2020 CVEs (page 37)
Page 37 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-19643 | Medium | 6.1 | 2021-03-30 | Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/form… |
CVE-2020-19642 | Medium | 6.2 | 2021-03-30 | An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. A local attacker can execute arbitrary code via editing the 'recdata.db' fi… |
CVE-2020-19641 | High | 8.8 | 2021-03-30 | An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. Authenticated attackers with the "Operator" Privilege can gain admin privil… |
CVE-2020-19640 | High | 7.5 | 2021-03-30 | An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. An unauthenticated attacker can reboot the device causing a Denial of Servi… |
CVE-2020-19639 | High | 8.8 | 2021-03-30 | Cross Site Request Forgery (CSRF) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI. |
CVE-2020-35138 | Critical | 9.8 | 2021-03-29 | The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details du… |
CVE-2020-35137 | High | 7.5 | 2021-03-29 | The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS discovery API, as demons… |
CVE-2020-25583 | Critical | 9.8 | 2021-03-29 | In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 when processing a… |
CVE-2020-25577 | Critical | 9.8 | 2021-03-29 | In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 rtsold(8) does no… |
CVE-2020-24636 | Critical | 9.8 | 2021-03-29 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2020-24635 | High | 7.2 | 2021-03-29 | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5… |
CVE-2020-25218 | Critical | 9.8 | 2021-03-29 | Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allow Authentication Bypass in its administrative web interface. |
CVE-2020-25217 | High | 7.2 | 2021-03-29 | Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administrative web interface. |
CVE-2020-7850 | High | 7.8 | 2021-03-29 | NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setting the arguments to… |
CVE-2020-7468 | High | 8.8 | 2021-03-26 | In FreeBSD 12.2-STABLE before r365772, 11.4-STABLE before r365773, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a ftpd(8) bug in… |
CVE-2020-7467 | High | 7.6 | 2021-03-26 | In FreeBSD 12.2-STABLE before r365767, 11.4-STABLE before r365769, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a number of AMD… |
CVE-2020-7464 | Medium | 5.3 | 2021-03-26 | In FreeBSD 12.2-STABLE before r365730, 11.4-STABLE before r365738, 12.1-RELEASE before p10, 11.4-RELEASE before p4, and 11.3-RELEASE before p14, a programming… |
CVE-2020-7463 | Medium | 5.5 | 2021-03-26 | In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, improper handli… |
CVE-2020-7462 | Medium | 5.5 | 2021-03-26 | In 11.4-PRERELEASE before r360733 and 11.3-RELEASE before p13, improper mbuf handling in the kernel causes a use-after-free bug by sending IPv6 Hop-by-Hop opti… |
CVE-2020-7461 | High | 7.3 | 2021-03-26 | In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, dhclient(8) fai… |
CVE-2020-25582 | High | 8.7 | 2021-03-26 | In FreeBSD 12.2-STABLE before r369334, 11.4-STABLE before r369335, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 when a process, such as jexec(8) or killal… |
CVE-2020-25581 | High | 7.5 | 2021-03-26 | In FreeBSD 12.2-STABLE before r369312, 11.4-STABLE before r369313, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 due to a race condition in the jail_remove… |
CVE-2020-25580 | Medium | 5.3 | 2021-03-26 | In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the login.access(5) rule p… |
CVE-2020-25579 | Medium | 5.3 | 2021-03-26 | In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was fa… |
CVE-2020-25578 | Medium | 5.3 | 2021-03-26 | In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 several file syst… |
CVE-2020-28695 | High | 8.8 | 2021-03-26 | Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard… |
CVE-2020-35518 | Medium | 5.3 | 2021-03-26 | When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthentica… |
CVE-2020-35508 | Medium | 4.5 | 2021-03-26 | A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling… |
CVE-2020-27829 | Medium | 5.5 | 2021-03-26 | A heap based buffer overflow in coders/tiff.c may result in program crash and denial of service in ImageMagick before 7.0.10-45. |
CVE-2020-35856 | Medium | 4.8 | 2021-03-26 | SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page. |
CVE-2020-19626 | Medium | 5.4 | 2021-03-26 | Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new. |
CVE-2020-19625 | Critical | 9.8 | 2021-03-26 | Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attackers to execute arbitrary code, via craf… |
CVE-2020-25840 | Medium | 6.1 | 2021-03-26 | Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could cause configuration… |
CVE-2020-28346 | High | 7.5 | 2021-03-26 | ACRN through 2.2 has a devicemodel/hw/pci/virtio/virtio.c NULL Pointer Dereference. |
CVE-2020-23517 | Medium | 6.1 | 2021-03-26 | Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML… |
