2020 CVEs (page 25)
Page 25 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-20248 | Medium | 6.5 | 2021-07-19 | Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process. An authenticated remote attacker can cause a Den… |
CVE-2020-36427 | Medium | 5.5 | 2021-07-19 | GNOME gThumb before 3.10.1 allows an application crash via a malformed JPEG image. |
CVE-2020-36426 | High | 7.5 | 2021-07-19 | An issue was discovered in Arm Mbed TLS before 2.24.0. mbedtls_x509_crl_parse_der has a buffer over-read (of one byte). |
CVE-2020-36425 | Medium | 5.3 | 2021-07-19 | An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a C… |
CVE-2020-36424 | Medium | 4.7 | 2021-07-19 | An issue was discovered in Arm Mbed TLS before 2.24.0. An attacker can recover a private key (for RSA or static Diffie-Hellman) via a side-channel attack again… |
CVE-2020-36423 | High | 7.5 | 2021-07-19 | An issue was discovered in Arm Mbed TLS before 2.23.0. A remote attacker can recover plaintext because a certain Lucky 13 countermeasure doesn't properly consi… |
CVE-2020-36422 | Medium | 5.3 | 2021-07-19 | An issue was discovered in Arm Mbed TLS before 2.23.0. A side channel allows recovery of an ECC private key, related to mbedtls_ecp_check_pub_priv, mbedtls_pk_… |
CVE-2020-36421 | Medium | 5.3 | 2021-07-19 | An issue was discovered in Arm Mbed TLS before 2.23.0. Because of a side channel in modular exponentiation, an RSA private key used in a secure enclave could b… |
CVE-2020-22650 | High | 7.5 | 2021-07-19 | A memory leak vulnerability in sim-organizer.c of AlienVault Ossim v5 causes a denial of service (DOS) via a system crash triggered by the occurrence of a larg… |
CVE-2020-20230 | Medium | 6.5 | 2021-07-19 | Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. An authenticated remote attacker can cause a Denial… |
CVE-2020-5031 | Medium | 5.4 | 2021-07-19 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4980 | Medium | 6.5 | 2021-07-16 | IBM QRadar SIEM 7.3 and 7.4 uses less secure methods for protecting data in transit between hosts when encrypt host connections is not enabled as well as data… |
CVE-2020-4821 | Critical | 9.8 | 2021-07-16 | IBM InfoSphere Data Replication 11.4 and IBM InfoSphere Change Data Capture for z/OS 10.2.1, under certain configurations, could allow a user to bypass authent… |
CVE-2020-4675 | Medium | 6.5 | 2021-07-16 | IBM InfoSphere Master Data Management Server 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2020-23707 | Medium | 6.5 | 2021-07-15 | A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_progressive() at ok_jpg.c:1054 of ok-file-formats through 2020-06-26 allows atta… |
CVE-2020-23706 | Medium | 6.5 | 2021-07-15 | A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_subsequent_scan() ok_jpg.c:1102 of ok-file-formats through 2020-06-26 allows att… |
CVE-2020-23705 | Medium | 6.5 | 2021-07-15 | A global buffer overflow vulnerability in jfif_encode at jfif.c:701 of ffjpeg through 2020-06-22 allows attackers to cause a Denial of Service (DOS) via a craf… |
CVE-2020-11634 | High | 7.8 | 2021-07-15 | The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may… |
CVE-2020-11632 | High | 7.8 | 2021-07-15 | The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileg… |
CVE-2020-11633 | Critical | 9.8 | 2021-07-15 | The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would p… |
CVE-2020-12734 | High | 8.1 | 2021-07-15 | DEPSTECH WiFi Digital Microscope 3 allows remote attackers to change the SSID and password, and demand a ransom payment from the rightful device owner, because… |
CVE-2020-12733 | High | 7.5 | 2021-07-15 | Certain Shenzhen PENGLIXIN components on DEPSTECH WiFi Digital Microscope 3, as used by Shekar Endoscope, allow a TELNET connection with the molinkadmin passwo… |
CVE-2020-12732 | Medium | 6.5 | 2021-07-15 | DEPSTECH WiFi Digital Microscope 3 has a default SSID of Jetion_xxxxxxxx with a password of 12345678. |
CVE-2020-25736 | High | 7.8 | 2021-07-15 | Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configuration. |
CVE-2020-25593 | Medium | 6.7 | 2021-07-15 | Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions. |
CVE-2020-15495 | High | 7.8 | 2021-07-15 | Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service configuration. |
CVE-2020-12731 | High | 7.5 | 2021-07-15 | The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, whence it can be read by other application… |
CVE-2020-12730 | Medium | 5.3 | 2021-07-15 | MagicMotion Flamingo 2 lacks BLE encryption, enabling data sniffing and packet forgery. |
CVE-2020-12729 | Medium | 4.6 | 2021-07-15 | MagicMotion Flamingo 2 has a lack of access control for reading from device descriptors. |
CVE-2020-15496 | High | 7.8 | 2021-07-15 | Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions. |
