2020 CVEs (page 43)
Page 43 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27007 | Medium | 5.5 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper… |
CVE-2020-27006 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper… |
CVE-2020-27005 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper… |
CVE-2020-27004 | Medium | 5.5 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper… |
CVE-2020-27003 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper… |
CVE-2020-27002 | High | 7.1 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper… |
CVE-2020-27001 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper… |
CVE-2020-27000 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper… |
CVE-2020-26999 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper… |
CVE-2020-26998 | Medium | 5.5 | 2021-02-09 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper… |
CVE-2020-25245 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders a… |
CVE-2020-25238 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in PCS neo (Administration Console) (All versions < V3.1), TIA Portal (V15, V15.1 and V16). Manipulating certain files in s… |
CVE-2020-25237 | High | 8.1 | 2021-02-09 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2). When uploading files to… |
CVE-2020-15798 | Critical | 9.8 | 2021-02-09 | A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V16 Update 3a), SIMATIC HMI KTP Mobile Panels (All ve… |
CVE-2020-10048 | Medium | 5.5 | 2021-02-09 | A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC WinCC (All versions < V7.5 SP2). Due to an insecure password verification process… |
CVE-2020-4996 | Medium | 5.5 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a local user to obtain sensitive information via the capturing of screenshots of authentica… |
CVE-2020-4995 | Medium | 5.3 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitive information from… |
CVE-2020-4795 | High | 8.2 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information to an unauthorized user using a specially crafted HTTP request. IB… |
CVE-2020-4791 | Medium | 5.3 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to obtain sensitive information using main in the middle attacks due to imprope… |
CVE-2020-4790 | Medium | 6.5 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a user to cause a denial of service due to improperly validating a supplied URL, rendering… |
CVE-2020-27261 | High | 8.8 | 2021-02-09 | The Omron CX-One Version 4.60 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. |
CVE-2020-27259 | High | 8.8 | 2021-02-09 | The Omron CX-One Version 4.60 and prior may allow an attacker to supply a pointer to arbitrary memory locations, which may allow an attacker to remotely execut… |
CVE-2020-27257 | High | 7.8 | 2021-02-09 | This vulnerability allows local attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type-conf… |
CVE-2020-22841 | Medium | 4.8 | 2021-02-09 | Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name input field in the… |
CVE-2020-22840 | Medium | 6.1 | 2021-02-09 | Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resourc… |
CVE-2020-16044 | High | 8.8 | 2021-02-09 | Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet. |
CVE-2020-13462 | Medium | 5.7 | 2021-02-09 | Insecure Direct Object Reference (IDOR) exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. Fixed in version R20-2 GA. |
CVE-2020-13461 | Medium | 4.3 | 2021-02-09 | Username enumeration in present in Tufin SecureTrack. It's affecting all versions of SecureTrack. The vendor has decided not to fix this vulnerability. Vendor'… |
CVE-2020-13460 | High | 8.8 | 2021-02-09 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were present in Tufin SecureTrack, affecting all versions prior to R20-2 GA. |
CVE-2020-13409 | Medium | 5.9 | 2021-02-09 | Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later… |
CVE-2020-13408 | Medium | 5.9 | 2021-02-09 | Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later… |
CVE-2020-13407 | Medium | 5.9 | 2021-02-09 | Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later… |
CVE-2020-24685 | High | 8.6 | 2021-02-09 | An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attac… |
CVE-2020-29021 | Low | 3.5 | 2021-02-08 | A vulnerability in web UI input field of GateManager allows authenticated attacker to enter script tags that could cause XSS. This issue affects: GateManager a… |
CVE-2020-14391 | Medium | 5.5 | 2021-02-08 | A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials… |
CVE-2020-8590 | Low | 3.3 | 2021-02-08 | Clustered Data ONTAP versions prior to 9.1P18 and 9.3P12 are susceptible to a vulnerability which could allow an attacker to discover node names via AutoSuppor… |
