2020 CVEs (page 29)
Page 29 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11182 | Critical | 9.8 | 2021-06-09 | Possible heap overflow while parsing NAL header due to lack of check of length of data received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2020-11178 | High | 7.8 | 2021-06-09 | Trusted APPS to overwrite the CPZ memory of another use-case as TZ only checks the physical address not overlapping with its memory and its RoT memory in Snapd… |
CVE-2020-11165 | High | 7.8 | 2021-06-09 | Memory corruption due to buffer overflow while copying the message provided by HLOS into buffer without validating the length of buffer in Snapdragon Auto, Sna… |
CVE-2020-11161 | High | 7.1 | 2021-06-09 | Out-of-bounds memory access can occur while calculating alignment requirements for a negative width from external components in Snapdragon Auto, Snapdragon Com… |
CVE-2020-11160 | Medium | 6.7 | 2021-06-09 | Resource leakage issue during dci client registration due to reference count is not decremented if dci client registration fails in Snapdragon Auto, Snapdragon… |
CVE-2020-11159 | Critical | 9.1 | 2021-06-09 | Buffer over-read can happen while processing WPA,RSN IE of beacon and response frames if IE length is less than length of frame pointer being accessed in Snapd… |
CVE-2020-11134 | Critical | 9.8 | 2021-06-09 | Possible stack out of bound write might happen due to time bitmap length and bit duration fields of the attributes like NAN ranging setup attribute inside a NA… |
CVE-2020-11126 | Critical | 9.1 | 2021-06-09 | Possible out of bound read while WLAN frame parsing due to lack of check for body and header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti… |
CVE-2020-26136 | Medium | 6.5 | 2021-06-08 | In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication. |
CVE-2020-28713 | Medium | 6.5 | 2021-06-08 | Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notification events via… |
CVE-2020-26138 | Medium | 5.3 | 2021-06-08 | In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation. |
CVE-2020-25817 | Medium | 4.8 | 2021-06-08 | SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to… |
CVE-2020-26517 | Medium | 4.8 | 2021-06-08 | A cross-site scripting (XSS) issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. It is possible to perform XSS attacks through using the WebD… |
CVE-2020-26516 | High | 8.8 | 2021-06-08 | A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. Requests sent to the server that trigger actions do not contain a CSRF token and c… |
CVE-2020-26515 | High | 7.5 | 2021-06-08 | An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the a… |
CVE-2020-25716 | High | 8.1 | 2021-06-07 | A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific… |
CVE-2020-1750 | Medium | 6.5 | 2021-06-07 | A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An att… |
CVE-2020-36387 | High | 7.8 | 2021-06-07 | An issue was discovered in the Linux kernel before 5.8.2. fs/io_uring.c has a use-after-free related to io_async_task_func and ctx reference holding, aka CID-6… |
CVE-2020-36386 | High | 7.1 | 2021-06-07 | An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-5… |
CVE-2020-1742 | High | 7.0 | 2021-06-07 | An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could us… |
CVE-2020-1690 | Medium | 6.5 | 2021-06-07 | An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege esc… |
CVE-2020-18268 | Medium | 6.1 | 2021-06-07 | Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/… |
CVE-2020-18265 | High | 8.8 | 2021-06-07 | Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/a… |
CVE-2020-18264 | High | 8.8 | 2021-06-07 | Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/a… |
CVE-2020-1719 | Medium | 5.4 | 2021-06-07 | A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from… |
CVE-2020-5008 | Medium | 5.3 | 2021-06-07 | IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to inf… |
CVE-2020-36385 | High | 7.8 | 2021-06-07 | An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in som… |
CVE-2020-36384 | Medium | 6.1 | 2021-06-07 | PageLayer before 1.3.5 allows reflected XSS via color settings. |
CVE-2020-36383 | Medium | 6.1 | 2021-06-07 | PageLayer before 1.3.5 allows reflected XSS via the font-size parameter. |
CVE-2020-26885 | Medium | 6.1 | 2021-06-07 | An issue was discovered in 2sic 2sxc before 11.22. A XSS vulnerability in the sxcver parameter of dnn/ui.html allows an attacker to craft a malicious URL that… |
CVE-2020-29324 | High | 7.5 | 2021-06-04 | The DLink Router DIR-895L MFC v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthentica… |
