2020 CVEs (page 30)
Page 30 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26670 | High | 8.8 | 2021-06-01 | A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted re… |
CVE-2020-26669 | Medium | 5.4 | 2021-06-01 | A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary… |
CVE-2020-26668 | High | 8.8 | 2021-06-01 | A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a mal… |
CVE-2020-17541 | High | 8.8 | 2021-06-01 | Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and… |
CVE-2020-4561 | Critical | 10.0 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access… |
CVE-2020-4520 | High | 8.8 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the c… |
CVE-2020-4354 | Medium | 5.4 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2020-4300 | High | 8.2 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit thi… |
CVE-2020-27748 | Medium | 6.5 | 2021-06-01 | A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added v… |
CVE-2020-1920 | High | 7.5 | 2021-06-01 | A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unres… |
CVE-2020-10666 | Critical | 9.8 | 2021-05-31 | The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an… |
CVE-2020-36375 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_equality Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36374 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_comparison Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36373 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_shifts Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36372 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_plus_minus Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36371 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_mul_div_rem Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36370 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_unary Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36369 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_statement_list Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36368 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_statement Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36367 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_block Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36366 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_value Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-18395 | High | 7.5 | 2021-05-28 | A NULL-pointer deference issue was discovered in GNU_gama::set() in ellipsoid.h in Gama 2.04 which can lead to a denial of service (DOS) via segment faults cau… |
CVE-2020-18392 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_array Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-26642 | Medium | 6.1 | 2021-05-28 | A cross-site scripting (XSS) vulnerability has been discovered in the login page of SeaCMS version 11 which allows an attacker to inject arbitrary web script o… |
CVE-2020-26641 | High | 8.8 | 2021-05-28 | A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts. |
CVE-2020-15782 | Critical | 9.8 | 2021-05-28 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS va… |
CVE-2020-1729 | Medium | 4.4 | 2021-05-28 | A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoa… |
CVE-2020-1716 | High | 8.8 | 2021-05-28 | A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. A… |
CVE-2020-35506 | Medium | 6.7 | 2021-05-28 | A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Informati… |
CVE-2020-35505 | Medium | 4.4 | 2021-05-28 | A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling th… |
CVE-2020-35504 | Medium | 6.0 | 2021-05-28 | A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged guest user to crash the… |
CVE-2020-27847 | Critical | 9.8 | 2021-05-28 | A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to by… |
CVE-2020-27826 | Medium | 4.2 | 2021-05-28 | A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an at… |
CVE-2020-25715 | Medium | 6.1 | 2021-05-28 | A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into… |
CVE-2020-25710 | High | 7.5 | 2021-05-28 | A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed asser… |
CVE-2020-10145 | High | 7.8 | 2021-05-27 | The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, u… |
CVE-2020-1761 | Medium | 6.1 | 2021-05-27 | A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this flaw to get the access… |
CVE-2020-1702 | Low | 3.3 | 2021-05-27 | A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using pod… |
CVE-2020-1701 | Medium | 6.5 | 2021-05-27 | A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create V… |
CVE-2020-15180 | Critical | 9.0 | 2021-05-27 | A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited b… |
CVE-2020-14387 | High | 7.4 | 2021-05-27 | A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attac… |
CVE-2020-14329 | Low | 3.3 | 2021-05-27 | A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allo… |
CVE-2020-14328 | Low | 3.3 | 2021-05-27 | A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server… |
CVE-2020-14327 | Medium | 5.5 | 2021-05-27 | A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by… |
CVE-2020-14301 | Medium | 6.5 | 2021-05-27 | An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML du… |
CVE-2020-22034 | High | 8.8 | 2021-05-27 | A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_floodfill.c, which might lead to memory corruption and other potential consequen… |
CVE-2020-22033 | Medium | 6.5 | 2021-05-27 | A heap-based Buffer Overflow Vulnerability exists FFmpeg 4.2 at libavfilter/vf_vmafmotion.c in convolution_y_8bit, which could let a remote malicious user caus… |
CVE-2020-22032 | High | 8.8 | 2021-05-27 | A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_edgedetect.c in gaussian_blur, which might lead to memory corruption and other p… |
CVE-2020-22027 | High | 8.8 | 2021-05-27 | A heap-based Buffer Overflow vulnerability exits in FFmpeg 4.2 in deflate16 at libavfilter/vf_neighbor.c, which might lead to memory corruption and other poten… |
CVE-2020-22025 | High | 8.8 | 2021-05-27 | A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to memory corruption and other potential co… |
CVE-2020-22023 | High | 8.8 | 2021-05-27 | A heap-based Buffer Overflow vulnerabililty exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_bitplanenoise.c, which might lead to memory corruption and o… |
CVE-2020-22022 | High | 8.8 | 2021-05-27 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory corruption and other… |
CVE-2020-22017 | High | 8.8 | 2021-05-27 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at ff_fill_rectangle in libavfilter/drawutils.c, which might lead to memory corruption and othe… |
