2020 CVEs (page 3)
Page 3 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-37048 | High | 7.8 | 2026-02-01 | Iskysoft Application Framework Service 2.4.3.241 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code… |
CVE-2020-37047 | High | 7.8 | 2026-02-01 | Deep Instinct Windows Agent 1.2.29.0 contains an unquoted service path vulnerability in the DeepMgmtService that allows local users to potentially execute code… |
CVE-2020-37045 | High | 7.8 | 2026-02-01 | Veritas NetBackup 7.0 contains an unquoted service path vulnerability in the NetBackup INET Daemon service that allows local users to potentially execute arbit… |
CVE-2020-37037 | High | 7.8 | 2026-02-01 | Avast SecureLine 5.5.522.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges… |
CVE-2020-37057 | High | 8.2 | 2026-01-30 | Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries through the 'fid' pa… |
CVE-2020-37056 | Critical | 9.8 | 2026-01-30 | Crystal Shard http-protection 0.2.0 contains an IP spoofing vulnerability that allows attackers to bypass protection middleware by manipulating request headers… |
CVE-2020-37054 | Medium | 4.3 | 2026-01-30 | Navigate CMS 2.8.7 contains a cross-site request forgery vulnerability that allows attackers to upload malicious extensions through a crafted HTML page. Attack… |
CVE-2020-37053 | High | 7.1 | 2026-01-30 | Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' paramete… |
CVE-2020-37052 | Critical | 9.8 | 2026-01-30 | AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands t… |
CVE-2020-37051 | High | 8.2 | 2026-01-30 | Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attackers to extract database password hashes… |
CVE-2020-37050 | Critical | 9.8 | 2026-01-30 | Quick Player 1.3 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious .m3l file with carefully cons… |
CVE-2020-37049 | High | 8.4 | 2026-01-30 | Frigate 3.36.0.9 contains a local buffer overflow vulnerability in the Command Line input field that allows attackers to execute arbitrary code. Attackers can… |
CVE-2020-37046 | Medium | 5.3 | 2026-01-30 | Sistem Informasi Pengumuman Kelulusan Online 1.0 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized admin users thro… |
CVE-2020-37044 | Medium | 5.4 | 2026-01-30 | OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sen… |
CVE-2020-37043 | Critical | 9.8 | 2026-01-30 | 10-Strike Bandwidth Monitor 3.9 contains a buffer overflow vulnerability that allows attackers to bypass SafeSEH, ASLR, and DEP protections through carefully c… |
CVE-2020-37042 | High | 8.4 | 2026-01-30 | Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the 'Find Computer' feature that allows attackers to execute arbitrary code by… |
CVE-2020-37041 | High | 7.5 | 2026-01-30 | OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesyst… |
CVE-2020-37040 | High | 8.4 | 2026-01-30 | Code Blocks 17.12 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious file name with Unicode… |
CVE-2020-37039 | High | 7.5 | 2026-01-30 | Frigate 2.02 contains a denial of service vulnerability that allows attackers to crash the application by sending oversized input to the command line interface… |
CVE-2020-37038 | High | 7.5 | 2026-01-30 | Code Blocks 20.03 contains a denial of service vulnerability that allows attackers to crash the application by manipulating input in the FSymbols search field… |
CVE-2020-37036 | High | 8.4 | 2026-01-30 | RM Downloader 2.50.60 contains a local buffer overflow vulnerability in the 'Load' parameter that allows attackers to execute arbitrary code by overwriting mem… |
CVE-2020-37035 | High | 8.2 | 2026-01-30 | e-Learning PHP Script 0.1.0 contains a SQL injection vulnerability in the search functionality that allows attackers to manipulate database queries through unv… |
CVE-2020-37034 | High | 7.5 | 2026-01-30 | HelloWeb 2.0 contains an arbitrary file download vulnerability that allows remote attackers to download system files by manipulating filepath and filename para… |
CVE-2020-37033 | High | 8.2 | 2026-01-30 | Infor Storefront B2B 1.0 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'usr_name' parameter in login… |
