2020 CVEs (page 42)
Page 42 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-36235 | Medium | 5.3 | 2021-02-15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information… |
CVE-2020-36234 | Medium | 4.8 | 2021-02-15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulne… |
CVE-2020-13949 | High | 7.5 | 2021-02-12 | In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denia… |
CVE-2020-27869 | High | 8.8 | 2021-02-12 | This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor 2020 HF1, NPM: 2020.2. Au… |
CVE-2020-27868 | Critical | 9.8 | 2021-02-12 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395. Authentication is not required to… |
CVE-2020-27867 | Medium | 6.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2… |
CVE-2020-27866 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2… |
CVE-2020-27865 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi exten… |
CVE-2020-27864 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi exten… |
CVE-2020-27863 | Medium | 6.5 | 2021-02-12 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Auth… |
CVE-2020-27862 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authenticati… |
CVE-2020-27861 | High | 8.8 | 2021-02-12 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is no… |
CVE-2020-27860 | High | 7.8 | 2021-02-12 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.35811. User interaction is required to ex… |
CVE-2020-9307 | Medium | 6.5 | 2021-02-11 | Hirschmann OS2, RSP, and RSPE devices before HiOS 08.3.00 allow a denial of service. An unauthenticated, adjacent attacker can cause an infinite loop on one of… |
CVE-2020-35498 | High | 7.5 | 2021-02-11 | A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted… |
CVE-2020-25493 | High | 7.5 | 2021-02-11 | Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payloa… |
CVE-2020-1717 | Low | 2.7 | 2021-02-11 | A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack. |
CVE-2020-13186 | Medium | 6.5 | 2021-02-11 | An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web form, which allowed an attacker with kno… |
CVE-2020-13185 | Medium | 6.5 | 2021-02-11 | Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify auth… |
CVE-2020-10734 | Low | 3.3 | 2021-02-11 | A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Sin… |
CVE-2020-4768 | Medium | 5.4 | 2021-02-11 | IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users… |
CVE-2020-8030 | Low | 3.6 | 2021-02-11 | A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapToken or modify the configuration file b… |
CVE-2020-8029 | Low | 2.9 | 2021-02-11 | A Incorrect Permission Assignment for Critical Resource vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to gain access to the kublet ke… |
CVE-2020-8027 | High | 7.3 | 2021-02-11 | A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, open… |
CVE-2020-8031 | Medium | 6.3 | 2021-02-11 | A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS… |
CVE-2020-27874 | High | 8.8 | 2021-02-10 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent WeChat 7.0.18. User interaction is required to exploi… |
CVE-2020-27871 | High | 7.2 | 2021-02-10 | This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication i… |
CVE-2020-27870 | Medium | 6.5 | 2021-02-10 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1. Authentication is… |
CVE-2020-28596 | High | 7.8 | 2021-02-10 | A stack-based buffer overflow vulnerability exists in the Objparser::objparse() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856)… |
CVE-2020-28595 | High | 7.8 | 2021-02-10 | An out-of-bounds write vulnerability exists in the Obj.cpp load_obj() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856). A specia… |
CVE-2020-27250 | High | 7.8 | 2021-02-10 | In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the document parser to copy data from a part… |
CVE-2020-24842 | Medium | 6.1 | 2021-02-10 | PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's browser. |
CVE-2020-13585 | High | 8.8 | 2021-02-10 | An out-of-bounds write vulnerability exists in the PSD Header processing functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead… |
CVE-2020-13583 | High | 7.5 | 2021-02-10 | A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of se… |
CVE-2020-13581 | High | 7.8 | 2021-02-10 | In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the document parser to copy data from a part… |
CVE-2020-13572 | High | 8.8 | 2021-02-10 | A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.8. A specially crafted malformed file ca… |
CVE-2020-13571 | High | 8.8 | 2021-02-10 | An out-of-bounds write vulnerability exists in the SGI RLE decompression functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead… |
CVE-2020-13561 | High | 8.8 | 2021-02-10 | An out-of-bounds write vulnerability exists in the TIFF parser of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to code execution. An at… |
CVE-2020-8355 | Medium | 4.9 | 2021-02-10 | An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA us… |
CVE-2020-16120 | Medium | 5.1 | 2021-02-10 | Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for examp… |
CVE-2020-13578 | High | 7.5 | 2021-02-10 | A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial… |
CVE-2020-13577 | High | 7.5 | 2021-02-10 | A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial… |
CVE-2020-13576 | Critical | 9.8 | 2021-02-10 | A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote c… |
CVE-2020-13575 | High | 7.5 | 2021-02-10 | A denial-of-service vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denia… |
CVE-2020-13574 | High | 7.5 | 2021-02-10 | A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial… |
CVE-2020-13565 | Medium | 6.1 | 2021-02-10 | An open redirect vulnerability exists in the return_page redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development version 6.0.0 (commi… |
CVE-2020-13548 | High | 8.8 | 2021-02-10 | In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attac… |