CVE-2020-29323 | High | 7.5 | 2021-06-04 | The D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an un… |
CVE-2020-29322 | High | 7.5 | 2021-06-04 | The D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated att… |
CVE-2020-29321 | High | 7.5 | 2021-06-04 | The D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated att… |
CVE-2020-36142 | Medium | 6.5 | 2021-06-04 | BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter. |
CVE-2020-36141 | High | 8.8 | 2021-06-04 | BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header. |
CVE-2020-36140 | Medium | 6.5 | 2021-06-04 | BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change an… |
CVE-2020-36139 | Medium | 5.4 | 2021-06-04 | BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting (XSS) vulnerability by inserting a XSS payload within the 'fileurl' parameter. |
CVE-2020-27302 | High | 8.0 | 2021-06-04 | A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "memcpy" function, when an attacker in Wi-… |
CVE-2020-27301 | High | 8.0 | 2021-06-04 | A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "AES_UnWRAP" function, when an attacker in… |
CVE-2020-7469 | High | 7.5 | 2021-06-04 | In FreeBSD 12.2-STABLE before r367402, 11.4-STABLE before r368202, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 the handler for a… |
CVE-2020-36382 | High | 7.5 | 2021-06-04 | OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data… |
CVE-2020-15077 | Medium | 5.3 | 2021-06-04 | OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with… |
CVE-2020-36009 | High | 7.5 | 2021-06-03 | OBottle 2.0 in \c\g.php contains an arbitrary file download vulnerability. |
CVE-2020-36008 | High | 8.1 | 2021-06-03 | OBottle 2.0 in \c\t.php contains an arbitrary file write vulnerability. |
CVE-2020-36007 | Medium | 6.1 | 2021-06-03 | AppCMS 2.0.101 in /admin/template/tpl_app.php has a cross site scripting attack vulnerability which allows the attacker to obtain sensitive information of othe… |
CVE-2020-36006 | Medium | 6.5 | 2021-06-03 | AppCMS 2.0.101 in /admin/info.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site. |
CVE-2020-36005 | Medium | 6.5 | 2021-06-03 | AppCMS 2.0.101 in /admin/app.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site. |
CVE-2020-36004 | Medium | 6.5 | 2021-06-03 | AppCMS 2.0.101 in /admin/download_frame.php has a SQL injection vulnerability which allows attackers to obtain sensitive database information. |
CVE-2020-35973 | Medium | 5.4 | 2021-06-03 | An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php. |
CVE-2020-35972 | Medium | 4.3 | 2021-06-03 | An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html. |
CVE-2020-35971 | Medium | 5.4 | 2021-06-03 | A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_manage/user… |
CVE-2020-35970 | High | 7.5 | 2021-06-03 | An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read. |
CVE-2020-28469 | Medium | 5.3 | 2021-06-03 | This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. |
CVE-2020-21005 | Medium | 6.5 | 2021-06-03 | WellCMS 2.0 beta3 is vulnerable to File Upload. A user can log in to the CMS background and upload a picture. Because the upload file type is controllable, the… |
CVE-2020-21003 | Medium | 4.8 | 2021-06-03 | Pbootcms v2.0.3 is vulnerable to Cross Site Scripting (XSS) via admin.php. |
CVE-2020-35442 | Critical | 9.8 | 2021-06-02 | FDCMS (also known as Fangfa Content Management System) 4.0 allows remote attackers to get a webshell in the background via Front/lib/Action/FindexAction.class… |
CVE-2020-35441 | Critical | 9.8 | 2021-06-02 | FDCMS (aka Fangfa Content Management System) 4.0 contains a front-end SQL injection via Admin/Lib/Action/FloginAction.class.php. |
CVE-2020-5030 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4977 | Medium | 5.4 | 2021-06-02 | IBM Engineering Lifecycle Optimization - Publishing is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2020-4732 | Medium | 6.5 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions. IBM X-… |
CVE-2020-4495 | High | 8.8 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a… |
CVE-2020-22056 | Medium | 6.5 | 2021-06-02 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the config_input function in af_acrossover.c. |
CVE-2020-22054 | Medium | 6.5 | 2021-06-02 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_dict_set function in dict.c. |
CVE-2020-25362 | High | 7.5 | 2021-06-02 | The id paramater in Online Shopping Alphaware 1.0 has been discovered to be vulnerable to an Error-Based blind SQL injection in the /alphaware/details.php path… |
