2020 CVEs (page 45)
Page 45 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-24669 | Medium | 5.4 | 2021-01-29 | The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated rem… |
CVE-2020-24666 | Medium | 5.4 | 2021-01-29 | The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote use… |
CVE-2020-24665 | Medium | 6.5 | 2021-01-29 | The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remot… |
CVE-2020-24664 | Medium | 5.4 | 2021-01-29 | The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote… |
CVE-2020-35652 | Medium | 6.5 | 2021-01-29 | An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1… |
CVE-2020-35547 | Critical | 9.1 | 2021-01-29 | A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user dat… |
CVE-2020-35145 | High | 7.8 | 2021-01-29 | Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple components, aka an Un… |
CVE-2020-29605 | Medium | 4.3 | 2021-01-29 | An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access… |
CVE-2020-29604 | Medium | 6.5 | 2021-01-29 | An issue was discovered in MantisBT before 2.24.4. A missing access check in bug_actiongroup.php allows an attacker (with rights to create new issues) to use t… |
CVE-2020-29603 | Medium | 4.3 | 2021-01-29 | In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php… |
CVE-2020-29538 | Medium | 4.9 | 2021-01-29 | Archer before 6.9 P1 (6.9.0.1) contains an improper access control vulnerability in an API. A remote authenticated malicious administrative user can potentiall… |
CVE-2020-29537 | Medium | 4.6 | 2021-01-29 | Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitra… |
CVE-2020-29536 | Medium | 4.3 | 2021-01-29 | Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. A remote authenticated malicious attacker with access to service files may obtain… |
CVE-2020-29535 | Medium | 5.3 | 2021-01-29 | Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability t… |
CVE-2020-29005 | High | 7.5 | 2021-01-29 | The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosure. |
CVE-2020-29004 | High | 8.8 | 2021-01-29 | The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack. |
CVE-2020-28406 | Medium | 6.5 | 2021-01-29 | An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access details about jobs h… |
CVE-2020-28405 | High | 8.8 | 2021-01-29 | An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to change the privileges of an… |
CVE-2020-28404 | Medium | 6.5 | 2021-01-29 | An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access the Billing page wit… |
CVE-2020-28403 | High | 8.0 | 2021-01-29 | A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change the privileges of a… |
CVE-2020-28402 | Medium | 5.4 | 2021-01-29 | An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access Launcher Configurati… |
CVE-2020-28401 | Medium | 6.5 | 2021-01-29 | An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access WIP details about jo… |
CVE-2020-8585 | Medium | 5.5 | 2021-01-28 | OnCommand Unified Manager Core Package versions prior to 5.2.5 may disclose sensitive account information to unauthorized users via the use of PuTTY Link (plin… |
CVE-2020-36115 | Medium | 5.4 | 2021-01-28 | Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter i… |
CVE-2020-35754 | High | 7.2 | 2021-01-28 | OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input… |
CVE-2020-35517 | High | 8.2 | 2021-01-28 | A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to creat… |
CVE-2020-1725 | Medium | 5.4 | 2021-01-28 | A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and af… |
CVE-2020-1723 | Medium | 6.1 | 2021-01-28 | A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. Affected versions of K… |
CVE-2020-26272 | Medium | 5.4 | 2021-01-28 | The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0… |
CVE-2020-4888 | High | 8.8 | 2021-01-28 | IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure… |
CVE-2020-4682 | Critical | 9.8 | 2021-01-28 | IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of tr… |
CVE-2020-13569 | High | 8.8 | 2021-01-28 | A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f600ff1394f91ccd512bc… |
CVE-2020-5626 | High | 8.8 | 2021-01-28 | Logstorage version 8.0.0 and earlier, and ELC Analytics version 3.0.0 and earlier allow remote attackers to execute arbitrary OS commands via a specially craft… |
CVE-2020-35124 | Critical | 9.6 | 2021-01-28 | A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the R… |
CVE-2020-25785 | Critical | 9.8 | 2021-01-28 | An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-b… |