CVE-2020-37032 | High | 8.8 | 2026-01-30 | Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. A… |
CVE-2020-37031 | High | 8.4 | 2026-01-30 | Simple Startup Manager 1.17 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory through the 'F… |
CVE-2020-37029 | High | 8.4 | 2026-01-30 | FTPDummy 4.80 contains a local buffer overflow vulnerability in its preference file handling that allows attackers to execute arbitrary code. Attackers can cra… |
CVE-2020-37028 | High | 8.4 | 2026-01-30 | Socusoft Photo to Video Converter Professional 8.07 contains a local buffer overflow vulnerability in the 'Output Folder' input field that allows attackers to… |
CVE-2020-37027 | Critical | 9.8 | 2026-01-30 | Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts… |
CVE-2020-37026 | Medium | 5.3 | 2026-01-30 | Sickbeard alpha contains a cross-site request forgery vulnerability that allows attackers to disable authentication by submitting crafted configuration paramet… |
CVE-2020-37025 | High | 8.4 | 2026-01-30 | Port Forwarding Wizard 4.8.0 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code through a long request in the Regis… |
CVE-2020-37024 | High | 8.4 | 2026-01-30 | Nidesoft DVD Ripper 5.2.18 contains a local buffer overflow vulnerability in the License Code registration parameter that allows attackers to execute arbitrary… |
CVE-2020-37023 | High | 8.8 | 2026-01-30 | Koken CMS 0.22.24 contains a file upload vulnerability that allows authenticated attackers to bypass file extension restrictions by renaming malicious PHP file… |
CVE-2020-37060 | High | 7.8 | 2026-01-30 | Atomic Alarm Clock 6.3 contains a local privilege escalation vulnerability in its service configuration that allows attackers to execute arbitrary code with SY… |
CVE-2020-37059 | High | 7.8 | 2026-01-30 | Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system p… |
CVE-2020-37058 | High | 7.8 | 2026-01-30 | Andrea ST Filters Service 1.0.64.7 contains an unquoted service path vulnerability in its Windows service configuration. Local attackers can exploit the unquot… |
CVE-2020-37030 | High | 7.8 | 2026-01-30 | Outline Service 1.3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privil… |
CVE-2020-37022 | Medium | 6.4 | 2026-01-30 | OpenZ ERP 3.6.60 contains a persistent cross-site scripting vulnerability in the Employee module's name and description parameters. Attackers can inject malici… |
CVE-2020-37019 | Medium | 6.4 | 2026-01-30 | Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation… |
CVE-2020-37014 | Medium | 6.4 | 2026-01-30 | Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. At… |
CVE-2020-37003 | Medium | 6.4 | 2026-01-30 | Sellacious eCommerce 4.6 contains a persistent cross-site scripting vulnerability in the Manage Your Addresses module that allows attackers to inject malicious… |
CVE-2020-36998 | Medium | 6.4 | 2026-01-30 | Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and profile parameters. Attackers can inject… |
CVE-2020-36996 | Medium | 6.4 | 2026-01-30 | PHPFusion 9.03.50 contains a persistent cross-site scripting vulnerability in the print.php page that fails to properly sanitize user-submitted message content… |
CVE-2020-36966 | Medium | 6.4 | 2026-01-30 | Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows attackers to inject malicious scripts thr… |
CVE-2020-37021 | High | 7.8 | 2026-01-29 | 10-Strike Bandwidth Monitor 3.9 contains an unquoted service path vulnerability in multiple services that allows local attackers to escalate privileges. Attack… |
CVE-2020-37020 | High | 7.8 | 2026-01-29 | SonarQube 8.3.1 contains an unquoted service path vulnerability that allows local attackers to gain SYSTEM privileges by exploiting the service executable path… |
CVE-2020-37018 | Medium | 6.4 | 2026-01-29 | GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through message subjects… |
CVE-2020-37017 | High | 7.8 | 2026-01-29 | CodeMeter 6.60 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. A… |
CVE-2020-37016 | High | 7.8 | 2026-01-29 | BarcodeOCR 19.3.6 contains an unquoted service path vulnerability that allows local attackers to execute code with elevated privileges during system startup. A… |