CVE-2020-8587 | Medium | 5.5 | 2021-02-08 | OnCommand System Manager 9.x versions prior to 9.3P20 and 9.4 prior to 9.4P3 are susceptible to a vulnerability that could allow HTTP clients to cache sensitiv… |
CVE-2020-8578 | Low | 3.3 | 2021-02-08 | Clustered Data ONTAP versions prior to 9.3P20 are susceptible to a vulnerability which could allow an attacker to discover node names via AutoSupport bundles e… |
CVE-2020-13947 | Medium | 6.1 | 2021-02-08 | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache Acti… |
CVE-2020-36152 | High | 8.8 | 2021-02-08 | Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted SOFA. |
CVE-2020-36151 | Medium | 6.5 | 2021-02-08 | Incorrect handling of input data in mysofa_resampler_reset_mem function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow and overwriting la… |
CVE-2020-36150 | Medium | 6.5 | 2021-02-08 | Incorrect handling of input data in loudness function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow and access to unallocated memory blo… |
CVE-2020-36149 | Medium | 6.5 | 2021-02-08 | Incorrect handling of input data in changeAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault er… |
CVE-2020-36148 | Medium | 6.5 | 2021-02-08 | Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and segmentation fault er… |
CVE-2020-24944 | High | 7.5 | 2021-02-08 | picoquic (before 3rd of July 2020) allows attackers to cause a denial of service (infinite loop) via a crafted QUIC frame, related to the picoquic_decode_frame… |
CVE-2020-7786 | Critical | 9.8 | 2021-02-08 | This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js. |
CVE-2020-7785 | Critical | 9.8 | 2021-02-08 | This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js. |
CVE-2020-7782 | Critical | 9.8 | 2021-02-08 | This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/gene… |
CVE-2020-6649 | Critical | 9.8 | 2021-02-08 | An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user se… |
CVE-2020-16629 | Critical | 9.8 | 2021-02-08 | PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through… |
CVE-2020-26052 | Medium | 5.4 | 2021-02-08 | Online Marriage Registration System 1.0 is affected by stored cross-site scripting (XSS) vulnerabilities in multiple parameters. |
CVE-2020-26051 | Critical | 9.8 | 2021-02-08 | College Management System Php 1.0 suffers from SQL injection vulnerabilities in the index.php page from POST parameters 'unametxt' and 'pwdtxt', which are not… |
CVE-2020-1779 | Medium | 4.3 | 2021-02-08 | When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affec… |
CVE-2020-35700 | High | 8.8 | 2021-02-08 | A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authentic… |
CVE-2020-11920 | Critical | 9.8 | 2021-02-08 | An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in the HOST/IP section of the NFS settings… |
CVE-2020-11915 | Medium | 6.8 | 2021-02-08 | An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. By sending a set_params.cgi?telnetd=1&save=1&reboot=1 request to the webserver, it is… |
CVE-2020-36243 | High | 8.8 | 2021-02-07 | The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. To exploit the vulnerability, an authenti… |
CVE-2020-36242 | Critical | 9.1 | 2021-02-07 | In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer over… |
CVE-2020-9205 | Medium | 4.9 | 2021-02-06 | There has a CSV injection vulnerability in ManageOne 8.0.1. An attacker with common privilege may exploit this vulnerability through some operations to inject… |
CVE-2020-9118 | Medium | 6.8 | 2021-02-06 | There is an insufficient integrity check vulnerability in Huawei Sound X Product. The system does not check certain software package's integrity sufficiently… |
CVE-2020-5812 | Medium | 5.9 | 2021-02-06 | Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trust… |
CVE-2020-14312 | Medium | 5.9 | 2021-02-06 | A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it li… |
CVE-2020-11836 | Medium | 5.5 | 2021-02-06 | OPPO Android Phone with MTK chipset and Android 8.1/9/10/11 versions have an information leak vulnerability. The “adb shell getprop ro.vendor.aee.enforcing” or… |
CVE-2020-9453 | Medium | 5.5 | 2021-02-05 | In Epson iProjection v2.30, the driver file EMP_MPAU.sys allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact becau… |
CVE-2020-12122 | High | 7.8 | 2021-02-05 | In Max Secure Max Spyware Detector 1.0.0.044, the driver file (MaxProc64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecifi… |
CVE-2020-10858 | Medium | 5.3 | 2021-02-05 | Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missing permission request handler. |
CVE-2020-10857 | Critical | 9.8 | 2021-02-05 | Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to remote code execution. |
CVE-2020-10554 | High | 7.5 | 2021-02-05 | An issue was discovered in Psyprax beforee 3.2.2. Passwords used to encrypt the data are stored in the database in an obfuscated format, which can be easily re… |
