2020 CVEs (page 35)
Page 35 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-9667 | Medium | 6.5 | 2021-04-16 | Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker with admin privileg… |
CVE-2020-28898 | Medium | 5.3 | 2021-04-15 | In QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific URL parameters causes a server error in script execution due to… |
CVE-2020-28593 | High | 8.1 | 2021-04-15 | A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object… |
CVE-2020-28592 | Critical | 9.8 | 2021-04-15 | A heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially… |
CVE-2020-27239 | Critical | 9.8 | 2021-04-15 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The assetStatus parameter in the getAssets.jsp page is vuln… |
CVE-2020-27238 | Critical | 9.8 | 2021-04-15 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter in the getAssets.jsp page is vulnerable… |
CVE-2020-27237 | Critical | 9.8 | 2021-04-15 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter in the The nomenclature parameter in the… |
CVE-2020-7308 | Medium | 4.8 | 2021-04-15 | Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threa… |
CVE-2020-7270 | Medium | 4.9 | 2021-04-15 | Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensit… |
CVE-2020-7269 | Medium | 4.9 | 2021-04-15 | Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensit… |
CVE-2020-36288 | Medium | 6.1 | 2021-04-15 | The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 be… |
CVE-2020-35660 | Medium | 5.4 | 2021-04-14 | Cross Site Scripting (XSS) in Monica before 2.19.1 via the journal page. |
CVE-2020-28124 | Medium | 5.4 | 2021-04-14 | Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field. |
CVE-2020-35419 | Medium | 6.1 | 2021-04-14 | Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter. |
CVE-2020-35418 | Medium | 5.4 | 2021-04-14 | Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file. |
CVE-2020-29593 | Medium | 5.4 | 2021-04-14 | An issue was discovered in Orchard before 1.10. The Media Settings Allowed File Types list field allows an attacker to add a XSS payload that will execute when… |
CVE-2020-29592 | Critical | 9.8 | 2021-04-14 | An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an at… |
CVE-2020-36120 | High | 7.5 | 2021-04-14 | Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Service (DoS). |
CVE-2020-21088 | Medium | 4.8 | 2021-04-14 | Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML v… |
CVE-2020-21087 | Medium | 6.1 | 2021-04-14 | Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the… |
CVE-2020-19778 | Critical | 9.8 | 2021-04-14 | Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain privileges in "/index.php" by manipulating the parameter "user_id" in the… |
CVE-2020-36323 | High | 8.2 | 2021-04-14 | In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to… |
CVE-2020-36322 | Medium | 5.5 | 2021-04-14 | An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode()… |
CVE-2020-28590 | Medium | 6.5 | 2021-04-13 | An out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A s… |
CVE-2020-27236 | Critical | 9.8 | 2021-04-13 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. An attacker can make an a… |
CVE-2020-27235 | Critical | 9.8 | 2021-04-13 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attacker can make an authen… |
CVE-2020-27234 | Critical | 9.8 | 2021-04-13 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authent… |
CVE-2020-27233 | Critical | 9.8 | 2021-04-13 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authen… |
CVE-2020-27228 | High | 7.8 | 2021-04-13 | An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. Overwriting the binary can result in privileg… |
CVE-2020-27227 | Critical | 9.8 | 2021-04-13 | An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the s… |
CVE-2020-13568 | High | 8.8 | 2021-04-13 | SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trig… |
CVE-2020-13566 | High | 8.8 | 2021-04-13 | SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to tri… |
CVE-2020-15390 | Critical | 9.8 | 2021-04-12 | pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo. |
CVE-2020-4965 | High | 7.5 | 2021-04-12 | IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-For… |
CVE-2020-4964 | Medium | 4.3 | 2021-04-12 | IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application wh… |
CVE-2020-4920 | Medium | 5.4 | 2021-04-12 | IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t… |
CVE-2020-7924 | Medium | 4.2 | 2021-04-12 | Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certif… |
