2020 CVEs (page 24)
Page 24 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-18158 | Medium | 5.4 | 2021-07-30 | Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php. |
CVE-2020-18157 | High | 8.8 | 2021-07-30 | Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php. |
CVE-2020-18013 | Critical | 9.8 | 2021-07-30 | SQL Injextion vulnerability exists in Whatsns 4.0 via the ip parameter in index.php?admin_banned/add.htm. |
CVE-2020-16839 | High | 7.5 | 2021-07-30 | On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSo… |
CVE-2020-15948 | Medium | 6.1 | 2021-07-30 | eGain Chat 15.5.5 allows XSS via the Name (aka full_name) field. |
CVE-2020-14999 | High | 7.5 | 2021-07-30 | A logic bug in system monitoring driver of Acronis Agent after 12.5.21540 and before 12.5.23094 allowed to bypass Windows memory protection and access sensitiv… |
CVE-2020-11511 | High | 8.1 | 2021-07-30 | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher… |
CVE-2020-10590 | High | 7.5 | 2021-07-30 | Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with ne… |
CVE-2020-5353 | High | 8.8 | 2021-07-29 | The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access… |
CVE-2020-5329 | Medium | 6.1 | 2021-07-29 | Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect application users… |
CVE-2020-36239 | Critical | 9.8 | 2021-07-29 | Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Ji… |
CVE-2020-5004 | Medium | 5.4 | 2021-07-28 | IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2020-4974 | Medium | 6.3 | 2021-07-28 | IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from… |
CVE-2020-5351 | High | 7.5 | 2021-07-28 | Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded passwor… |
CVE-2020-5341 | Critical | 9.8 | 2021-07-28 | Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protectio… |
CVE-2020-26180 | Medium | 6.3 | 2021-07-28 | Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport use… |
CVE-2020-18430 | High | 7.5 | 2021-07-26 | tinyexr 0.9.5 was discovered to contain an array index error in the tinyexr::DecodeEXRImage component, which can lead to a denial of service (DOS). |
CVE-2020-18428 | High | 7.5 | 2021-07-26 | tinyexr commit 0.9.5 was discovered to contain an array index error in the tinyexr::SaveEXR component, which can lead to a denial of service (DOS). |
CVE-2020-23243 | Medium | 4.8 | 2021-07-26 | Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" feature. |
CVE-2020-23242 | Medium | 4.8 | 2021-07-26 | Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature. |
CVE-2020-23241 | Medium | 4.8 | 2021-07-26 | Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature. |
CVE-2020-23240 | Medium | 4.8 | 2021-07-26 | Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature. |
CVE-2020-23239 | Medium | 4.8 | 2021-07-26 | Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature. |
CVE-2020-23238 | Medium | 5.4 | 2021-07-26 | Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature. |
CVE-2020-23234 | Medium | 4.8 | 2021-07-26 | Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "… |
CVE-2020-18174 | Critical | 9.8 | 2021-07-26 | A process injection vulnerability in setup.exe of AutoHotkey 1.1.32.00 allows attackers to escalate privileges. |
CVE-2020-18173 | High | 7.8 | 2021-07-26 | A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code. |
CVE-2020-18172 | Critical | 9.8 | 2021-07-26 | A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate privileges. |
CVE-2020-18171 | High | 8.8 | 2021-07-26 | TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges… |
CVE-2020-18170 | Critical | 9.8 | 2021-07-26 | An issue in the SeChangeNotifyPrivilege component of Abloy Key Manager Version 7.14301.0.0 allows attackers to escalate privileges via a change in permissions. |
CVE-2020-18169 | High | 7.8 | 2021-07-26 | A vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate privileges. NOTE: Exploit of the Snagit… |
CVE-2020-17952 | Critical | 9.8 | 2021-07-26 | A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code. |
CVE-2020-4623 | Medium | 6.5 | 2021-07-26 | IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a… |
CVE-2020-12681 | High | 7.5 | 2021-07-26 | Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by which door lock po… |
CVE-2020-20741 | Critical | 9.8 | 2021-07-23 | Incorrect Access Control in Beckhoff Automation GmbH & Co. KG CX9020 with firmware version CX9020_CB3011_WEC7_HPS_v602_TC31_B4016.6 allows remote attackers to… |
CVE-2020-14032 | Critical | 9.8 | 2021-07-23 | ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege escalation via code execution in the SMM. |
CVE-2020-22284 | High | 7.5 | 2021-07-22 | A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version and version 2.1.2 allows attackers to acce… |
CVE-2020-22283 | High | 7.5 | 2021-07-22 | A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation lwIP version git head allows attackers t… |