CVE-2020-10553 | Medium | 5.5 | 2021-02-05 | An issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\Psyprax32\PPScreen.ini contains a hash for the lockscreen (aka screensaver) of the appl… |
CVE-2020-10552 | High | 8.1 | 2021-02-05 | An issue was discovered in Psyprax before 3.2.2. The Firebird database is accessible with the default user sysdba and password masterke after installation. Thi… |
CVE-2020-10375 | Medium | 5.5 | 2021-02-05 | An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file dat… |
CVE-2020-9014 | Medium | 5.5 | 2021-02-05 | In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via crafted input to the virtual audio device… |
CVE-2020-18750 | High | 7.8 | 2021-02-05 | Buffer overflow in pdf2json 0.69 allows local users to execute arbitrary code by converting a crafted PDF file. |
CVE-2020-10234 | Medium | 6.5 | 2021-02-05 | The AscRegistryFilter.sys kernel driver in IObit Advanced SystemCare 13.2 allows an unprivileged user to send an IOCTL to the device driver. If the user provid… |
CVE-2020-18737 | Medium | 6.1 | 2021-02-05 | An issue was discovered in Typora 0.9.67. There is an XSS vulnerability that causes Remote Code Execution. |
CVE-2020-4832 | Medium | 5.5 | 2021-02-05 | IBM PowerHA 7.2 could allow a local attacker to obtain sensitive information from temporary directories after a discovery failure occurs. IBM X-Force ID: 18996… |
CVE-2020-8807 | Medium | 5.3 | 2021-02-05 | In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive information about the relationship betw… |
CVE-2020-8806 | High | 7.5 | 2021-02-05 | Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending. A valid chain could be incorrectly rejected beca… |
CVE-2020-36241 | Medium | 5.5 | 2021-02-05 | autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction beca… |
CVE-2020-35765 | High | 8.8 | 2021-02-05 | doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the… |
CVE-2020-18717 | Critical | 9.8 | 2021-02-05 | SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzz_template.php. |
CVE-2020-18716 | Critical | 9.8 | 2021-02-05 | SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordAction.php. |
CVE-2020-18714 | Critical | 9.8 | 2021-02-05 | SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordModel.php's getdata function. |
CVE-2020-18713 | Critical | 9.8 | 2021-02-05 | SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in customerAction.php |
CVE-2020-10539 | Critical | 9.8 | 2021-02-05 | An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort() function that, upon user login, checks the submitted password a… |
CVE-2020-10538 | Medium | 5.5 | 2021-02-05 | An issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as MD5 hashes in the database. MD5 can be brute-forced efficiently… |
CVE-2020-10537 | High | 7.8 | 2021-02-05 | An issue was discovered in Epikur before 20.1.1. A Glassfish 4.1 server with a default configuration is running on TCP port 4848. No password is required to ac… |
CVE-2020-5032 | Medium | 4.3 | 2021-02-04 | IBM QRadar SIEM 7.3 and 7.4 in some configurations may be vulnerable to a temporary denial of service attack when sent particular payloads. IBM X-Force ID: 194… |
CVE-2020-4828 | Medium | 6.5 | 2021-02-04 | IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to web cache poisoning, caused by improper input validation by modif… |
CVE-2020-4827 | Medium | 4.3 | 2021-02-04 | IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site request forgery which could allow an attacker to execu… |
CVE-2020-4826 | Medium | 4.3 | 2021-02-04 | IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site request forgery which could allow an attacker to execu… |
CVE-2020-4825 | Medium | 5.4 | 2021-02-04 | IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar… |
CVE-2020-4640 | Medium | 4.1 | 2021-02-04 | Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment ide… |
CVE-2020-27873 | Medium | 6.5 | 2021-02-04 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authe… |
CVE-2020-27872 | High | 8.8 | 2021-02-04 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authentication… |
CVE-2020-28450 | High | 8.6 | 2021-02-04 | This affects all versions of package decal. The vulnerability is in the extend function. |
CVE-2020-28449 | High | 8.6 | 2021-02-04 | This affects all versions of package decal. The vulnerability is in the set function. |
CVE-2020-16194 | Medium | 5.3 | 2021-02-04 | An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis < 4.0.2. Unauthenticated attackers can have access to any user's i… |
CVE-2020-6088 | High | 7.5 | 2021-02-04 | An exploitable denial of service vulnerability exists in the ENIP Request Path Network Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A spec… |
CVE-2020-27249 | High | 7.8 | 2021-02-04 | A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is small… |