CVE-2020-15734 | Medium | 5.5 | 2021-04-12 | An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other file… |
CVE-2020-15942 | Medium | 4.3 | 2021-04-12 | An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may al… |
CVE-2020-28872 | Critical | 9.8 | 2021-04-12 | An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows an unauthorized person to create valid c… |
CVE-2020-24285 | High | 7.5 | 2021-04-12 | INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx. |
CVE-2020-36318 | Critical | 9.8 | 2021-04-11 | In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug… |
CVE-2020-36317 | High | 7.5 | 2021-04-11 | In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the pro… |
CVE-2020-23763 | Critical | 9.8 | 2021-04-09 | SQL injection in admin.php in Online Book Store 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication. |
CVE-2020-23762 | Medium | 5.4 | 2021-04-09 | Cross Site Scripting (XSS) vulnerability in the Larsens Calender plugin Version <= 1.2 for WordPress allows remote attackers to execute arbitrary web script vi… |
CVE-2020-23761 | Medium | 6.1 | 2021-04-09 | Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "payment gateway" colu… |
CVE-2020-13592 | High | 8.8 | 2021-04-09 | An exploitable SQL injection vulnerability exists in "global_lists/choices" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP requ… |
CVE-2020-13591 | High | 8.8 | 2021-04-09 | An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HT… |
CVE-2020-13587 | High | 8.8 | 2021-04-09 | An exploitable SQL injection vulnerability exists in the "forms_fields_rules/rules" page of the Rukovoditel Project Management App 2.7.2. A specially crafted H… |
CVE-2020-13534 | High | 7.8 | 2021-04-09 | A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream Report 5 20-2, reference LocalServer32 a… |
CVE-2020-13533 | High | 7.8 | 2021-04-09 | A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following registry keys, which reference binaries with… |
CVE-2020-13532 | High | 7.8 | 2021-04-09 | A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashboard Service service binary can be repla… |
CVE-2020-21884 | High | 8.8 | 2021-04-09 | Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace… |
CVE-2020-21883 | High | 8.8 | 2021-04-09 | Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to c… |
CVE-2020-36287 | Medium | 5.3 | 2021-04-09 | The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14… |
CVE-2020-6590 | High | 7.5 | 2021-04-08 | Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure. |
CVE-2020-14106 | Medium | 5.5 | 2021-04-08 | The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI < 2021.01.26. |
CVE-2020-14103 | Medium | 5.5 | 2021-04-08 | The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15. |
CVE-2020-14104 | High | 8.1 | 2021-04-08 | A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50. |
CVE-2020-14099 | High | 7.5 | 2021-04-08 | On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can… |
CVE-2020-23539 | High | 7.5 | 2021-04-08 | An issue was discovered in Realtek rtl8723de BLE Stack <= 4.1 that allows remote attackers to cause a Denial of Service via the interval field to the CONNECT_R… |
CVE-2020-23426 | Critical | 9.8 | 2021-04-08 | zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further at… |
CVE-2020-36316 | Medium | 5.5 | 2021-04-07 | In RELIC before 2021-04-03, there is a buffer overflow in PKCS#1 v1.5 signature verification because garbage bytes can be present. |
CVE-2020-36315 | Medium | 5.3 | 2021-04-07 | In RELIC before 2020-08-01, RSA PKCS#1 v1.5 signature forgery can occur because certain checks of the padding (and of the first two bytes) are inadequate. NOTE… |
CVE-2020-24140 | High | 8.3 | 2021-04-07 | Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename param… |
CVE-2020-24139 | High | 8.3 | 2021-04-07 | Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path paramete… |
CVE-2020-24137 | Medium | 5.3 | 2021-04-07 | Directory traversal vulnerability in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the path parameter… |
CVE-2020-24135 | Medium | 6.1 | 2021-04-07 | A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web script and HTML via th… |
CVE-2020-25584 | High | 7.5 | 2021-04-07 | In FreeBSD 13.0-STABLE before n245118, 12.2-STABLE before r369552, 11.4-STABLE before r369560, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE bef… |
CVE-2020-24138 | Medium | 6.1 | 2021-04-07 | Cross Site Scripting (XSS) vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.p… |
CVE-2020-24136 | High | 8.6 | 2021-04-07 | Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/htm… |
