2020 CVEs (page 31)
Page 31 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-20448 | Medium | 6.5 | 2021-05-25 | FFmpeg 4.1.3 is affected by a Divide By Zero issue via libavcodec/ratecontrol.c, which allows a remote malicious user to cause a Denial of Service. |
CVE-2020-20446 | Medium | 6.5 | 2021-05-25 | FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause a Denial of Service. |
CVE-2020-20445 | Medium | 6.5 | 2021-05-25 | FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a Denial of Service. |
CVE-2020-4839 | Medium | 4.9 | 2021-05-25 | IBM Host firmware for LC-class Systems is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A remote privileged attacker could e… |
CVE-2020-13603 | Medium | 6.9 | 2021-05-25 | Integer Overflow in memory allocating functions. Zephyr versions >= 1.14.2, >= 2.4.0 contain Integer Overflow or Wraparound (CWE-190). For more information, se… |
CVE-2020-13602 | Medium | 4.0 | 2021-05-25 | Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop with Unreachable Exit C… |
CVE-2020-13601 | Critical | 9.0 | 2021-05-25 | Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com… |
CVE-2020-13600 | High | 7.0 | 2021-05-25 | Malformed SPI in response for eswifi can corrupt kernel memory. Zephyr versions >= 1.14.2, >= 2.3.0 contain Heap-based Buffer Overflow (CWE-122). For more info… |
CVE-2020-13599 | Low | 3.3 | 2021-05-25 | Security problem with settings and littlefs. Zephyr versions >= 1.14.2, >= 2.3.0 contain Incorrect Default Permissions (CWE-276). For more information, see htt… |
CVE-2020-13598 | Medium | 6.3 | 2021-05-25 | FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat. Zephyr versions >= v1.14.2, >= v2.3.0 contain Stack-based Buffer Overflow (CWE… |
CVE-2020-10072 | Medium | 5.9 | 2021-05-25 | Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Insufficient Permissi… |
CVE-2020-10069 | Medium | 4.3 | 2021-05-25 | Zephyr Bluetooth unchecked packet data results in denial of service. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Parameters (CWE-233). F… |
CVE-2020-10066 | Low | 2.5 | 2021-05-25 | Incorrect Error Handling in Bluetooth HCI core. Zephyr versions >= v1.14.2, >= v2.2.0 contain NULL Pointer Dereference (CWE-476). For more information, see htt… |
CVE-2020-10065 | Low | 3.8 | 2021-05-25 | Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Length Parameter Inconsistency (CWE-130). For… |
CVE-2020-10064 | High | 8.3 | 2021-05-25 | Improper Input Frame Validation in ieee802154 Processing. Zephyr versions >= v1.14.2, >= v2.2.0 contain Stack-based Buffer Overflow (CWE-121), Heap-based Buffe… |
CVE-2020-9452 | High | 7.8 | 2021-05-25 | An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe includes functionality to quarantine files by copying a suspected ra… |
CVE-2020-9451 | Medium | 5.5 | 2021-05-25 | An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe keeps a log in a folder where unprivileged users have write permissi… |
CVE-2020-9450 | High | 7.8 | 2021-05-25 | An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe exposes a REST API that can be used by everyone, even unprivileged u… |
CVE-2020-20178 | High | 7.5 | 2021-05-24 | Ethereum 0xe933c0cd9784414d5f278c114904f5a84b396919#code.sol latest version is affected by a denial of service vulnerability in the affected payout function. O… |
CVE-2020-26560 | High | 8.1 | 2021-05-24 | Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner… |
CVE-2020-26559 | High | 8.8 | 2021-05-24 | Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the… |
CVE-2020-26558 | Medium | 4.2 | 2021-05-24 | Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey u… |
CVE-2020-26557 | High | 7.5 | 2021-05-24 | Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol… |
CVE-2020-26556 | High | 7.5 | 2021-05-24 | Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently… |
CVE-2020-26555 | Medium | 5.4 | 2021-05-24 | Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of t… |
CVE-2020-21041 | High | 7.5 | 2021-05-24 | Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of… |
CVE-2020-20907 | Critical | 9.1 | 2021-05-24 | MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/system/language/admin/language_general.clas… |
CVE-2020-4990 | High | 8.8 | 2021-05-24 | IBM Security Guardium 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to vie… |
CVE-2020-28911 | Medium | 6.5 | 2021-05-24 | Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the… |
CVE-2020-28910 | Critical | 9.8 | 2021-05-24 | Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are… |
CVE-2020-28909 | High | 8.8 | 2021-05-24 | Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are abl… |
CVE-2020-28908 | Critical | 9.8 | 2021-05-24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios. |
CVE-2020-28907 | Critical | 9.8 | 2021-05-24 | Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to do… |