CVE-2020-10584 | High | 7.5 | 2021-03-25 | A directory traversal on the /admin/search_by.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to read arbitrary serv… |
CVE-2020-10583 | High | 8.8 | 2021-03-25 | The /admin/admapi.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute arbitrary OS commands on… |
CVE-2020-10582 | Critical | 9.8 | 2021-03-25 | A SQL injection on the /admin/display_errors.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to execute arbitrary SQ… |
CVE-2020-10581 | High | 7.5 | 2021-03-25 | Multiple session validity check issues in several administration functionalities of Invigo Automatic Device Management (ADM) through 5.0 allow remote attackers… |
CVE-2020-10580 | High | 8.8 | 2021-03-25 | A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute… |
CVE-2020-10579 | High | 7.5 | 2021-03-25 | A directory traversal on the /admin/sysmon.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to list the content of ar… |
CVE-2020-35502 | High | 7.5 | 2021-03-25 | A flaw was found in Privoxy in versions before 3.0.29. Memory leaks when a response is buffered and the buffer limit is reached or Privoxy is running out of me… |
CVE-2020-6790 | High | 7.8 | 2021-03-25 | Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentiall… |
CVE-2020-6789 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Monitor Wall installer up to and including version 10.00.0164 potentially allows an atta… |
CVE-2020-6788 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Configuration Manager installer up to and including version 7.21.0078 potentially allows… |
CVE-2020-6787 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Client installer up to and including version 1.7.6.079 potentially allows an attac… |
CVE-2020-6786 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to… |
CVE-2020-6785 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allo… |
CVE-2020-6771 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in Bosch IP Helper up to and including version 1.00.0008 potentially allows an attacker to execute ar… |
CVE-2020-1946 | Critical | 9.8 | 2021-03-25 | In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this… |
CVE-2020-7852 | High | 7.8 | 2021-03-24 | DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed ex.j2c format file that is mishandled by Daview.exe. Attackers co… |
CVE-2020-7853 | Medium | 5.5 | 2021-03-24 | An outbound read/write vulnerability exists in XPLATFORM that does not check offset input ranges, allowing out-of-range data to be read. An attacker can exploi… |
CVE-2020-26283 | Medium | 6.8 | 2021-03-24 | go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control charact… |
CVE-2020-26279 | High | 7.7 | 2021-03-24 | go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possi… |
CVE-2020-7839 | High | 8.8 | 2021-03-24 | In MaEPSBroker 2.5.0.31 and prior, a command injection vulnerability caused by improper input validation checks when parsing brokerCommand parameter. |
CVE-2020-15809 | Medium | 6.5 | 2021-03-24 | spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiV… |
CVE-2020-36283 | Critical | 9.6 | 2021-03-24 | HID OMNIKEY 5427 and OMNIKEY 5127 readers are vulnerable to CSRF when using the EEM driver (Ethernet Emulation Mode). By persuading an authenticated user to vi… |
CVE-2020-35337 | Critical | 9.8 | 2021-03-24 | ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title parameter, which allows remote attackers to… |
CVE-2020-5015 | High | 7.5 | 2021-03-24 | IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0 through 5.3.6.2 could allow a remote attacker to cause a denial of servic… |
CVE-2020-24994 | High | 8.8 | 2021-03-23 | Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code exec… |
CVE-2020-12483 | High | 8.2 | 2021-03-23 | The appstore before 8.12.0.0 exposes some of its components, and the attacker can cause remote download and install apps through carefully constructed paramete… |
CVE-2020-7346 | High | 7.8 | 2021-03-23 | Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use… |
CVE-2020-28503 | High | 7.3 | 2021-03-23 | The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality. |
CVE-2020-9213 | High | 7.5 | 2021-03-22 | There is a denial of service vulnerability in some huawei products. In specific scenarios, due to the improper handling of the packets, an attacker may craft m… |
CVE-2020-9212 | Medium | 6.5 | 2021-03-22 | There is a vulnerability in some version of USG9500 that the device improperly handles the information when a user logs in to device. The attacker can exploit… |
CVE-2020-9206 | Medium | 6.7 | 2021-03-22 | The eUDC660 product has a resource management vulnerability. An attacker with high privilege needs to perform specific operations to exploit the vulnerability… |
CVE-2020-4882 | Medium | 6.1 | 2021-03-22 | IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from user-controlled data . This could enable… |
