2020 CVEs (page 26)
Page 26 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-25391 | Medium | 5.4 | 2021-07-09 | A cross site scripting vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New Pag… |
CVE-2020-29014 | Medium | 6.3 | 2021-07-09 | A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an au… |
CVE-2020-21333 | Medium | 5.4 | 2021-07-09 | Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case. |
CVE-2020-22535 | Medium | 6.5 | 2021-07-09 | Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update function in upgradecontroller.php. |
CVE-2020-23580 | Critical | 9.8 | 2021-07-08 | Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board. |
CVE-2020-20363 | Medium | 4.8 | 2021-07-08 | Crossi Site Scripting (XSS) vulnerability in PbootCMS 2.0.3 in admin.php. |
CVE-2020-18741 | Medium | 5.3 | 2021-07-08 | Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the "photoid%5B%5D" and "photodesc%5B%5D" pa… |
CVE-2020-20586 | Medium | 4.5 | 2021-07-08 | A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the adminis… |
CVE-2020-20585 | High | 7.5 | 2021-07-08 | A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information. |
CVE-2020-20584 | Medium | 6.1 | 2021-07-08 | A cross site scripting vulnerability in baigo CMS v4.0-beta-1 allows attackers to execute arbitrary web scripts or HTML via the form parameter post to /public/… |
CVE-2020-20583 | High | 7.5 | 2021-07-08 | A SQL injection vulnerability in /question.php of LJCMS Version v4.3.R60321 allows attackers to obtain sensitive database information. |
CVE-2020-20582 | High | 7.5 | 2021-07-08 | A server side request forgery (SSRF) vulnerability in /ApiAdminDomainSettings.php of MipCMS 5.0.1 allows attackers to access sensitive information. |
CVE-2020-28598 | High | 7.8 | 2021-07-08 | An out-of-bounds write vulnerability exists in the Admesh stl_fix_normal_directions() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b04… |
CVE-2020-20217 | Medium | 6.5 | 2021-07-08 | Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process. An authenticated re… |
CVE-2020-23702 | Medium | 4.8 | 2021-07-07 | Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php. |
CVE-2020-23700 | Medium | 4.8 | 2021-07-07 | Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature. |
CVE-2020-25925 | Medium | 6.1 | 2021-07-07 | Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML via the "p4" field. |
CVE-2020-25868 | High | 7.5 | 2021-07-07 | Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup. An unauthenticated remote attacker can trigger a software abort (tem… |
CVE-2020-24149 | High | 7.5 | 2021-07-07 | Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter i… |
CVE-2020-24148 | Critical | 9.1 | 2021-07-07 | Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml acti… |
CVE-2020-24147 | Critical | 9.1 | 2021-07-07 | Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field. |
CVE-2020-24146 | High | 8.1 | 2021-07-07 | Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possi… |
CVE-2020-24145 | Medium | 6.1 | 2021-07-07 | Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbi… |
CVE-2020-24144 | High | 8.6 | 2021-07-07 | Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outs… |
CVE-2020-24143 | High | 7.5 | 2021-07-07 | Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored ou… |
CVE-2020-24142 | Critical | 9.8 | 2021-07-07 | Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the… |
CVE-2020-24141 | Medium | 5.3 | 2021-07-07 | Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerab… |
CVE-2020-24038 | Medium | 6.5 | 2021-07-07 | myFax version 229 logs sensitive information in the export log module which allows any user to access critical information. |
CVE-2020-20225 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process. An authenticated remote attacker can… |
CVE-2020-20216 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/graphing process. An authenticated remote attacker ca… |
CVE-2020-20215 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can c… |
CVE-2020-20213 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process. An authenticated remote attacker can cau… |
CVE-2020-20212 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/console process. An authenticated remote attacker can… |
CVE-2020-20211 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an assertion failure vulnerability in the /nova/bin/console process. An authenticated remote attacker ca… |
CVE-2020-23697 | Medium | 5.4 | 2021-07-06 | Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php. |
CVE-2020-22251 | Medium | 4.8 | 2021-07-06 | Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin. |
CVE-2020-22249 | Critical | 9.8 | 2021-07-06 | Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious p… |
CVE-2020-26763 | High | 7.5 | 2021-07-05 | The Rocket.Chat desktop application 2.17.11 opens external links without user interaction. |
CVE-2020-36416 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36415 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36414 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36413 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36412 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36411 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36410 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36409 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36408 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36399 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2020-36398 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2020-36397 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary… |