CVE-2020-25784 | Critical | 9.8 | 2021-01-28 | An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-b… |
CVE-2020-25783 | Critical | 9.8 | 2021-01-28 | An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated heap-ba… |
CVE-2020-25782 | Critical | 9.8 | 2021-01-28 | An issue was discovered on Accfly Wireless Security IR Camera 720P System with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-b… |
CVE-2020-5428 | Medium | 6.0 | 2021-01-27 | In applications using Spring Cloud Task 2.2.4.RELEASE and below, may be vulnerable to SQL injection when exercising certain lookup queries in the TaskExplorer. |
CVE-2020-5427 | High | 7.2 | 2021-01-27 | In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, versions 2.5.x prior 2.5.4, an application is vulnerable to SQL injection when requesting task execut… |
CVE-2020-4952 | High | 8.8 | 2021-01-27 | IBM Security Guardium 11.2 could allow an authenticated user to gain root access due to improper access control. IBM X-Force ID: 192028. |
CVE-2020-4865 | Medium | 5.4 | 2021-01-27 | IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2020-4855 | Medium | 5.4 | 2021-01-27 | IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2020-4789 | Medium | 6.5 | 2021-01-27 | IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 could allow a remote attacker to traverse directories on the syst… |
CVE-2020-4787 | Low | 2.3 | 2021-01-27 | IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery (SSRF). This may all… |
CVE-2020-4786 | Medium | 4.3 | 2021-01-27 | IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery (SSRF). This may all… |
CVE-2020-4547 | Medium | 5.4 | 2021-01-27 | IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a… |
CVE-2020-4524 | Medium | 5.4 | 2021-01-27 | IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2020-4189 | Medium | 4.3 | 2021-01-27 | IBM Security Guardium 11.2 discloses sensitive information in the response headers that could be used in further attacks against the system. IBM X-Force ID: 17… |
CVE-2020-23361 | Critical | 9.8 | 2021-01-27 | phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed… |
CVE-2020-23360 | Critical | 9.8 | 2021-01-27 | oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/adm… |
CVE-2020-23359 | Critical | 9.8 | 2021-01-27 | WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two pa… |
CVE-2020-23356 | High | 7.5 | 2021-01-27 | dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password hashes, which mish… |
CVE-2020-23355 | High | 7.5 | 2021-01-27 | ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If enc… |
CVE-2020-23352 | High | 7.5 | 2021-01-27 | Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zb_user/plugin/pas… |
CVE-2020-4967 | Medium | 4.3 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks against the system… |
CVE-2020-4820 | Medium | 6.1 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2020-4816 | Medium | 5.9 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict T… |
CVE-2020-4815 | Medium | 5.3 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further at… |
CVE-2020-4628 | Medium | 5.3 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2020-36012 | Medium | 4.8 | 2021-01-27 | Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field. |
CVE-2020-23776 | High | 7.5 | 2021-01-26 | A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send… |
CVE-2020-23774 | Medium | 6.1 | 2021-01-26 | A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed. |
CVE-2020-27295 | High | 7.5 | 2021-01-26 | The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on the OPC UA Tunneller (… |
CVE-2020-27299 | Critical | 9.1 | 2021-01-26 | The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information or cause the device… |
CVE-2020-27297 | Critical | 9.8 | 2021-01-26 | The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to manipulate memory with controlled values and remotely execut… |
CVE-2020-27274 | High | 7.5 | 2021-01-26 | Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to close, which may lead t… |
CVE-2020-13582 | High | 7.5 | 2021-01-26 | A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of se… |
CVE-2020-9492 | High | 8.8 | 2021-01-26 | In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without… |
CVE-2020-8295 | High | 7.5 | 2021-01-26 | A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user. |
CVE-2020-8293 | Medium | 6.5 | 2021-01-26 | A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential… |