CVE-2020-28501 | Medium | 5.3 | 2021-03-22 | This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators. |
CVE-2020-13963 | Critical | 9.8 | 2021-03-21 | SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for ad… |
CVE-2020-27171 | Medium | 6.0 | 2021-03-20 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-… |
CVE-2020-27170 | Medium | 4.7 | 2021-03-20 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading… |
CVE-2020-4635 | Medium | 5.3 | 2021-03-19 | IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames. |
CVE-2020-25097 | High | 8.6 | 2021-03-19 | An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smugg… |
CVE-2020-6578 | Medium | 6.1 | 2021-03-19 | Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsi… |
CVE-2020-6577 | Critical | 9.8 | 2021-03-19 | The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c (German edition) allows itrk-api.php rechtstext_language SQL Injection. |
CVE-2020-9367 | High | 7.8 | 2021-03-18 | The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CS… |
CVE-2020-36144 | Medium | 5.3 | 2021-03-18 | Redash 8.0.0 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided template since the user… |
CVE-2020-26886 | High | 7.8 | 2021-03-18 | Softaculous before 5.5.7 is affected by a code execution vulnerability because of External Initialization of Trusted Variables or Data Stores. This leads to pr… |
CVE-2020-26797 | High | 7.5 | 2021-03-18 | Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping. |
CVE-2020-35492 | High | 7.8 | 2021-03-18 | A flaw was found in cairo's image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo's im… |
CVE-2020-14516 | Critical | 10.0 | 2021-03-18 | In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the implementation of the SHA-256 hashing algorithm w… |
CVE-2020-27827 | High | 7.5 | 2021-03-18 | A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific option… |
CVE-2020-26155 | High | 7.8 | 2021-03-18 | Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated users, which allows for… |
CVE-2020-17457 | Medium | 5.4 | 2021-03-17 | Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An authenticated attacker can store an XSS payload in the PSCU_FILE_INIT field of a Save Configuration X… |
CVE-2020-35456 | Medium | 5.5 | 2021-03-17 | The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to view private chat messages and media files via logcat because of excess… |
CVE-2020-35455 | High | 7.8 | 2021-03-17 | The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from Shared Preferences and the SQLite database… |
CVE-2020-35454 | Medium | 6.8 | 2021-03-17 | The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from an Android backup because of insecure appl… |
CVE-2020-28873 | High | 7.5 | 2021-03-17 | Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sen… |
CVE-2020-17525 | High | 7.5 | 2021-03-17 | Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client send… |
CVE-2020-13924 | High | 7.5 | 2021-03-17 | In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download f… |
CVE-2020-11309 | High | 7.8 | 2021-03-17 | Use after free in GPU driver while mapping the user memory to GPU memory due to improper check of referenced memory in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2020-11308 | Medium | 6.8 | 2021-03-17 | Buffer overflow occurs when trying to convert ASCII string to Unicode string if the actual size is more than required in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2020-11305 | Medium | 6.8 | 2021-03-17 | Integer overflow in boot due to improper length check on arguments received in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music |
CVE-2020-11299 | Critical | 9.8 | 2021-03-17 | Buffer overflow can occur in video while playing the non-standard clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT… |
CVE-2020-11290 | High | 7.0 | 2021-03-17 | Use after free condition in msm ioctl events due to race between the ioctl register and deregister events in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2020-11230 | Medium | 6.4 | 2021-03-17 | Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address to user land in Sna… |
CVE-2020-11228 | High | 7.8 | 2021-03-17 | Part of RPM region was not protected from xblSec itself due to improper policy and leads to unprivileged access in Snapdragon Auto, Snapdragon Compute, Snapdra… |
CVE-2020-11227 | Critical | 9.8 | 2021-03-17 | Out of bound write while parsing RTT/TTY packet parsing due to lack of check of buffer size before copying into buffer in Snapdragon Auto, Snapdragon Compute… |
CVE-2020-11226 | High | 7.5 | 2021-03-17 | Out of bound memory read in Data modem while unpacking data due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2020-11222 | Critical | 9.1 | 2021-03-17 | Buffer over read while processing MT SMS with maximum length due to improper length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snap… |