CVE-2020-36396 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web… |
CVE-2020-36395 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web s… |
CVE-2020-23194 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbi… |
CVE-2020-23192 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a craf… |
CVE-2020-23190 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web script… |
CVE-2020-23185 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbit… |
CVE-2020-23184 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute… |
CVE-2020-23182 | Medium | 5.4 | 2021-07-02 | The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites v… |
CVE-2020-23181 | Medium | 5.4 | 2021-07-02 | A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web… |
CVE-2020-23179 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary… |
CVE-2020-23178 | Medium | 5.4 | 2021-07-02 | An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack a… |
CVE-2020-23219 | High | 8.8 | 2021-07-01 | Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module. |
CVE-2020-23217 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23214 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23209 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23208 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23207 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23205 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload… |
CVE-2020-4935 | Medium | 5.4 | 2021-07-01 | IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2020-4902 | High | 8.8 | 2021-07-01 | IBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, whi… |
CVE-2020-27362 | High | 8.8 | 2021-07-01 | An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web configuration file e… |
CVE-2020-27361 | High | 7.5 | 2021-07-01 | An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirectories. |
CVE-2020-9158 | High | 7.5 | 2021-07-01 | There is a Missing Cryptographic Step vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause DoS of Samgr. |
CVE-2020-36407 | High | 8.8 | 2021-07-01 | libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid. |
CVE-2020-36406 | High | 8.8 | 2021-07-01 | uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll). NOTE: the vendor's… |
CVE-2020-36405 | High | 7.8 | 2021-07-01 | Keystone Engine 0.9.2 has a use-after-free in llvm_ks::X86Operand::getToken. |
CVE-2020-36404 | High | 7.8 | 2021-07-01 | Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl. |
CVE-2020-36403 | High | 8.8 | 2021-07-01 | HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read). |
CVE-2020-36402 | High | 7.8 | 2021-07-01 | Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver. NOTE: c39a5e2b7a3fabbf687f53a2823fc087be6c1a7e is cited in the… |
CVE-2020-36401 | High | 7.8 | 2021-07-01 | mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free). |
CVE-2020-36400 | Critical | 9.8 | 2021-07-01 | ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235. |
CVE-2020-36196 | Medium | 6.1 | 2021-07-01 | A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious cod… |
CVE-2020-36194 | Medium | 6.1 | 2021-07-01 | An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code… |
CVE-2020-18066 | Medium | 6.1 | 2021-06-29 | Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment. |
CVE-2020-21394 | High | 8.8 | 2021-06-29 | SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDatabackup.php. |
CVE-2020-7870 | Medium | 6.4 | 2021-06-29 | A memory corruption vulnerability exists when ezPDF improperly handles the parameter. This vulnerability exists due to insufficient validation of the parameter. |
CVE-2020-7869 | Critical | 9.0 | 2021-06-29 | An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary file. The ZOOK viewe… |
CVE-2020-7868 | Critical | 9.6 | 2021-06-29 | A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecutionExA function used f… |
CVE-2020-7871 | High | 7.5 | 2021-06-29 | A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of th… |
CVE-2020-21142 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi. |
CVE-2020-22609 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php. |
CVE-2020-22608 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php. |
CVE-2020-22607 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/Permissiontempla… |
CVE-2020-20640 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity encoding to bypass th… |
CVE-2020-23715 | High | 8.6 | 2021-06-28 | Directory Traversal vulnerability in Webport CMS 1.19.10.17121 via the file parameter to file/download. |
CVE-2020-23711 | Critical | 9.8 | 2021-06-28 | SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php. |
CVE-2020-23710 | Medium | 5.4 | 2021-06-28 | Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature. |
CVE-2020-28200 | Medium | 4.3 | 2021-06-28 | The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the re… |
CVE-2020-15303 | Medium | 6.5 | 2021-06-28 | Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564. |
CVE-2020-4610 | High | 7.8 | 2021-06-25 | IBM Security Secret Server (IBM Security Verify Privilege Manager 10.8.2 ) could allow a local user to execute code due to improper integrity checks. IBM X-For… |