CVE-2020-7021 | Medium | 4.9 | 2021-02-10 | Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasti… |
CVE-2020-26299 | Medium | 6.3 | 2021-02-10 | ftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulnerability. Clients o… |
CVE-2020-5023 | High | 7.5 | 2021-02-10 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause the serivce to crash due to excess resour… |
CVE-2020-13546 | High | 7.8 | 2021-02-10 | In SoftMaker Software GmbH SoftMaker Office TextMaker 2021 (revision 1014), a specially crafted document can cause the document parser to miscalculate a length… |
CVE-2020-24838 | High | 7.5 | 2021-02-10 | An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parameter is overly large. An attacker can obt… |
CVE-2020-24837 | High | 7.5 | 2021-02-10 | An integer underflow has been found in the latest version of ZCFees. The variables 'currPeriodIdx' and 'lastPeriodExecIdx' are both unsigned integers, and the… |
CVE-2020-29171 | Medium | 6.1 | 2021-02-10 | Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-sec… |
CVE-2020-36244 | Critical | 9.8 | 2021-02-10 | The daemon in GENIVI diagnostic log and trace (DLT), is vulnerable to a heap-based buffer overflow that could allow an attacker to remotely execute arbitrary c… |
CVE-2020-28871 | Critical | 9.8 | 2021-02-10 | Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload. |
CVE-2020-28870 | Critical | 9.8 | 2021-02-10 | In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in /modules/sys/form_personalization/json_fp… |
CVE-2020-35125 | Critical | 9.6 | 2021-02-09 | A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[ret… |
CVE-2020-26196 | Medium | 5.5 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.0-9.1.0 contain a Backup/Restore Privilege implementation issue. A user with the BackupAdmin role may potentially exploi… |
CVE-2020-26195 | Medium | 5.3 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory auto-create may erroneously create a directory for a user. A re… |
CVE-2020-26194 | High | 7.0 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource vulnerability. This may allow a non-admin… |
CVE-2020-26193 | High | 7.8 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain an improper input validation vulnerability. A user with the ISI_PRIV_CLUSTER privilege may exploit thi… |
CVE-2020-26192 | High | 7.8 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.2.0 - 9.1.0 contain a privilege escalation vulnerability. A non-admin user with either ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_… |
CVE-2020-26191 | High | 7.8 | 2021-02-09 | Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain a privilege escalation vulnerability. A user with ISI_PRIV_JOB_ENGINE may use the PermissionRepair job… |
CVE-2020-14343 | Critical | 9.8 | 2021-02-09 | A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YA… |
CVE-2020-22839 | Medium | 6.1 | 2021-02-09 | Reflected cross-site scripting vulnerability (XSS) in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers to inject arbitrary… |
CVE-2020-28645 | Critical | 9.1 | 2021-02-09 | Deleting users with certain names caused system files to be deleted. Risk is higher for systems which allow users to register themselves and have the data dire… |
CVE-2020-28644 | Medium | 4.3 | 2021-02-09 | The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints. This affects ownC… |
CVE-2020-18215 | High | 8.8 | 2021-02-09 | Multiple SQL Injection vulnerabilities in PHPSHE 1.7 in phpshe/admin.php via the (1) ad_id, (2) menu_id, and (3) cashout_id parameters, which could let a remot… |
CVE-2020-13117 | Critical | 9.8 | 2021-02-09 | Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login reques… |
CVE-2020-35943 | Medium | 6.5 | 2021-02-09 | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protectio… |
CVE-2020-35942 | High | 8.8 | 2021-02-09 | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings mod… |
CVE-2020-35572 | Medium | 6.1 | 2021-02-09 | Adminer through 4.7.8 allows XSS via the history parameter to the default URI. |
CVE-2020-28394 | Medium | 5.5 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper… |
CVE-2020-28392 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in SIMARIS configuration (All versions < V4.0.1). During installation to default target folder, incorrect permissions are c… |
CVE-2020-28388 | Medium | 6.5 | 2021-02-09 | A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE P… |
CVE-2020-27857 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-27856 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-27855 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17436 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17435 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17434 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17433 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17432 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17431 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-17430 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-17429 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17428 | Low | 3.3 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17427 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-17426 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-17425 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-17424 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-17423 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-17422 | Low | 3.3 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17421 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-17420 | Low | 3.3 | 2021-02-09 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is req… |
CVE-2020-17419 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-17418 | High | 7.8 | 2021-02-09 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to… |
CVE-2020-16144 | Medium | 5.7 | 2021-02-09 | When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files, and another user… |
CVE-2020-27008 | Medium | 5.5 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper… |