CVE-2020-28906 | High | 8.8 | 2021-05-24 | Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are… |
CVE-2020-28905 | High | 8.8 | 2021-05-24 | Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination. |
CVE-2020-28904 | Critical | 9.8 | 2021-05-24 | Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component co… |
CVE-2020-28903 | Medium | 6.1 | 2021-05-24 | Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS. |
CVE-2020-28902 | Critical | 9.8 | 2021-05-24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php. |
CVE-2020-28901 | Critical | 9.8 | 2021-05-24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component install… |
CVE-2020-28900 | Critical | 9.8 | 2021-05-24 | Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code E… |
CVE-2020-26006 | Medium | 6.1 | 2021-05-24 | Project Worlds Online Examination System 1.0 is affected by Cross Site Scripting (XSS) via account.php. |
CVE-2020-25411 | Medium | 6.5 | 2021-05-24 | Projectworlds Online Examination System 1.0 is vulnerable to CSRF, which allows a remote attacker to delete the existing user. |
CVE-2020-25409 | Critical | 9.8 | 2021-05-24 | Projectsworlds College Management System Php 1.0 is vulnerable to SQL injection issues over multiple parameters. |
CVE-2020-25408 | Medium | 6.5 | 2021-05-24 | A Cross-Site Request Forgery (CSRF) vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows a remote attacker to modify, delete, or… |
CVE-2020-23768 | High | 7.5 | 2021-05-21 | An information disclosure vulnerability was discovered in alipay_function.php in the log file of Alibaba payment interface on PHPPYUN prior to version 5.0.1. I… |
CVE-2020-23766 | Medium | 6.5 | 2021-05-21 | An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any file in the server… |
CVE-2020-23765 | High | 7.2 | 2021-05-21 | A file upload vulnerability was discovered in the file path /bl-plugins/backup/plugin.php on Bludit version 3.12.0. If an attacker is able to gain Administrato… |
CVE-2020-36332 | High | 7.5 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnera… |
CVE-2020-36331 | Critical | 9.1 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability i… |
CVE-2020-36330 | Critical | 9.1 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerabil… |
CVE-2020-36329 | Critical | 9.8 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerabi… |
CVE-2020-36328 | Critical | 9.8 | 2021-05-21 | A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer… |
CVE-2020-27211 | Medium | 5.7 | 2021-05-21 | Nordic Semiconductor nRF52840 devices through 2020-10-19 have improper protection against physical side channels. The flash read-out protection (APPROTECT) can… |
CVE-2020-27212 | High | 7.0 | 2021-05-21 | STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP) can be degraded from RDP level 2 (no a… |
CVE-2020-27208 | Medium | 6.8 | 2021-05-21 | The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token… |
CVE-2020-12061 | Critical | 9.8 | 2021-05-21 | An issue was discovered in Nitrokey FIDO U2F firmware through 1.1. Communication between the microcontroller and the secure element transmits credentials in pl… |
CVE-2020-27209 | High | 7.5 | 2021-05-20 | The ECDSA operation of the micro-ecc library 1.0 is vulnerable to simple power analysis attacks which allows an adversary to extract the private ECC key. |
CVE-2020-18220 | High | 7.5 | 2021-05-20 | Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CB… |
CVE-2020-21345 | Medium | 6.1 | 2021-05-20 | Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary co… |
CVE-2020-35580 | High | 7.5 | 2021-05-20 | A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the op… |
CVE-2020-21057 | High | 8.1 | 2021-05-20 | Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the system via the folder variable to app/edit/… |
CVE-2020-21056 | Medium | 4.3 | 2021-05-20 | Directory Traversal vulnerability exists in FusionPBX 4.5.7, which allows a remote malicious user to create folders via the folder variale to app\edit\folderne… |
CVE-2020-21055 | Medium | 6.5 | 2021-05-20 | A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2) filename, and (3)… |
CVE-2020-21054 | Medium | 6.1 | 2021-05-20 | Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "f" variabl… |
CVE-2020-4850 | High | 7.5 | 2021-05-20 | IBM Spectrum Scale 1.1.1.0 through 1.1.8.4 Transparent Cloud Tiering could allow a remote attacker to obtain sensitive information, caused by the leftover file… |
CVE-2020-21053 | Medium | 6.1 | 2021-05-20 | Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "qu… |
CVE-2020-24396 | High | 7.5 | 2021-05-20 | homee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensitive SSH keys within downloadable and unencrypted firmware images. This allows remote attackers to us… |
CVE-2020-24395 | Medium | 6.8 | 2021-05-20 | The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install compromised firmware. This… |