CVE-2020-24862 | High | 7.5 | 2021-06-02 | The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via the /medical/inventor… |
CVE-2020-22051 | Medium | 6.5 | 2021-06-02 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the filter_frame function in vf_tile.c. |
CVE-2020-6950 | Medium | 6.5 | 2021-06-02 | Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. |
CVE-2020-27661 | Medium | 6.5 | 2021-06-02 | A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU. A malicious guest could use… |
CVE-2020-24870 | High | 8.8 | 2021-06-02 | Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp. |
CVE-2020-22049 | Medium | 6.5 | 2021-06-02 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c. |
CVE-2020-22048 | Medium | 6.5 | 2021-06-02 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_frame_pool_get function in framepool.c. |
CVE-2020-22046 | Medium | 6.5 | 2021-06-02 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in libavutil/float_dsp.c. |
CVE-2020-35514 | High | 7.0 | 2021-06-02 | An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container wh… |
CVE-2020-35510 | Medium | 5.9 | 2021-06-02 | A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by… |
CVE-2020-35503 | Medium | 6.0 | 2021-06-02 | A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. This issue occurs i… |
CVE-2020-14388 | Medium | 6.3 | 2021-06-02 | A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows… |
CVE-2020-14380 | High | 7.5 | 2021-06-02 | An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication to the relevant external authentication s… |
CVE-2020-14371 | Medium | 6.5 | 2021-06-02 | A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are running on these resou… |
CVE-2020-14340 | Medium | 5.9 | 2021-06-02 | A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It… |
CVE-2020-14336 | Medium | 6.5 | 2021-06-02 | A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allows an attacker to ca… |
CVE-2020-14335 | Medium | 5.5 | 2021-06-02 | A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attack… |
CVE-2020-14326 | High | 7.5 | 2021-06-02 | A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CP… |
CVE-2020-14317 | Medium | 5.5 | 2021-06-02 | It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - Continuous Delivery… |
CVE-2020-10771 | High | 7.1 | 2021-06-02 | A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an… |
CVE-2020-6641 | Medium | 4.3 | 2021-06-02 | Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain… |
CVE-2020-10743 | Medium | 4.3 | 2021-06-02 | It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate… |
CVE-2020-10742 | Medium | 6.0 | 2021-06-02 | A flaw was found in the Linux kernel. An index buffer overflow during Direct IO write leading to the NFS client to crash. In some cases, a reach out of the ind… |
CVE-2020-22044 | Medium | 6.5 | 2021-06-01 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the url_open_dyn_buf_internal function in libavformat/aviobuf.c. |
CVE-2020-22043 | Medium | 6.5 | 2021-06-01 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifo_alloc_common function in libavutil/fifo.c. |
CVE-2020-22042 | Medium | 6.5 | 2021-06-01 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link_filter_inouts function in libavfilter/graph… |
CVE-2020-22041 | Medium | 6.5 | 2021-06-01 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_buffersrc_add_frame_flags function in buffersrc. |
CVE-2020-22040 | Medium | 6.5 | 2021-06-01 | A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v_frame_alloc function in frame.c. |
CVE-2020-22039 | Medium | 6.5 | 2021-06-01 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function. |
CVE-2020-22038 | Medium | 6.5 | 2021-06-01 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c. |
CVE-2020-22037 | Medium | 6.5 | 2021-06-01 | A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c. |
CVE-2020-22036 | High | 8.8 | 2021-06-01 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_intra at libavfilter/vf_bwdif.c, which might lead to memory corruption and other pote… |
CVE-2020-22035 | High | 8.8 | 2021-06-01 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get_block_row at libavfilter/vf_bm3d.c, which might lead to memory corruption and other pote… |
CVE-2020-27377 | Medium | 4.8 | 2021-06-01 | A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an att… |
CVE-2020-26693 | Medium | 5.4 | 2021-06-01 | A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts vi… |