CVE-2020-36420 | High | 7.5 | 2021-07-15 | Polipo through 1.1.1, when NDEBUG is omitted, allows denial of service via a reachable assertion during parsing of a malformed Range header. NOTE: This vulnera… |
CVE-2020-24133 | Critical | 9.8 | 2021-07-14 | A heap buffer overflow vulnerability in the r_asm_swf_disass function of Radare2-extras before commit e74a93c allows attackers to execute arbitrary code or car… |
CVE-2020-29157 | High | 7.8 | 2021-07-14 | An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted. |
CVE-2020-18155 | Critical | 9.8 | 2021-07-14 | SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection. |
CVE-2020-18151 | Medium | 6.5 | 2021-07-14 | Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account. |
CVE-2020-18145 | Medium | 6.1 | 2021-07-14 | Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php. |
CVE-2020-29147 | High | 7.5 | 2021-07-14 | A SQL injection vulnerability in wy_controlls/wy_side_visitor.php of Wayang-CMS v1.0 allows attackers to obtain sensitive database information. |
CVE-2020-29146 | Medium | 6.1 | 2021-07-14 | A cross site scripting (XSS) vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload… |
CVE-2020-18144 | Critical | 9.8 | 2021-07-14 | SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php. |
CVE-2020-27379 | Medium | 6.5 | 2021-07-14 | Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the r… |
CVE-2020-25445 | High | 7.8 | 2021-07-14 | The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not bei… |
CVE-2020-25444 | Medium | 5.4 | 2021-07-14 | Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) "About Yourself” section under the “My Profil… |
CVE-2020-20231 | Medium | 6.5 | 2021-07-14 | Mikrotik RouterOs through stable version 6.48.3 suffers from a memory corruption vulnerability in the /nova/bin/detnet process. An authenticated remote attacke… |
CVE-2020-0417 | High | 7.8 | 2021-07-14 | In setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due to an empty mutable PendingIntent. This could lead to local esc… |
CVE-2020-19722 | Medium | 6.5 | 2021-07-13 | An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a direct copy to NULL pointer dereference, leading to a denial of service… |
CVE-2020-19721 | Medium | 6.5 | 2021-07-13 | A heap buffer overflow vulnerability in Ap4TrunAtom.cpp of Bento 1.5.1-628 may lead to an out-of-bounds write while running mp42aac, leading to system crashes… |
CVE-2020-19720 | Medium | 6.5 | 2021-07-13 | An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS). |
CVE-2020-19719 | Medium | 6.5 | 2021-07-13 | A buffer overflow vulnerability in Ap4ElstAtom.cpp of Bento 1.5.1-628 leads to a denial of service (DOS). |
CVE-2020-19718 | Medium | 6.5 | 2021-07-13 | An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS). |
CVE-2020-19717 | Medium | 6.5 | 2021-07-13 | An unhandled memory allocation failure in Core/Ap48bdlAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS). |
CVE-2020-19716 | Medium | 6.5 | 2021-07-13 | A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS). |
CVE-2020-20252 | Medium | 6.5 | 2021-07-13 | Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker… |
CVE-2020-22907 | High | 7.5 | 2021-07-13 | Stack overflow vulnerability in function jsi_evalcode_sub in jsish before 3.0.18, allows remote attackers to cause a Denial of Service via a crafted value to t… |
CVE-2020-22886 | High | 7.5 | 2021-07-13 | Buffer overflow vulnerability in function jsG_markobject in jsgc.c in mujs before 1.0.8, allows remote attackers to cause a denial of service. |
CVE-2020-22885 | High | 7.5 | 2021-07-13 | Buffer overflow vulnerability in mujs before 1.0.8 due to recursion in the GC scanning phase, allows remote attackers to cause a denial of service. |
CVE-2020-22884 | Critical | 9.8 | 2021-07-13 | Buffer overflow vulnerability in function jsvGetStringChars in Espruino before RELEASE_2V09, allows remote attackers to execute arbitrary code. |
CVE-2020-22882 | High | 7.5 | 2021-07-13 | Issue was discovered in the fxParserTree function in moddable, allows attackers to cause denial of service via a crafted payload. Fixed in commit 723816ab9b52f… |
CVE-2020-22876 | High | 7.5 | 2021-07-13 | Buffer Overflow vulnerability in quickjs.c in QuickJS, allows remote attackers to cause denial of service. This issue is resolved in the 2020-07-05 release. |
CVE-2020-22875 | Critical | 9.8 | 2021-07-13 | Integer overflow vulnerability in function Jsi_ObjSetLength in jsish before 3.0.6, allows remote attackers to execute arbitrary code. |
CVE-2020-22874 | Critical | 9.8 | 2021-07-13 | Integer overflow vulnerability in function Jsi_ObjArraySizer in jsish before 3.0.8, allows remote attackers to execute arbitrary code. |
CVE-2020-22873 | Critical | 9.8 | 2021-07-13 | Buffer overflow vulnerability in function NumberToPrecisionCmd in jsish before 3.0.7, allows remote attackers to execute arbitrary code. |