CVE-2020-15522 | Medium | 5.9 | 2021-05-20 | Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math li… |
CVE-2020-4765 | Low | 3.3 | 2021-05-19 | IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 188… |
CVE-2020-4646 | Medium | 4.3 | 2021-05-19 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5, 6.0.0.0 through 6.0.3.3, and 6.1.0.0 through 6.1.0.2 could allow an authenticated user to… |
CVE-2020-36365 | Medium | 6.1 | 2021-05-19 | Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open re… |
CVE-2020-36364 | Critical | 9.1 | 2021-05-19 | An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs allows path traversal (for copy and dele… |
CVE-2020-20266 | Medium | 6.5 | 2021-05-19 | Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. An authenticated remote attacker can… |
CVE-2020-20264 | Medium | 6.5 | 2021-05-19 | Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. An authenticated remote attacker can cause a Denial of S… |
CVE-2020-20246 | Medium | 6.5 | 2021-05-18 | Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the mactel process. An authenticated remote attacker can cause a Denial of Se… |
CVE-2020-20245 | Medium | 6.5 | 2021-05-18 | Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the log process. An authenticated remote attacker can cause a Denial of Servi… |
CVE-2020-20227 | Medium | 6.5 | 2021-05-18 | Mikrotik RouterOs stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can cause a Denia… |
CVE-2020-20220 | Medium | 6.5 | 2021-05-18 | Mikrotik RouterOs prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/bfd process. An authenticated remote attacker can cause… |
CVE-2020-19924 | Medium | 5.4 | 2021-05-18 | In Boostnote 0.12.1, exporting to PDF contains opportunities for XSS attacks. |
CVE-2020-20237 | Medium | 6.5 | 2021-05-18 | Mikrotik RouterOs 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can ca… |
CVE-2020-20236 | Medium | 6.5 | 2021-05-18 | Mikrotik RouterOs 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can ca… |
CVE-2020-20222 | Medium | 6.5 | 2021-05-18 | Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. An authenticated remote attacker can… |
CVE-2020-20214 | Medium | 6.5 | 2021-05-18 | Mikrotik RouterOs 6.44.6 (long-term tree) suffers from an assertion failure vulnerability in the btest process. An authenticated remote attacker can cause a De… |
CVE-2020-18178 | Critical | 9.8 | 2021-05-18 | Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/ind… |
CVE-2020-24740 | Medium | 4.3 | 2021-05-18 | An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage |
CVE-2020-23861 | Medium | 5.5 | 2021-05-18 | A heap-based buffer overflow vulnerability exists in LibreDWG 0.10.1 via the read_system_page function at libredwg-0.10.1/src/decode_r2007.c:666:5, which cause… |
CVE-2020-20951 | Critical | 9.8 | 2021-05-18 | In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files. |
CVE-2020-24026 | Medium | 6.1 | 2021-05-18 | TinyShop, a free and open source mall based on RageFrame2, has a stored XSS vulnerability that affects version 1.2.0. TinyShop allows XSS via the explain_first… |
CVE-2020-23856 | Medium | 5.5 | 2021-05-18 | Use-after-Free vulnerability in cflow 1.6 in the void call(char *name, int line) function at src/parser.c, which could cause a denial of service via the pointe… |
CVE-2020-23852 | Medium | 5.5 | 2021-05-18 | A heap based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif_decode(void *ctxt, BMP *pb) function at ffjpeg/src/jfif.c (line 544… |
CVE-2020-23851 | Medium | 5.5 | 2021-05-18 | A stack-based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif_decode(void *ctxt, BMP *pb) function at ffjpeg/src/jfif.c:513:28, w… |
CVE-2020-20254 | Medium | 6.5 | 2021-05-18 | Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker c… |
CVE-2020-20253 | Medium | 6.5 | 2021-05-18 | Mikrotik RouterOs before 6.47 (stable tree) suffers from a divison by zero vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can… |
CVE-2020-25709 | High | 7.5 | 2021-05-18 | A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion… |
CVE-2020-15279 | Medium | 4.0 | 2021-05-18 | An Improper Access Control vulnerability in the logging component of Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.23.320 allows a regu… |
CVE-2020-24755 | High | 7.8 | 2021-05-17 | In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory. This allows the impersonation and modif… |
CVE-2020-21844 | High | 8.8 | 2021-05-17 | GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. The impact is: execute arbitrary code (remote). The component is: read_2004_section_header ../../src/de… |
CVE-2020-21843 | High | 8.8 | 2021-05-17 | A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318. |
CVE-2020-21842 | High | 8.8 | 2021-05-17 | A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode.c:3051. |