2020 CVEs (page 27)
Page 27 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-18670 | Medium | 5.4 | 2021-06-24 | Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php. |
CVE-2020-18668 | Medium | 5.4 | 2021-06-24 | Cross Site Scripting (XSS) vulnerabililty in WebPort <=1.19.1 via the description parameter to script/listcalls. |
CVE-2020-18667 | Critical | 9.8 | 2021-06-24 | SQL Injection vulnerability in WebPort <=1.19.1 via the new connection, parameter name in type-conn. |
CVE-2020-21786 | Critical | 9.8 | 2021-06-24 | In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php. |
CVE-2020-21785 | High | 8.8 | 2021-06-24 | In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability. |
CVE-2020-21784 | Critical | 9.8 | 2021-06-24 | phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php. |
CVE-2020-21783 | Medium | 6.1 | 2021-06-24 | In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter. |
CVE-2020-18665 | Medium | 5.3 | 2021-06-24 | Directory Traversal vulnerability in WebPort <=1.19.1 in tags of system settings. |
CVE-2020-18664 | Medium | 5.4 | 2021-06-24 | Cross Site Scripting (XSS) vulnerability in WebPort <=1.19.1via the connection name parameter in type-conn. |
CVE-2020-18663 | Medium | 6.1 | 2021-06-24 | Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php. |
CVE-2020-18662 | Critical | 9.8 | 2021-06-24 | SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php. |
CVE-2020-21788 | Medium | 4.3 | 2021-06-24 | In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file /crmeb/app/admin/controller/store/CopyT… |
CVE-2020-21787 | Critical | 9.8 | 2021-06-24 | CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php. |
CVE-2020-18661 | Medium | 6.1 | 2021-06-24 | Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php. |
CVE-2020-28097 | Medium | 5.9 | 2021-06-24 | The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85. |
CVE-2020-7862 | High | 7.0 | 2021-06-24 | A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execute arbitrary commands This vulnerability… |
CVE-2020-18660 | Medium | 6.1 | 2021-06-23 | GetSimpleCMS <=3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter. |
CVE-2020-23962 | Medium | 6.1 | 2021-06-23 | A cross site scripting (XSS) vulnerability in Catfish CMS 4.9.90 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into t… |
CVE-2020-18659 | Medium | 6.1 | 2021-06-23 | Cross Site Scripting vulnerability in GetSimpleCMS <=3.3.15 via the (1) sitename, (2) username, and (3) email parameters to /admin/setup.php |
CVE-2020-18658 | Medium | 6.1 | 2021-06-23 | Cross Site Scriptiong (XSS) vulnerability in GetSimpleCMS <=3.3.15 via the timezone parameter to settings.php. |
CVE-2020-18657 | Medium | 6.1 | 2021-06-23 | Cross Site Scripting (XSS) vulnerability in GetSimpleCMS <= 3.3.15 in admin/changedata.php via the redirect_url parameter and the headers_sent function. |
CVE-2020-20392 | Critical | 9.8 | 2021-06-23 | SQL Injection vulnerability in imcat v5.2 via the fm[auser] parameters in coms/add_coms.php. |
CVE-2020-20391 | Medium | 5.4 | 2021-06-23 | Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippets. |
CVE-2020-20389 | Medium | 4.8 | 2021-06-23 | Cross Site Scripting (XSS) vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php. |
CVE-2020-36394 | High | 7.0 | 2021-06-22 | pam_setquota.c in the pam_setquota module before 2020-05-29 for Linux-PAM allows local attackers to set their quota on an arbitrary filesystem, in certain situ… |
CVE-2020-18654 | Medium | 6.1 | 2021-06-22 | Cross Site Scripting (XSS) in Wuzhi CMS v4.1.0 allows remote attackers to execute arbitrary code via the "Title" parameter in the component "/coreframe/app/gue… |
CVE-2020-22176 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a sensitive information disclosure vulnerability in multiple areas. Remote unauthenticated users can expl… |
CVE-2020-22175 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\admin\betweendates-detailsreports.php. Remote unauthenticated users… |
CVE-2020-22174 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\book-appointment.php. Remote unauthenticated users can exploit the… |
CVE-2020-22173 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\edit-profile.php. Remote unauthenticated users can exploit the vuln… |
CVE-2020-22172 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\get_doctor.php. Remote unauthenticated users can exploit the vulner… |
CVE-2020-22171 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\registration.php. Remote unauthenticated users can exploit the vuln… |