CVE-2020-20250 | Medium | 6.5 | 2021-07-13 | Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker… |
CVE-2020-28400 | High | 7.5 | 2021-07-13 | Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be triggered i… |
CVE-2020-26153 | Medium | 6.1 | 2021-07-13 | A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in t… |
CVE-2020-11307 | Critical | 9.8 | 2021-07-13 | Buffer overflow in modem due to improper array index check before copying into it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon C… |
CVE-2020-19907 | High | 8.8 | 2021-07-12 | A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command or service. |
CVE-2020-18544 | Critical | 9.8 | 2021-07-12 | SQL Injection in WMS v1.0 allows remote attackers to execute arbitrary code via the "username" parameter in the component "chkuser.php". |
CVE-2020-23079 | High | 7.5 | 2021-07-12 | SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet. |
CVE-2020-19038 | Critical | 9.1 | 2021-07-12 | File Deletion vulnerability in Halo 0.4.3 via delBackup. |
CVE-2020-19037 | Medium | 5.3 | 2021-07-12 | Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies. |
CVE-2020-18982 | Medium | 5.4 | 2021-07-12 | Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl. |
CVE-2020-4938 | High | 8.8 | 2021-07-12 | IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitte… |
CVE-2020-19204 | Medium | 5.4 | 2021-07-12 | An authenticated Stored Cross-Site Scriptiong (XSS) vulnerability exists in Lightning Wire Labs IPFire 2.21 (x86_64) - Core Update 130 in the "routing.cgi" Rou… |
CVE-2020-19203 | Medium | 5.4 | 2021-07-12 | An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on v… |
CVE-2020-19201 | Medium | 5.4 | 2021-07-12 | A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4… |
CVE-2020-18980 | Critical | 9.8 | 2021-07-12 | Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters. |
CVE-2020-18979 | Medium | 6.1 | 2021-07-12 | Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter. |
CVE-2020-7872 | High | 7.8 | 2021-07-12 | DaviewIndy v8.98.7.0 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed format file that is mishandled by Da… |
CVE-2020-21133 | Critical | 9.8 | 2021-07-12 | SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid. |
CVE-2020-21132 | Critical | 9.8 | 2021-07-12 | SQL Injection vulnerability in Metinfo 7.0.0beta in index.php. |
CVE-2020-21131 | High | 7.2 | 2021-07-12 | SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language&c=language_web&a=doAddLanguage. |
CVE-2020-35987 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web s… |
CVE-2020-35986 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary… |
CVE-2020-35985 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Global Lists" feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web sc… |
CVE-2020-35984 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web sc… |
CVE-2020-25879 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Manage Users' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scr… |
CVE-2020-25878 | Medium | 4.8 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Admin-Tools' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute arbitrary web sc… |
CVE-2020-25877 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Add Page' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute arbitrary web scrip… |
CVE-2020-25876 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Pages' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or… |
CVE-2020-25875 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in the 'Smileys' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts… |
CVE-2020-25394 | Medium | 5.4 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in moziloCMS 2.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2020-25392 | Medium | 5.4 | 2021-07-09 | A cross site scripting (XSS) vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'N… |
CVE-2020-25391 | Medium | 5.4 | 2021-07-09 | A cross site scripting vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New Pag… |
CVE-2020-29014 | Medium | 6.3 | 2021-07-09 | A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an au… |
CVE-2020-21333 | Medium | 5.4 | 2021-07-09 | Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case. |
CVE-2020-22535 | Medium | 6.5 | 2021-07-09 | Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update function in upgradecontroller.php. |
CVE-2020-23580 | Critical | 9.8 | 2021-07-08 | Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board. |
CVE-2020-20363 | Medium | 4.8 | 2021-07-08 | Crossi Site Scripting (XSS) vulnerability in PbootCMS 2.0.3 in admin.php. |
CVE-2020-18741 | Medium | 5.3 | 2021-07-08 | Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the "photoid%5B%5D" and "photodesc%5B%5D" pa… |
CVE-2020-20586 | Medium | 4.5 | 2021-07-08 | A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the adminis… |