CVE-2020-37015 | High | 7.5 | 2026-01-29 | The Ruijie Networks Switch eWeb S29_RGOS version 11.4 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive co… |
CVE-2020-37013 | High | 8.4 | 2026-01-29 | Audio Playback Recorder 3.2.2 contains a local buffer overflow vulnerability in the eject and registration parameters that allows attackers to execute arbitrar… |
CVE-2020-37012 | Critical | 9.8 | 2026-01-29 | Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php end… |
CVE-2020-37011 | High | 7.5 | 2026-01-29 | Gnome Fonts Viewer 3.34.0 contains a heap corruption vulnerability that allows attackers to trigger an out-of-bounds write by crafting a malicious TTF font fil… |
CVE-2020-37010 | Critical | 9.8 | 2026-01-29 | BearShare Lite 5.2.5 contains a buffer overflow vulnerability in the Advanced Search keywords input that allows attackers to execute arbitrary code. Attackers… |
CVE-2020-37009 | High | 8.8 | 2026-01-29 | MedDream PACS Server 6.8.3.751 contains an authenticated remote code execution vulnerability that allows authorized users to upload malicious PHP files. Attack… |
CVE-2020-37008 | High | 7.5 | 2026-01-29 | EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user in… |
CVE-2020-37007 | Medium | 5.3 | 2026-01-29 | Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate user account settings without proper request validation. Atta… |
CVE-2020-37006 | High | 8.2 | 2026-01-29 | berliCRM 1.0.24 contains a SQL injection vulnerability in the 'src_record' parameter that allows remote attackers to manipulate database queries. Attackers can… |
CVE-2020-37005 | High | 7.1 | 2026-01-29 | TimeClock Software 1.01 contains an authenticated time-based SQL injection vulnerability that allows attackers to enumerate valid usernames by manipulating the… |
CVE-2020-37004 | High | 8.2 | 2026-01-29 | The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes… |
CVE-2020-37002 | Critical | 9.8 | 2026-01-29 | Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful… |
CVE-2020-37001 | High | 8.4 | 2026-01-29 | Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the Pack File feature that allows attackers to execute arbitrary code by overfl… |
CVE-2020-37000 | Critical | 9.8 | 2026-01-29 | Free MP3 CD Ripper 2.8 contains a stack buffer overflow vulnerability that allows remote attackers to execute arbitrary code by crafting a malicious WAV file w… |
CVE-2020-36999 | High | 8.2 | 2026-01-29 | Elaniin CMS 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard by manipulating the login page with SQL injection… |
CVE-2020-36997 | Critical | 9.8 | 2026-01-29 | BacklinkSpeed 2.4 contains a buffer overflow vulnerability that allows attackers to corrupt the Structured Exception Handler (SEH) chain through malicious file… |
CVE-2020-36995 | High | 7.5 | 2026-01-29 | Mocha Telnet Lite for iOS 4.2 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the user configuration… |
CVE-2020-36994 | Medium | 6.2 | 2026-01-29 | QlikView 12.50.20000.0 contains a denial of service vulnerability in the FTP server address input field that allows local attackers to crash the application. A… |
CVE-2020-36973 | Medium | 6.5 | 2026-01-28 | PDW File Browser 1.3 contains a remote code execution vulnerability that allows authenticated users to upload and rename webshell files to arbitrary web server… |
CVE-2020-36972 | High | 8.2 | 2026-01-28 | SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to extract database inf… |
CVE-2020-36971 | High | 8.4 | 2026-01-28 | Nidesoft 3GP Video Converter 2.6.18 contains a local stack buffer overflow vulnerability in the license registration parameter. Attackers can craft a malicious… |
CVE-2020-36970 | High | 8.4 | 2026-01-28 | PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating the 'chemin' paramete… |
CVE-2020-36969 | High | 8.8 | 2026-01-28 | M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions by manipulating the admin parameter. Att… |
CVE-2020-36968 | Medium | 6.5 | 2026-01-28 | M/Monit 3.7.4 contains an authentication vulnerability that allows authenticated attackers to retrieve user password hashes through an administrative API endpo… |