CVE-2020-22016 | High | 8.8 | 2021-05-27 | A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get_bits.h when writing .mov files, which might lead to memory corruption and other pote… |
CVE-2020-12403 | Critical | 9.1 | 2021-05-27 | A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds read… |
CVE-2020-10774 | Medium | 5.5 | 2021-05-27 | A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/kernel/rh_features f… |
CVE-2020-10729 | Medium | 5.5 | 2021-05-27 | A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template… |
CVE-2020-10716 | Medium | 6.5 | 2021-05-27 | A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Sate… |
CVE-2020-10709 | High | 7.1 | 2021-05-27 | A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication… |
CVE-2020-10701 | Medium | 6.5 | 2021-05-27 | A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to a… |
CVE-2020-10698 | Low | 3.3 | 2021-05-27 | A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizati… |
CVE-2020-10697 | Medium | 4.4 | 2021-05-27 | A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage of writing a playbo… |
CVE-2020-10688 | Medium | 6.1 | 2021-05-27 | A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding w… |
CVE-2020-22031 | High | 8.8 | 2021-05-27 | A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_w3fdif.c in filter16_complex_low, which might lead to memory corruption and o… |
CVE-2020-22030 | High | 8.8 | 2021-05-27 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/af_afade.c in crossfade_samples_fltp, which might lead to memory corruption and… |
CVE-2020-22029 | High | 8.8 | 2021-05-27 | A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_colorconstancy.c: in slice_get_derivative, which crossfade_samples_fltp, whic… |
CVE-2020-18230 | Medium | 4.8 | 2021-05-27 | Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_switchshow" of com… |
CVE-2020-18229 | Medium | 4.8 | 2021-05-27 | Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_copyright" of comp… |
CVE-2020-27832 | Critical | 9.0 | 2021-05-27 | A flaw was found in Red Hat Quay, where it has a persistent Cross-site Scripting (XSS) vulnerability when displaying a repository's notification. This flaw all… |
CVE-2020-17514 | High | 7.4 | 2021-05-27 | Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method. Under typical deployments, a man in the m… |
CVE-2020-27831 | Medium | 4.3 | 2021-05-27 | A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notification… |
CVE-2020-27839 | Medium | 5.4 | 2021-05-26 | A flaw was found in ceph-dashboard. The JSON Web Token (JWT) used for user authentication is stored by the frontend application in the browser’s localStorage w… |
CVE-2020-10695 | High | 7.8 | 2021-05-26 | An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can use this flaw to mo… |
CVE-2020-25724 | Medium | 4.3 | 2021-05-26 | A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information… |
CVE-2020-25634 | Medium | 5.4 | 2021-05-26 | A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or mo… |
CVE-2020-22028 | Medium | 6.5 | 2021-05-26 | Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_vertically_8 at libavfilter/vf_avgblur.c, which could cause a remote Denial of Service. |
CVE-2020-22026 | Medium | 6.5 | 2021-05-26 | Buffer Overflow vulnerability exists in FFmpeg 4.2 in the config_input function at libavfilter/af_tremolo.c, which could let a remote malicious user cause a De… |
CVE-2020-22024 | Medium | 6.5 | 2021-05-26 | Buffer Overflow vulnerability in FFmpeg 4.2 at the lagfun_frame16 function in libavfilter/vf_lagfun.c, which could let a remote malicious user cause Denial of… |
CVE-2020-22021 | Medium | 6.5 | 2021-05-26 | Buffer Overflow vulnerability in FFmpeg 4.2 at filter_edges function in libavfilter/vf_yadif.c, which could let a remote malicious user cause a Denial of Servi… |
CVE-2020-22020 | Medium | 6.5 | 2021-05-26 | Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could let a remote malicious user cause a Deni… |
CVE-2020-22019 | Medium | 6.5 | 2021-05-26 | Buffer Overflow vulnerability in FFmpeg 4.2 at convolution_y_10bit in libavfilter/vf_vmafmotion.c, which could let a remote malicious user cause a Denial of Se… |
CVE-2020-15076 | High | 7.8 | 2021-05-26 | Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinks in /tmp. |
CVE-2020-22015 | High | 8.8 | 2021-05-26 | Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, which could let a remote malicious user ob… |
CVE-2020-24020 | High | 8.8 | 2021-05-26 | Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnn_execute_layer_pad in libavfilter/dnn/dnn_backend_native_layer_pad.c due to a call to memcpy without length… |
CVE-2020-18221 | Medium | 6.1 | 2021-05-26 | Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting commands during block rendering of a ma… |
CVE-2020-27815 | High | 7.8 | 2021-05-26 | A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system… |
CVE-2020-25697 | High | 7.0 | 2021-05-26 | A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of a… |
CVE-2020-26680 | Medium | 5.4 | 2021-05-26 | In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payl… |
CVE-2020-26679 | Medium | 4.3 | 2021-05-26 | vFairs 3.3 is affected by Insecure Permissions. Any user logged in to a vFairs virtual conference or event can modify any other users profile information or pr… |
CVE-2020-26678 | High | 8.8 | 2021-05-26 | vFairs 3.3 is affected by Remote Code Execution. Any user logged in to a vFairs virtual conference or event can abuse the functionality to upload a profile pic… |
CVE-2020-26677 | High | 8.8 | 2021-05-26 | Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the API. |
CVE-2020-25669 | High | 7.8 | 2021-05-26 | A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the… |
CVE-2020-25668 | High | 7.0 | 2021-05-26 | A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op. |
CVE-2020-25673 | Medium | 5.5 | 2021-05-26 | A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually hanging-up the system. |
CVE-2020-25671 | High | 7.8 | 2021-05-26 | A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which might lead to privilege escalations. |
CVE-2020-25670 | High | 7.8 | 2021-05-26 | A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might lead to privilege escalations. |
CVE-2020-25672 | High | 7.5 | 2021-05-25 | A memory leak vulnerability was found in Linux kernel in llcp_sock_connect |
CVE-2020-20453 | Medium | 6.5 | 2021-05-25 | FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause a Denial of Service |
CVE-2020-20451 | High | 7.5 | 2021-05-25 | Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c. |
CVE-2020-20450 | High | 7.5 | 2021-05-25 | FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which could cause a Denial of Service. |