CVE-2020-7390 | Medium | 4.6 | 2021-07-22 | Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address"… |
CVE-2020-7389 | Medium | 5.5 | 2021-07-22 | Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web app… |
CVE-2020-7388 | Critical | 10.0 | 2021-07-22 | Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can b… |
CVE-2020-7387 | Medium | 5.3 | 2021-07-22 | Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directo… |
CVE-2020-36033 | Critical | 9.8 | 2021-07-22 | SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the id parameter to edituser.php. |
CVE-2020-5370 | High | 7.9 | 2021-07-22 | Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability. A remote authenticated malicious user with high p… |
CVE-2020-5316 | High | 7.8 | 2021-07-22 | Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2… |
CVE-2020-19499 | High | 8.8 | 2021-07-21 | An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact… |
CVE-2020-19498 | High | 8.8 | 2021-07-21 | Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts. |
CVE-2020-19497 | High | 8.8 | 2021-07-21 | Integer overflow vulnerability in Mat_VarReadNextInfo5 in mat5.c in tbeu matio (aka MAT File I/O Library) 1.5.17, allows attackers to cause a Denial of Service… |
CVE-2020-19492 | High | 7.8 | 2021-07-21 | There is a floating point exception in ReadImage that leads to a Segmentation fault in sam2p 0.49.4. A crafted input will lead to a denial of service or possib… |
CVE-2020-19491 | High | 7.8 | 2021-07-21 | There is an invalid memory access bug in cgif.c that leads to a Segmentation fault in sam2p 0.49.4. A crafted input will lead to a denial of service or possibl… |
CVE-2020-19490 | Medium | 5.5 | 2021-07-21 | tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code. |
CVE-2020-19488 | Medium | 5.5 | 2021-07-21 | An issue was discovered in box_code_apple.c:119 in Gpac MP4Box 0.8.0, allows attackers to cause a Denial of Service due to an invalid read on function ilst_ite… |
CVE-2020-19481 | Medium | 5.5 | 2021-07-21 | An issue was discovered in GPAC before 0.8.0, as demonstrated by MP4Box. It contains an invalid memory read in gf_m2ts_process_pmt in media_tools/mpegts.c that… |
CVE-2020-19475 | Medium | 5.5 | 2021-07-21 | An issue has been found in function CCITTFaxStream::lookChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid write of siz… |
CVE-2020-19474 | Medium | 5.5 | 2021-07-21 | An issue has been found in function Gfx::doShowText in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an Use After Free . |
CVE-2020-19473 | Medium | 5.5 | 2021-07-21 | An issue has been found in function DCTStream::decodeImage in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an uncaught floating poin… |
CVE-2020-19472 | Medium | 5.5 | 2021-07-21 | An issue has been found in function DCTStream::readHuffSym in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid read of size 2… |
CVE-2020-19471 | Medium | 5.5 | 2021-07-21 | An issue has been found in function DCTStream::decodeImage in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid read of size 4… |
CVE-2020-19470 | Medium | 5.5 | 2021-07-21 | An issue has been found in function DCTStream::getChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a NULL pointer dereference (i… |
CVE-2020-19469 | Medium | 5.5 | 2021-07-21 | An issue has been found in function DCTStream::reset in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid write of size 8 . |
CVE-2020-19468 | Medium | 5.5 | 2021-07-21 | An issue has been found in function EmbedStream::getChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a null pointer derefenrece… |
CVE-2020-19467 | Medium | 5.5 | 2021-07-21 | An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an Illegal Use Afte… |
CVE-2020-19466 | Medium | 5.5 | 2021-07-21 | An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid read of… |
CVE-2020-19465 | Medium | 5.5 | 2021-07-21 | An issue has been found in function ObjectStream::getObject in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid read of size… |
CVE-2020-19464 | Medium | 5.5 | 2021-07-21 | An issue has been found in function XRef::fetch in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow . |
CVE-2020-19463 | Medium | 5.5 | 2021-07-21 | An issue has been found in function vfprintf in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow. |
CVE-2020-22150 | Medium | 6.1 | 2021-07-21 | A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2020-22148 | Medium | 6.1 | 2021-07-21 | A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2020-23283 | High | 7.5 | 2021-07-21 | Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute f… |
CVE-2020-23282 | High | 7.5 | 2021-07-21 | SQL injection in Logon Page in MV's mConnect application, v02.001.00, allows an attacker to use a non existing user with a generic password to connect to the a… |
