2020 CVEs (page 26)
Page 26 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-20585 | High | 7.5 | 2021-07-08 | A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information. |
CVE-2020-20584 | Medium | 6.1 | 2021-07-08 | A cross site scripting vulnerability in baigo CMS v4.0-beta-1 allows attackers to execute arbitrary web scripts or HTML via the form parameter post to /public/… |
CVE-2020-20583 | High | 7.5 | 2021-07-08 | A SQL injection vulnerability in /question.php of LJCMS Version v4.3.R60321 allows attackers to obtain sensitive database information. |
CVE-2020-20582 | High | 7.5 | 2021-07-08 | A server side request forgery (SSRF) vulnerability in /ApiAdminDomainSettings.php of MipCMS 5.0.1 allows attackers to access sensitive information. |
CVE-2020-28598 | High | 7.8 | 2021-07-08 | An out-of-bounds write vulnerability exists in the Admesh stl_fix_normal_directions() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b04… |
CVE-2020-20217 | Medium | 6.5 | 2021-07-08 | Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process. An authenticated re… |
CVE-2020-23702 | Medium | 4.8 | 2021-07-07 | Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php. |
CVE-2020-23700 | Medium | 4.8 | 2021-07-07 | Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature. |
CVE-2020-25925 | Medium | 6.1 | 2021-07-07 | Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML via the "p4" field. |
CVE-2020-25868 | High | 7.5 | 2021-07-07 | Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup. An unauthenticated remote attacker can trigger a software abort (tem… |
CVE-2020-24149 | High | 7.5 | 2021-07-07 | Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter i… |
CVE-2020-24148 | Critical | 9.1 | 2021-07-07 | Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml acti… |
CVE-2020-24147 | Critical | 9.1 | 2021-07-07 | Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field. |
CVE-2020-24146 | High | 8.1 | 2021-07-07 | Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possi… |
CVE-2020-24145 | Medium | 6.1 | 2021-07-07 | Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbi… |
CVE-2020-24144 | High | 8.6 | 2021-07-07 | Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outs… |
CVE-2020-24143 | High | 7.5 | 2021-07-07 | Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored ou… |
CVE-2020-24142 | Critical | 9.8 | 2021-07-07 | Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the… |
CVE-2020-24141 | Medium | 5.3 | 2021-07-07 | Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerab… |
CVE-2020-24038 | Medium | 6.5 | 2021-07-07 | myFax version 229 logs sensitive information in the export log module which allows any user to access critical information. |
CVE-2020-20225 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process. An authenticated remote attacker can… |
CVE-2020-20216 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/graphing process. An authenticated remote attacker ca… |
CVE-2020-20215 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can c… |
CVE-2020-20213 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process. An authenticated remote attacker can cau… |
CVE-2020-20212 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/console process. An authenticated remote attacker can… |
CVE-2020-20211 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an assertion failure vulnerability in the /nova/bin/console process. An authenticated remote attacker ca… |
CVE-2020-23697 | Medium | 5.4 | 2021-07-06 | Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php. |
CVE-2020-22251 | Medium | 4.8 | 2021-07-06 | Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin. |
CVE-2020-22249 | Critical | 9.8 | 2021-07-06 | Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious p… |
CVE-2020-26763 | High | 7.5 | 2021-07-05 | The Rocket.Chat desktop application 2.17.11 opens external links without user interaction. |
CVE-2020-36416 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36415 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36414 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36413 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36412 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36411 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36410 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36409 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36408 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36399 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2020-36398 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2020-36397 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary… |
CVE-2020-36396 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web… |
CVE-2020-36395 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web s… |
CVE-2020-23194 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbi… |
CVE-2020-23192 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a craf… |
CVE-2020-23190 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web script… |
CVE-2020-23185 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbit… |
CVE-2020-23184 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute… |
CVE-2020-23182 | Medium | 5.4 | 2021-07-02 | The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites v… |
CVE-2020-23181 | Medium | 5.4 | 2021-07-02 | A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web… |
CVE-2020-23179 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary… |
