-07-30 | SQL Injection Vulnerability in ECTouch v2 via the shop page in index.php.. |
CVE-2020-20701 | Medium | 4.8 | 2021-07-30 | A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payl… |
CVE-2020-20700 | Medium | 4.8 | 2021-07-30 | A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-20699 | Medium | 4.8 | 2021-07-30 | A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the C… |
CVE-2020-20698 | High | 7.2 | 2021-07-30 | A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file. |
CVE-2020-19118 | Medium | 5.4 | 2021-07-30 | Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html. |
CVE-2020-18175 | Critical | 9.8 | 2021-07-30 | SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php. |