CVE-2020-21937 | Critical | 9.8 | 2021-07-21 | An command injection vulnerability in HNAP1/SetWLanApcliSettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute arbitrar… |
CVE-2020-21936 | Medium | 5.3 | 2021-07-21 | An issue in HNAP1/GetMultipleHNAPs of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to access the components GetStationSettings, GetW… |
CVE-2020-21935 | Critical | 9.8 | 2021-07-21 | A command injection vulnerability in HNAP1/GetNetworkTomographySettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute a… |
CVE-2020-21934 | High | 7.5 | 2021-07-21 | An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where authentication to download the Syslog could be bypassed. |
CVE-2020-21933 | High | 7.5 | 2021-07-21 | An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where the admin password and private key could be found in the log tar packag… |
CVE-2020-21932 | Medium | 5.3 | 2021-07-21 | A vulnerability in /Login.html of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to bypass login and obtain a partially authorized tok… |
CVE-2020-20262 | Medium | 6.5 | 2021-07-21 | Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /ram/pckg/security/nova/bin/ipsec process. An authenticated… |
CVE-2020-20221 | Medium | 6.5 | 2021-07-21 | Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticate… |
CVE-2020-20219 | Medium | 6.5 | 2021-07-21 | Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/igmp-proxy process. An authenticated remote attacker… |
CVE-2020-19609 | Medium | 5.5 | 2021-07-21 | Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_colormap() function when parsing TIFF files allowing attackers to cause a denial… |
CVE-2020-23284 | High | 7.5 | 2021-07-20 | Information disclosure in aspx pages in MV's IDCE application v1.0 allows an attacker to copy and paste aspx pages in the end of the URL application that conne… |
CVE-2020-25206 | High | 7.2 | 2021-07-20 | The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats… |
CVE-2020-25205 | Medium | 6.1 | 2021-07-20 | The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of /var/www/core/controller/index… |
CVE-2020-35427 | Critical | 9.8 | 2021-07-20 | SQL injection vulnerability in PHPGurukul Employee Record Management System 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentica… |
CVE-2020-15660 | High | 8.8 | 2021-07-20 | Missing checks on Content-Type headers in geckodriver before 0.27.0 could lead to a CSRF vulnerability, that might, when paired with a specifically prepared re… |
CVE-2020-7866 | High | 8.8 | 2021-07-20 | When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation |
CVE-2020-36431 | Medium | 5.5 | 2021-07-20 | Unicorn Engine 1.0.2 has an out-of-bounds write in helper_wfe_arm. |
CVE-2020-36430 | High | 7.8 | 2021-07-20 | libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is… |
CVE-2020-36429 | Medium | 5.5 | 2021-07-20 | Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth. |
CVE-2020-36428 | High | 8.8 | 2021-07-20 | matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4). |
CVE-2020-5349 | Critical | 9.8 | 2021-07-19 | Dell EMC Networking S4100 and S5200 Series Switches manufactured prior to February 2020 contain a hardcoded credential vulnerability. A remote unauthenticated… |
CVE-2020-5323 | Medium | 5.4 | 2021-07-19 | Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an injection vulnerabili… |
CVE-2020-5322 | Critical | 9.1 | 2021-07-19 | Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability. A remote authenticated malicious user with… |
CVE-2020-5321 | High | 7.6 | 2021-07-19 | Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an improper input valida… |
CVE-2020-5320 | Critical | 9.0 | 2021-07-19 | Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a SQL injection vulnerab… |
CVE-2020-5315 | High | 8.8 | 2021-07-19 | Dell EMC Repository Manager (DRM) version 3.2 contains a plain-text password storage vulnerability. Proxy server user password is stored in a plain text in a l… |
CVE-2020-29503 | Medium | 4.1 | 2021-07-19 | Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. A locally authenticated attacker could potentially exploit this vu… |
CVE-2020-29499 | Medium | 6.4 | 2021-07-19 | Dell EMC PowerStore versions prior to 1.0.3.0.5.006 contain an OS Command Injection vulnerability in PowerStore X environment . A locally authenticated attacke… |
CVE-2020-22741 | High | 7.5 | 2021-07-19 | An issue was discovered in Xuperchain 3.6.0 that allows for attackers to recover any arbitrary users' private key after obtaining the partial signature in mult… |
CVE-2020-20249 | Medium | 6.5 | 2021-07-19 | Mikrotik RouterOs before stable 6.47 suffers from a memory corruption vulnerability in the resolver process. By sending a crafted packet, an authenticated remo… |