CVE-2020-23178 | Medium | 5.4 | 2021-07-02 | An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack a… |
CVE-2020-23219 | High | 8.8 | 2021-07-01 | Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module. |
CVE-2020-23217 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23214 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23209 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23208 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23207 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23205 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload… |
CVE-2020-4935 | Medium | 5.4 | 2021-07-01 | IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2020-4902 | High | 8.8 | 2021-07-01 | IBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, whi… |
CVE-2020-27362 | High | 8.8 | 2021-07-01 | An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web configuration file e… |
CVE-2020-27361 | High | 7.5 | 2021-07-01 | An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirectories. |
CVE-2020-9158 | High | 7.5 | 2021-07-01 | There is a Missing Cryptographic Step vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause DoS of Samgr. |
CVE-2020-36407 | High | 8.8 | 2021-07-01 | libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid. |
CVE-2020-36406 | High | 8.8 | 2021-07-01 | uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll). NOTE: the vendor's… |
CVE-2020-36405 | High | 7.8 | 2021-07-01 | Keystone Engine 0.9.2 has a use-after-free in llvm_ks::X86Operand::getToken. |
CVE-2020-36404 | High | 7.8 | 2021-07-01 | Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl. |
CVE-2020-36403 | High | 8.8 | 2021-07-01 | HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read). |
CVE-2020-36402 | High | 7.8 | 2021-07-01 | Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver. NOTE: c39a5e2b7a3fabbf687f53a2823fc087be6c1a7e is cited in the… |
CVE-2020-36401 | High | 7.8 | 2021-07-01 | mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free). |
CVE-2020-36400 | Critical | 9.8 | 2021-07-01 | ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235. |
CVE-2020-36196 | Medium | 6.1 | 2021-07-01 | A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious cod… |
CVE-2020-36194 | Medium | 6.1 | 2021-07-01 | An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code… |
CVE-2020-18066 | Medium | 6.1 | 2021-06-29 | Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment. |
CVE-2020-21394 | High | 8.8 | 2021-06-29 | SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDatabackup.php. |
CVE-2020-7870 | Medium | 6.4 | 2021-06-29 | A memory corruption vulnerability exists when ezPDF improperly handles the parameter. This vulnerability exists due to insufficient validation of the parameter. |
CVE-2020-7869 | Critical | 9.0 | 2021-06-29 | An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary file. The ZOOK viewe… |
CVE-2020-7868 | Critical | 9.6 | 2021-06-29 | A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecutionExA function used f… |
CVE-2020-7871 | High | 7.5 | 2021-06-29 | A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of th… |
CVE-2020-21142 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi. |
CVE-2020-22609 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php. |
CVE-2020-22608 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php. |
CVE-2020-22607 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/Permissiontempla… |
CVE-2020-20640 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity encoding to bypass th… |
CVE-2020-23715 | High | 8.6 | 2021-06-28 | Directory Traversal vulnerability in Webport CMS 1.19.10.17121 via the file parameter to file/download. |
CVE-2020-23711 | Critical | 9.8 | 2021-06-28 | SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php. |
CVE-2020-23710 | Medium | 5.4 | 2021-06-28 | Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature. |
CVE-2020-28200 | Medium | 4.3 | 2021-06-28 | The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the re… |
CVE-2020-15303 | Medium | 6.5 | 2021-06-28 | Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564. |
CVE-2020-4610 | High | 7.8 | 2021-06-25 | IBM Security Secret Server (IBM Security Verify Privilege Manager 10.8.2 ) could allow a local user to execute code due to improper integrity checks. IBM X-For… |
CVE-2020-4609 | High | 7.8 | 2021-06-25 | IBM Security Sevret Server (IBM Security Verify Privilege Manager 10.8.2) is vulnerable to a buffer overflow, caused by improper bounds checking. A local attac… |
CVE-2020-26801 | Medium | 5.4 | 2021-06-25 | A stored cross-site scripting (XSS) vulnerability was discovered in /Forms/device_vars_1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vuln… |
CVE-2020-17759 | High | 8.8 | 2021-06-24 | An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the us… |
CVE-2020-17753 | Medium | 6.5 | 2021-06-24 | An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows attackers to transfer an arbitrary amount… |
CVE-2020-17752 | Critical | 9.8 | 2021-06-24 | Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonstrated by the smart contract implemented… |
CVE-2020-4945 | High | 8.1 | 2021-06-24 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to improper group perm… |
CVE-2020-4885 | Medium | 4.7 | 2021-06-24 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the configuration of Db2 due to a race con… |
CVE-2020-18671 | Medium | 5.4 | 2021-06-24 | Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php. |