CVE-2020-22170 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\get_doctor.php. Remote unauthenticated users can exploit the vulner… |
CVE-2020-22169 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\appointment-history.php. Remote unauthenticated users can exploit t… |
CVE-2020-22168 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\change-emaild.php. Remote unauthenticated users can exploit the vul… |
CVE-2020-22167 | Medium | 5.4 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a Persistent Cross-Site Scripting vulnerability in \hms\admin\appointment-history.php. Remote registered… |
CVE-2020-22166 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\forgot-password.php. Remote unauthenticated users can exploit the v… |
CVE-2020-22165 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulner… |
CVE-2020-22164 | High | 7.5 | 2021-06-22 | PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\check_availability.php. Remote unauthenticated users can exploit th… |
CVE-2020-18648 | High | 8.8 | 2021-06-22 | Cross Site Request Forgery (CSRF) in JuQingCMS v1.0 allows remote attackers to gain local privileges via the component "JuQingCMS_v1.0/admin/index.php?c=admini… |
CVE-2020-18647 | High | 7.5 | 2021-06-22 | Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/nonecms/vendor". |
CVE-2020-18646 | High | 7.5 | 2021-06-22 | Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/public/index.php". |
CVE-2020-15732 | Medium | 6.5 | 2021-06-22 | Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attacker to potentially by… |
CVE-2020-27511 | High | 7.5 | 2021-06-21 | An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReD… |
CVE-2020-19511 | Medium | 6.1 | 2021-06-21 | Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes, |
CVE-2020-19510 | Critical | 9.8 | 2021-06-21 | Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php. |
CVE-2020-21130 | Medium | 6.1 | 2021-06-21 | Cross Site Scripting (XSS) vulnerability in HisiPHP 2.0.8 via the group name in addgroup.html. |
CVE-2020-22390 | High | 8.8 | 2021-06-21 | Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perf… |
CVE-2020-21517 | Medium | 6.1 | 2021-06-21 | Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php. |
CVE-2020-20474 | High | 7.5 | 2021-06-21 | White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the default_task_edituser.php files failing to filter the csa_to… |
CVE-2020-20473 | High | 7.5 | 2021-06-21 | White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the control_task.php, control_project.php, default_user.php file… |
CVE-2020-20472 | Medium | 5.3 | 2021-06-21 | White Shark System (WSS) 1.3.2 has a sensitive information disclosure vulnerability. The if_get_addbook.php file does not have an authentication operation. Rem… |
CVE-2020-20471 | High | 8.8 | 2021-06-21 | White Shark System (WSS) 1.3.2 has an unauthorized access vulnerability in default_user_edit.php, remote attackers can exploit this vulnerability to escalate t… |
CVE-2020-20470 | Medium | 5.3 | 2021-06-21 | White Shark System (WSS) 1.3.2 has web site physical path leakage vulnerability. |
CVE-2020-20469 | High | 7.5 | 2021-06-21 | White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the log_edit.php files failing to filter the csa_to_user paramet… |
CVE-2020-20468 | Medium | 6.5 | 2021-06-21 | White Shark System (WSS) 1.3.2 is vulnerable to CSRF. Attackers can use the user_edit_password.php file to modify the user password. |
CVE-2020-20467 | Medium | 6.5 | 2021-06-21 | White Shark System (WSS) 1.3.2 is vulnerable to sensitive information disclosure via default_task_add.php, remote attackers can exploit the vulnerability to cr… |
CVE-2020-20466 | Critical | 9.8 | 2021-06-21 | White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user_edit_password.php, remote attackers can modify the password of any user. |
CVE-2020-18442 | Low | 3.3 | 2021-06-18 | Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file". |
CVE-2020-36389 | Medium | 4.3 | 2021-06-17 | In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF. |
CVE-2020-36388 | High | 8.8 | 2021-06-17 | In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive. |
CVE-2020-35373 | Medium | 6.1 | 2021-06-17 | In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack. |
CVE-2020-19202 | Medium | 5.4 | 2021-06-17 | An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TITLE" parameter in IP… |
CVE-2020-25414 | Critical | 9.8 | 2021-06-17 | A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code. |
