2020 CVEs (page 28)
Page 28 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-12983 | High | 7.8 | 2021-06-11 | An out of bounds write vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privileges or denial of service. |
CVE-2020-12982 | High | 7.8 | 2021-06-11 | An invalid object pointer free vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service. |
CVE-2020-12981 | High | 7.8 | 2021-06-11 | An insufficient input validation in the AMD Graphics Driver for Windows 10 may allow unprivileged users to unload the driver, potentially causing memory corrup… |
CVE-2020-12980 | High | 7.8 | 2021-06-11 | An out of bounds write and read vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service. |
CVE-2020-7860 | High | 7.8 | 2021-06-11 | UnEGG v0.5 and eariler versions have a Integer overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by UnEGG. Att… |
CVE-2020-13663 | High | 8.8 | 2021-06-11 | Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other… |
CVE-2020-5003 | Critical | 9.1 | 2021-06-11 | IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploi… |
CVE-2020-13688 | Medium | 6.1 | 2021-06-11 | Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the… |
CVE-2020-23323 | Critical | 9.8 | 2021-06-10 | There is a heap-buffer-overflow at re-parser.c in re_parse_char_escape in JerryScript 2.2.0. |
CVE-2020-23322 | High | 7.5 | 2021-06-10 | There is an Assertion in 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' in parse… |
CVE-2020-23321 | Critical | 9.8 | 2021-06-10 | There is a heap-buffer-overflow at lit-strings.c:431 in lit_read_code_unit_from_utf8 in JerryScript 2.2.0. |
CVE-2020-23320 | High | 7.5 | 2021-06-10 | There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' in parser_parse_function_arguments in JerryScript 2.2.0. |
CVE-2020-23319 | High | 7.5 | 2021-06-10 | There is an Assertion in '(flags >> CBC_STACK_ADJUST_SHIFT) >= CBC_STACK_ADJUST_BASE || (CBC_STACK_ADJUST_BASE - (flags >> CBC_STACK_ADJUST_SHIFT)) <= context_… |
CVE-2020-23314 | High | 7.5 | 2021-06-10 | There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in JerryScript 2.2.0. |
CVE-2020-23313 | High | 7.5 | 2021-06-10 | There is an Assertion 'scope_stack_p > context_p->scope_stack_p' failed at js-scanner-util.c:2510 in scanner_literal_is_created in JerryScript 2.2.0 |
CVE-2020-23312 | High | 7.5 | 2021-06-10 | There is an Assertion 'context.status_flags & PARSER_SCANNING_SUCCESSFUL' failed at js-parser.c:2185 in parser_parse_source in JerryScript 2.2.0. |
CVE-2020-23311 | High | 7.5 | 2021-06-10 | There is an Assertion 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER_COMMA' failed at j… |
CVE-2020-23310 | High | 7.5 | 2021-06-10 | There is an Assertion 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at js-parser-statm.c:733 in parser_parse_function_statement in Jer… |
CVE-2020-23309 | High | 7.5 | 2021-06-10 | There is an Assertion 'context_p->stack_depth == context_p->context_stack_depth' failed at js-parser-statm.c:2756 in parser_parse_statements in JerryScript 2.2… |
CVE-2020-23308 | High | 7.5 | 2021-06-10 | There is an Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScript 2.2.0. |
CVE-2020-23306 | Critical | 9.8 | 2021-06-10 | There is a stack-overflow at ecma-regexp-object.c:535 in ecma_regexp_match in JerryScript 2.2.0. |
CVE-2020-23303 | Critical | 9.8 | 2021-06-10 | There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem_pools_collect_empty in JerryScript 2.2.0. |
CVE-2020-23302 | Critical | 9.8 | 2021-06-10 | There is a heap-use-after-free at ecma-helpers-string.c:772 in ecma_ref_ecma_string in JerryScript 2.2.0 |
CVE-2020-25467 | Medium | 5.5 | 2021-06-10 | A null pointer dereference was discovered lzo_decompress_buf in stream.c in Irzip 0.621 which allows an attacker to cause a denial of service (DOS) via a craft… |
CVE-2020-24671 | High | 8.8 | 2021-06-10 | Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03. |
CVE-2020-24668 | Medium | 5.4 | 2021-06-10 | Trace Financial Crest Bridge <6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03. |
CVE-2020-24667 | High | 8.8 | 2021-06-10 | Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03. |
CVE-2020-24663 | Medium | 5.4 | 2021-06-10 | Trace Financial CRESTBridge <6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03. |
CVE-2020-24662 | Medium | 5.4 | 2021-06-10 | SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) <3.1.0 allows XSS. This was fixed in TLM RP 3.1.0. |
CVE-2020-35452 | High | 7.3 | 2021-06-10 | Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow… |
CVE-2020-13950 | High | 7.5 | 2021-06-10 | Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-… |
CVE-2020-13938 | Medium | 5.5 | 2021-06-10 | Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows |
CVE-2020-24489 | High | 8.8 | 2021-06-09 | Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2020-24475 | Medium | 5.5 | 2021-06-09 | Improper initialization in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authe… |
CVE-2020-24474 | High | 8.0 | 2021-06-09 | Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated… |