CVE-2020-36314 | Low | 3.9 | 2021-04-07 | fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it… |
CVE-2020-11255 | High | 7.5 | 2021-04-07 | Denial of service while processing RTCP packets containing multiple SDES reports due to memory for last SDES packet is freed and rest of the memory is leaked i… |
CVE-2020-11252 | High | 7.2 | 2021-04-07 | Trustzone initialization code will disable xPU`s when memory dumps are enabled and lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapd… |
CVE-2020-11251 | High | 8.2 | 2021-04-07 | Out-of-bounds read vulnerability while accessing DTMF payload due to lack of check of buffer length before copying in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2020-11247 | High | 8.2 | 2021-04-07 | Out of bound memory read while unpacking data due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Co… |
CVE-2020-11246 | High | 8.4 | 2021-04-07 | A double free condition can occur when the device moves to suspend mode during secure playback in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2020-11245 | High | 8.4 | 2021-04-07 | Unintended reads and writes by NS EL2 in access control driver due to lack of check of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn… |
CVE-2020-11243 | High | 7.5 | 2021-04-07 | RRC sends a connection establishment success to NAS even though connection setup validation returns failure and leads to denial of service in Snapdragon Auto… |
CVE-2020-11242 | High | 8.4 | 2021-04-07 | User could gain access to secure memory due to incorrect argument into address range validation api used in SDI to capture requested contents in Snapdragon Ind… |
CVE-2020-11237 | High | 8.4 | 2021-04-07 | Memory crash when accessing histogram type KPI input received due to lack of check of histogram definition before accessing it in Snapdragon Auto, Snapdragon C… |
CVE-2020-11236 | High | 8.4 | 2021-04-07 | Memory corruption due to invalid value of total dimension in the non-histogram type KPI could lead to a denial of service in Snapdragon Auto, Snapdragon Comput… |
CVE-2020-11234 | High | 8.4 | 2021-04-07 | When sending a socket event message to a user application, invalid information will be passed if socket is freed by other thread resulting in a Use After Free… |
CVE-2020-11231 | Medium | 6.7 | 2021-04-07 | Two threads call one or both functions concurrently leading to corruption of pointers and reference counters which in turn can lead to heap corruption in Snapd… |
CVE-2020-11210 | Critical | 9.3 | 2021-04-07 | Possible memory corruption in RPM region due to improper XPU configuration in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon… |
CVE-2020-11191 | High | 8.2 | 2021-04-07 | Out of bound read occurs while processing crafted SDP due to lack of check of null string in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snap… |
CVE-2020-36313 | High | 7.8 | 2021-04-07 | An issue was discovered in the Linux kernel before 5.7. The KVM subsystem allows out-of-range access to memslots after a deletion, aka CID-0774a964ef56. This a… |
CVE-2020-36312 | Medium | 5.5 | 2021-04-07 | An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure, aka CID-f658… |
CVE-2020-36311 | Medium | 5.5 | 2021-04-07 | An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) by triggering destru… |
CVE-2020-36310 | Medium | 5.5 | 2021-04-07 | An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite loop for certain nested page faults, ak… |
CVE-2020-13422 | High | 8.1 | 2021-04-06 | OpenIAM before 4.2.0.3 does not verify if a user has permissions to perform /webconsole/rest/api/* administrative actions. |
CVE-2020-13421 | Critical | 9.8 | 2021-04-06 | OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions. |
CVE-2020-13420 | Critical | 9.8 | 2021-04-06 | OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script. |
CVE-2020-13419 | Medium | 5.3 | 2021-04-06 | OpenIAM before 4.2.0.3 allows Directory Traversal in the Batch task. |
CVE-2020-13418 | Medium | 6.1 | 2021-04-06 | OpenIAM before 4.2.0.3 allows XSS in the Add New User feature. |
CVE-2020-36309 | Medium | 5.3 | 2021-04-06 | ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request… |
CVE-2020-36285 | High | 7.5 | 2021-04-06 | Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for f… |
CVE-2020-36284 | High | 7.5 | 2021-04-06 | Union Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free… |
CVE-2020-23533 | High | 7.5 | 2021-04-06 | Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for… |
CVE-2020-36308 | Medium | 5.3 | 2021-04-06 | Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries. |