CVE-2020-25755 | High | 8.8 | 2021-06-16 | An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authen… |
CVE-2020-25754 | High | 7.5 | 2021-06-16 | An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authenti… |
CVE-2020-25753 | Critical | 9.8 | 2021-06-16 | An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. T… |
CVE-2020-25752 | Medium | 5.3 | 2021-06-16 | An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passw… |
CVE-2020-22212 | Critical | 9.8 | 2021-06-16 | SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php. |
CVE-2020-22211 | Critical | 9.8 | 2021-06-16 | SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php. |
CVE-2020-22210 | Critical | 9.8 | 2021-06-16 | SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php. |
CVE-2020-22209 | Critical | 9.8 | 2021-06-16 | SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php. |
CVE-2020-22208 | Critical | 9.8 | 2021-06-16 | SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php. |
CVE-2020-22206 | Critical | 9.8 | 2021-06-16 | SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php. |
CVE-2020-22205 | Critical | 9.8 | 2021-06-16 | SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php. |
CVE-2020-22204 | Critical | 9.8 | 2021-06-16 | SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php. . |
CVE-2020-22203 | Critical | 9.8 | 2021-06-16 | SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php. |
CVE-2020-22201 | High | 8.8 | 2021-06-16 | phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php. |
CVE-2020-22200 | Medium | 5.3 | 2021-06-16 | Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword. |
CVE-2020-22199 | Critical | 9.8 | 2021-06-16 | SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php. |
CVE-2020-35762 | Low | 2.7 | 2021-06-16 | bloofoxCMS 0.5.2.1 is infected with Path traversal in the 'fileurl' parameter that allows attackers to read local files. |
CVE-2020-35761 | Medium | 5.4 | 2021-06-16 | bloofoxCMS 0.5.2.1 is infected with XSS that allows remote attackers to execute arbitrary JS/HTML Code. |
CVE-2020-35760 | Critical | 9.8 | 2021-06-16 | bloofoxCMS 0.5.2.1 is infected with Unrestricted File Upload that allows attackers to upload malicious files (ex: php files). |
CVE-2020-35759 | Medium | 6.5 | 2021-06-16 | bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content (Locally/Remotely). |
CVE-2020-27339 | Medium | 6.7 | 2021-06-16 | In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt… |
CVE-2020-24939 | High | 7.5 | 2021-06-16 | Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the impleme… |
CVE-2020-22198 | Critical | 9.8 | 2021-06-16 | SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php. |
CVE-2020-20444 | High | 7.2 | 2021-06-16 | Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/view… |
CVE-2020-8300 | Medium | 6.5 | 2021-06-16 | Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access contr… |
CVE-2020-8299 | Medium | 6.5 | 2021-06-16 | Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Editio… |
CVE-2020-9493 | Critical | 9.8 | 2021-06-16 | A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution. |
CVE-2020-7864 | High | 7.8 | 2021-06-15 | Parameter manipulation can bypass authentication to cause file upload and execution. This will execute the remote code. This issue affects: Raonwiz DEXT5Editor… |
CVE-2020-5000 | Medium | 5.4 | 2021-06-15 | IBM Financial Transaction Manager 3.2.0 through 3.2.8 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2020-29215 | Medium | 5.4 | 2021-06-15 | A Cross Site Scripting in SourceCodester Employee Management System 1.0 allows the user to execute alert messages via /Employee Management System/addemp.php on… |
CVE-2020-29214 | Critical | 9.8 | 2021-06-15 | SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to bypass the authentication via admin/login.p… |
CVE-2020-21316 | Medium | 6.1 | 2021-06-15 | A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stole… |
CVE-2020-12988 | High | 7.5 | 2021-06-11 | A potential denial of service (DoS) vulnerability exists in the integrated chipset that may allow a malicious attacker to hang the system when it is rebooted. |
CVE-2020-12987 | Medium | 5.5 | 2021-06-11 | A heap information leak/kernel pool address disclosure vulnerability in the AMD Graphics Driver for Windows 10 may lead to KASLR bypass. |
CVE-2020-12986 | High | 7.8 | 2021-06-11 | An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows 10 may cause arbitrary code execution in the kernel, leading to escalat… |
CVE-2020-12985 | High | 7.8 | 2021-06-11 | An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service. |