CVE-2020-24473 | High | 7.8 | 2021-06-09 | Out of bounds write in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authentic… |
CVE-2020-8704 | Medium | 6.4 | 2021-06-09 | Race condition in a subsystem in the Intel(R) LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via loca… |
CVE-2020-8703 | Medium | 6.7 | 2021-06-09 | Improper buffer restrictions in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and… |
CVE-2020-8702 | High | 7.3 | 2021-06-09 | Uncontrolled search path element in the Intel(R) Processor Diagnostic Tool before version 4.1.5.37 may allow an authenticated user to potentially enable escala… |
CVE-2020-8700 | Medium | 6.7 | 2021-06-09 | Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acce… |
CVE-2020-8670 | Medium | 6.4 | 2021-06-09 | Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2020-27383 | High | 7.8 | 2021-06-09 | Battle.net.exe in Battle.Net 1.27.1.12428 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the exis… |
CVE-2020-24516 | Medium | 6.8 | 2021-06-09 | Modification of assumed-immutable data in subsystem in Intel(R) CSME versions before 13.0.47, 13.30.17, 14.1.53, 14.5.32, 15.0.22 may allow an unauthenticated… |
CVE-2020-24515 | Medium | 6.8 | 2021-06-09 | Protection mechanism failure in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical ac… |
CVE-2020-24514 | Medium | 6.8 | 2021-06-09 | Improper authentication in some Intel(R) RealSense(TM) IDs may allow an unauthenticated user to potentially enable escalation of privilege via physical access. |
CVE-2020-24513 | Medium | 6.5 | 2021-06-09 | Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure v… |
CVE-2020-24512 | Low | 3.3 | 2021-06-09 | Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2020-24511 | Medium | 6.5 | 2021-06-09 | Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local acces… |
CVE-2020-24509 | Medium | 6.7 | 2021-06-09 | Insufficient control flow management in subsystem in Intel(R) SPS versions before SPS_E3_05.01.04.300.0, SPS_SoC-A_05.00.03.091.0, SPS_E5_04.04.04.023.0, or SP… |
CVE-2020-24507 | Medium | 4.4 | 2021-06-09 | Improper initialization in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11… |
CVE-2020-24506 | Medium | 4.4 | 2021-06-09 | Out of bound read in a subsystem in the Intel(R) CSME versions before 12.0.81, 13.0.47, 13.30.17, 14.1.53 and 14.5.32 may allow a privileged user to potentiall… |
CVE-2020-24486 | Medium | 5.5 | 2021-06-09 | Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2020-12360 | High | 7.8 | 2021-06-09 | Out of bounds read in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2020-12359 | Medium | 6.8 | 2021-06-09 | Insufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable escalation of privile… |
CVE-2020-12358 | Medium | 4.4 | 2021-06-09 | Out of bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access. |
CVE-2020-12357 | Medium | 6.7 | 2021-06-09 | Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2020-12296 | Medium | 5.5 | 2021-06-09 | Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via loca… |
CVE-2020-12295 | Medium | 5.5 | 2021-06-09 | Improper input validation in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2020-12294 | Medium | 5.5 | 2021-06-09 | Insufficient control flow management in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via l… |
CVE-2020-12293 | Medium | 5.5 | 2021-06-09 | Improper control of a resource through its lifetime in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial o… |
CVE-2020-12292 | Medium | 5.5 | 2021-06-09 | Improper conditions check in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2020-12291 | Medium | 5.5 | 2021-06-09 | Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via loca… |
CVE-2020-12290 | Medium | 5.5 | 2021-06-09 | Improper access control in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2020-12289 | Medium | 5.5 | 2021-06-09 | Out-of-bounds write in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2020-12288 | Medium | 5.5 | 2021-06-09 | Protection mechanism failure in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local acc… |
CVE-2020-15387 | High | 7.4 | 2021-06-09 | The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h, v8.2.1c, v8.2.2, v9.0.0, and Brocade SANnav before v2.1.1 utilize keys of less than… |
CVE-2020-15386 | Medium | 5.3 | 2021-06-09 | Brocade Fabric OS prior to v9.0.1a and 8.2.3a and after v9.0.0 and 8.2.2d may observe high CPU load during security scanning, which could lead to a slower resp… |
CVE-2020-15385 | Medium | 5.4 | 2021-06-09 | Brocade SANnav before version 2.1.1 allows an authenticated attacker to list directories, and list files without permission. As a result, users without permiss… |
CVE-2020-15384 | Medium | 5.3 | 2021-06-09 | Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial log… |
CVE-2020-15380 | High | 7.5 | 2021-06-09 | Brocade SANnav before version 2.1.1 logs account credentials at the ‘trace’ logging level. |
CVE-2020-15379 | High | 7.5 | 2021-06-09 | Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of user-suppl… |
CVE-2020-15378 | Medium | 5.3 | 2021-06-09 | The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the pote… |