CVE-2020-8292 | Medium | 5.4 | 2021-01-26 | Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in message boxes. |
CVE-2020-8288 | Medium | 5.4 | 2021-01-26 | The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter. |
CVE-2020-6780 | Medium | 4.4 | 2021-01-26 | Use of Password Hash With Insufficient Computational Effort in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2… |
CVE-2020-6779 | Critical | 10.0 | 2021-01-26 | Use of Hard-coded Credentials in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows an unauthenticated remo… |
CVE-2020-36230 | High | 7.5 | 2021-01-26 | A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in den… |
CVE-2020-36229 | High | 7.5 | 2021-01-26 | A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of serv… |
CVE-2020-36228 | High | 7.5 | 2021-01-26 | An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial… |
CVE-2020-36227 | High | 7.5 | 2021-01-26 | A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. |
CVE-2020-36226 | High | 7.5 | 2021-01-26 | A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of… |
CVE-2020-36225 | High | 7.5 | 2021-01-26 | A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service. |
CVE-2020-36224 | High | 7.5 | 2021-01-26 | A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of servic… |
CVE-2020-36223 | High | 7.5 | 2021-01-26 | A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double f… |
CVE-2020-36222 | High | 7.5 | 2021-01-26 | A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service. |
CVE-2020-36221 | High | 7.5 | 2021-01-26 | An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of se… |
CVE-2020-36220 | Medium | 5.9 | 2021-01-26 | An issue was discovered in the va-ts crate before 0.0.4 for Rust. Because Demuxer<T> omits a required T: Send bound, a data race and memory corruption can occu… |
CVE-2020-36219 | Medium | 5.9 | 2021-01-26 | An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption<T> implements Sync unconditionally, a data race can occur. |
CVE-2020-36218 | Medium | 5.9 | 2021-01-26 | An issue was discovered in the buttplug crate before 1.0.4 for Rust. ButtplugFutureStateShared does not properly consider (!Send|!Sync) objects, leading to a d… |
CVE-2020-36217 | Medium | 5.9 | 2021-01-26 | An issue was discovered in the may_queue crate through 2020-11-10 for Rust. Because Queue does not have bounds on its Send trait or Sync trait, memory corrupti… |
CVE-2020-36216 | Medium | 5.9 | 2021-01-26 | An issue was discovered in Input<R> in the eventio crate before 0.5.1 for Rust. Because a non-Send type can be sent to a different thread, a data race and memo… |
CVE-2020-36215 | High | 7.5 | 2021-01-26 | An issue was discovered in the hashconsing crate before 1.1.0 for Rust. Because HConsed does not have bounds on its Send trait or Sync trait, memory corruption… |
CVE-2020-36214 | Medium | 5.9 | 2021-01-26 | An issue was discovered in the multiqueue2 crate before 0.1.7 for Rust. Because a non-Send type can be sent to a different thread, a data race can occur. |
CVE-2020-36213 | High | 7.5 | 2021-01-26 | An issue was discovered in the abi_stable crate before 0.9.1 for Rust. A retain call can create an invalid UTF-8 string, violating soundness. |
CVE-2020-36212 | High | 7.5 | 2021-01-26 | An issue was discovered in the abi_stable crate before 0.9.1 for Rust. DrainFilter lacks soundness because of a double drop. |
CVE-2020-36211 | High | 7.0 | 2021-01-26 | An issue was discovered in the gfwx crate before 0.3.0 for Rust. Because ImageChunkMut does not have bounds on its Send trait or Sync trait, a data race and me… |
CVE-2020-36210 | High | 7.8 | 2021-01-26 | An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs… |
CVE-2020-36209 | High | 7.0 | 2021-01-26 | An issue was discovered in the late-static crate before 0.4.0 for Rust. Because Sync is implemented for LateStatic with T: Send, a data race can occur. |
CVE-2020-36208 | High | 7.8 | 2021-01-26 | An issue was discovered in the conquer-once crate before 0.3.2 for Rust. Thread crossing can occur for a non-Send but Sync type, leading to memory corruption. |
CVE-2020-36207 | High | 7.0 | 2021-01-26 | An issue was discovered in the aovec crate through 2020-12-10 for Rust. Because Aovec<T> does not have bounds on its Send trait or Sync trait, a data race and… |
CVE-2020-36206 | High | 7.0 | 2021-01-26 | An issue was discovered in the rusb crate before 0.7.0 for Rust. Because of a lack of Send and Sync bounds, a data race and memory corruption can occur. |