CVE-2020-36967 | Critical | 9.8 | 2026-01-28 | Zortam Mp3 Media Studio 27.60 contains a buffer overflow vulnerability in the library creation file selection process that allows remote code execution. Attack… |
CVE-2020-36965 | High | 8.4 | 2026-01-28 | docPrint Pro 8.0 contains a local buffer overflow vulnerability in the 'Add URL' input field that allows attackers to execute arbitrary code by overwriting mem… |
CVE-2020-36964 | Critical | 9.8 | 2026-01-28 | YATinyWinFTP contains a denial of service vulnerability that allows attackers to crash the FTP service by sending a 272-byte buffer with a trailing space. Atta… |
CVE-2020-36963 | High | 7.5 | 2026-01-28 | Intelbras Router RF 301K firmware version 1.1.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to download router config… |
CVE-2020-36962 | Critical | 9.8 | 2026-01-28 | Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during expo… |
CVE-2020-36961 | Critical | 9.8 | 2026-01-28 | 10-Strike Network Inventory Explorer 8.65 contains a buffer overflow vulnerability in exception handling that allows remote attackers to execute arbitrary code… |
CVE-2020-36945 | High | 8.2 | 2026-01-28 | WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulat… |
CVE-2020-36944 | Medium | 4.0 | 2026-01-28 | ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read local files through portfolio PDF expor… |
CVE-2020-36943 | High | 7.5 | 2026-01-28 | aSc TimeTables 2021.6.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting subject title fields with exce… |
CVE-2020-36993 | Medium | 5.4 | 2026-01-28 | LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel. Attackers can inject malic… |
CVE-2020-36992 | High | 7.8 | 2026-01-28 | Nord VPN 6.31.13.0 contains an unquoted service path vulnerability in its nordvpn-service that allows local attackers to execute code with elevated privileges… |
CVE-2020-36991 | High | 7.8 | 2026-01-28 | ShareMouse 5.0.43 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges… |
CVE-2020-36990 | High | 7.8 | 2026-01-28 | Input Director 1.4.3 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute code with elev… |
CVE-2020-36989 | High | 7.8 | 2026-01-28 | ForensiT AppX Management Service 2.2.0.4 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with ele… |
CVE-2020-36988 | Medium | 5.4 | 2026-01-28 | PDW File Browser version 1.3 contains stored and reflected cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts… |
CVE-2020-36987 | High | 7.8 | 2026-01-28 | Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated p… |
CVE-2020-36986 | High | 7.8 | 2026-01-28 | Prey 1.9.6 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated privileges. Attackers can exploit… |
CVE-2020-36985 | High | 7.8 | 2026-01-28 | IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code… |
CVE-2020-36984 | High | 7.8 | 2026-01-28 | EPSON 1.124 contains an unquoted service path vulnerability in the SENADB service that allows local attackers to execute code with elevated system privileges… |
CVE-2020-36983 | High | 7.8 | 2026-01-27 | Quick 'n Easy FTP Service 3.2 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code during service startup. Att… |
CVE-2020-36982 | High | 7.8 | 2026-01-27 | Motorola Device Manager 2.5.4 contains an unquoted service path vulnerability in the MotoHelperService.exe service that allows local users to potentially injec… |
CVE-2020-36981 | High | 7.8 | 2026-01-27 | Motorola Device Manager 2.4.5 contains an unquoted service path vulnerability in the PST Service that allows local users to potentially execute arbitrary code… |
CVE-2020-36980 | High | 7.8 | 2026-01-27 | SAntivirus IC 10.0.21.61 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execut… |
CVE-2020-36979 | High | 7.8 | 2026-01-27 | Atheros Coex Service Application 8.0.0.255 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unqu… |
CVE-2020-36978 | Medium | 6.4 | 2026-01-27 | Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject ma… |
CVE-2020-36977 | High | 7.8 | 2026-01-27 | Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attackers to potentiall… |
CVE-2020-36976 | High | 7.8 | 2026-01-27 | Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local users to potentially ex… |