CVE-2020-15377 | Critical | 9.8 | 2021-06-09 | Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly re… |
CVE-2020-27384 | High | 7.8 | 2021-06-09 | The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to mo… |
CVE-2020-15383 | High | 7.5 | 2021-06-09 | Running security scans against the SAN switch can cause config and secnotify processes within the firmware before Brocade Fabric OS v9.0.0, v8.2.2d and v8.2.1e… |
CVE-2020-15382 | High | 7.2 | 2021-06-09 | Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at i… |
CVE-2020-15381 | High | 7.5 | 2021-06-09 | Brocade SANnav before version 2.1.1 contains an Improper Authentication vulnerability that allows cleartext transmission of authentication credentials of the j… |
CVE-2020-11306 | High | 7.8 | 2021-06-09 | Possible integer overflow in RPMB counter due to lack of length check on user provided data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sn… |
CVE-2020-11304 | High | 7.8 | 2021-06-09 | Possible out of bound read in DRM due to improper buffer length check. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT… |
CVE-2020-11298 | High | 7.8 | 2021-06-09 | While waiting for a response to a callback or listener request, non-secure clients can change permissions to shared memory buffers used by HLOS Invoke Call to… |
CVE-2020-11292 | High | 7.8 | 2021-06-09 | Possible buffer overflow in voice service due to lack of input validation of parameters in QMI Voice API in Snapdragon Auto, Snapdragon Compute, Snapdragon Con… |
CVE-2020-11291 | Critical | 9.8 | 2021-06-09 | Possible buffer overflow while updating ikev2 parameters for delete payloads received during informational exchange due to lack of check of input validation fo… |
CVE-2020-11267 | High | 8.4 | 2021-06-09 | Stack out-of-bounds write occurs while setting up a cipher device if the provided IV length exceeds the max limit value in Snapdragon Auto, Snapdragon Compute… |
CVE-2020-11176 | Critical | 9.8 | 2021-06-09 | While processing server certificate from IPSec server, certificate validation for subject alternative name API can cause heap overflow which can lead to memory… |
CVE-2020-11266 | Medium | 6.5 | 2021-06-09 | Image address is dereferenced before validating its range which can cause potential QSEE information leakage in Snapdragon Wired Infrastructure and Networking |
CVE-2020-11265 | Medium | 5.5 | 2021-06-09 | Information disclosure issue due to lack of validation of pointer arguments passed to TZ BSP in Snapdragon Wired Infrastructure and Networking |
CVE-2020-11262 | High | 7.0 | 2021-06-09 | A race between command submission and destroying the context can cause an invalid context being added to the list leads to use after free issue. in Snapdragon… |
CVE-2020-11261 | High | 7.8 | 2021-06-09 | Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute… |
CVE-2020-11260 | High | 8.4 | 2021-06-09 | An improper free of uninitialized memory can occur in DIAG services in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile |
CVE-2020-11259 | High | 8.8 | 2021-06-09 | Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking |
CVE-2020-11258 | High | 8.8 | 2021-06-09 | Memory corruption due to lack of validation of pointer arguments passed to Trustzone BSP in Snapdragon Wired Infrastructure and Networking |
CVE-2020-11257 | High | 8.8 | 2021-06-09 | Memory corruption due to lack of validation of pointer arguments passed to TrustZone BSP in Snapdragon Wired Infrastructure and Networking |
CVE-2020-11256 | High | 8.8 | 2021-06-09 | Memory corruption due to lack of check of validation of pointer to buffer passed to trustzone in Snapdragon Wired Infrastructure and Networking |
CVE-2020-11250 | High | 7.0 | 2021-06-09 | Use after free due to race condition when reopening the device driver repeatedly in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Co… |
CVE-2020-11241 | High | 7.5 | 2021-06-09 | Out of bound read will happen if EAPOL Key length is less than expected while processing NAN shared key descriptor attribute in Snapdragon Auto, Snapdragon Com… |
CVE-2020-11240 | High | 7.8 | 2021-06-09 | Memory corruption due to ioctl command size was incorrectly set to the size of a pointer and not enough storage is allocated for the copy of the user argument… |
CVE-2020-11239 | High | 7.8 | 2021-06-09 | Use after free issue when importing a DMA buffer by using the CPU address of the buffer due to attachment is not cleaned up properly in Snapdragon Auto, Snapdr… |
CVE-2020-11238 | High | 7.5 | 2021-06-09 | Possible Buffer over-read in ARP/NS parsing due to lack of check of packet length received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2020-11235 | High | 7.8 | 2021-06-09 | Buffer overflow might occur while parsing unified command due to lack of check of input data received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec… |
CVE-2020-11233 | High | 7.0 | 2021-06-09 | Time-of-check time-of-use race condition While processing partition entries due to newly created buffer was read again from mmc without validation in Snapdrago… |