2020 CVEs (page 47)
Page 47 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11180 | High | 7.8 | 2021-01-21 | Out of bound access in computer vision control due to improper validation of command length before processing it in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2020-11179 | High | 7.0 | 2021-01-21 | Arbitrary read and write to kernel addresses by temporarily overwriting ring buffer pointer and creating a race condition. in Snapdragon Auto, Snapdragon Compu… |
CVE-2020-11167 | Critical | 9.8 | 2021-01-21 | Memory corruption while calculating L2CAP packet length in reassembly logic when remote sends more data than expected in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2020-11152 | Medium | 6.4 | 2021-01-21 | Race condition in HAL layer while processing callback objects received from HIDL due to lack of synchronization between accessing objects in Snapdragon Auto, S… |
CVE-2020-11151 | Medium | 6.4 | 2021-01-21 | Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in video in Snapdragon Auto, Snapdragon Com… |
CVE-2020-11150 | Medium | 6.7 | 2021-01-21 | Out of bound memory access in camera driver due to improper validation on data coming from UMD which is used for offset manipulation of pointer in Snapdragon A… |
CVE-2020-11149 | Medium | 6.7 | 2021-01-21 | Out of bound access due to usage of an out-of-range pointer offset in the camera driver. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapd… |
CVE-2020-11148 | Medium | 6.7 | 2021-01-21 | Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and meantime close is triggered and callback i… |
CVE-2020-11146 | High | 7.8 | 2021-01-21 | Out of bound write while copying data using IOCTL due to lack of check of array index received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon Con… |
CVE-2020-11145 | High | 7.5 | 2021-01-21 | Divide by zero issue can happen while updating delta extension header due to improper validation of master SN and extension header SN in Snapdragon Auto, Snapd… |
CVE-2020-11144 | Critical | 9.1 | 2021-01-21 | Buffer over-read while UE process invalid DL ROHC packet for decompression due to lack of check of size of compresses packet in Snapdragon Auto, Snapdragon Com… |
CVE-2020-11143 | Critical | 9.8 | 2021-01-21 | Out of bound memory access during music playback with modified content due to copying data without checking destination buffer size in Snapdragon Auto, Snapdra… |
CVE-2020-11140 | Critical | 9.8 | 2021-01-21 | Out of bound memory access during music playback with ALAC modified content due to improper validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Conne… |
CVE-2020-11139 | High | 7.5 | 2021-01-21 | Out of bound memory access while processing frames due to lack of check of invalid frames received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv… |
CVE-2020-11138 | Critical | 9.8 | 2021-01-21 | Uninitialized pointers accessed during music play back with incorrect bit stream due to an uninitialized heap memory result in instability in Snapdragon Auto… |
CVE-2020-11137 | Critical | 9.8 | 2021-01-21 | Integer multiplication overflow resulting in lower buffer size allocation than expected causes memory access out of bounds resulting in possible device instabi… |
CVE-2020-11136 | Critical | 9.8 | 2021-01-21 | Buffer Over-read in audio driver while using malloc management function due to not returning NULL for zero sized memory requirement in Snapdragon Auto, Snapdra… |
CVE-2020-11119 | High | 7.5 | 2021-01-21 | Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, Snapdragon Compute… |
CVE-2020-27221 | Critical | 9.8 | 2021-01-21 | In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting… |
CVE-2020-26278 | Medium | 5.8 | 2021-01-20 | Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery… |
CVE-2020-26252 | High | 8.7 | 2021-01-20 | OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code ex… |
CVE-2020-27859 | High | 7.5 | 2021-01-20 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ESMPRO Manager 6.42. Authentication is not requir… |
CVE-2020-27858 | High | 7.5 | 2021-01-20 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5. Authentication is not required… |
CVE-2020-6024 | High | 7.8 | 2021-01-20 | Check Point SmartConsole before R80.10 Build 185, R80.20 Build 119, R80.30 before Build 94, R80.40 before Build 415, and R81 before Build 548 were vulnerable t… |
CVE-2020-28483 | High | 7.1 | 2021-01-20 | This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forw… |
CVE-2020-28452 | Medium | 6.3 | 2021-01-20 | This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core_… |
CVE-2020-25687 | Medium | 5.9 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the rece… |
CVE-2020-25686 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards… |
CVE-2020-25682 | High | 8.1 | 2021-01-20 | A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating the… |
CVE-2020-25681 | High | 8.1 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. A… |
CVE-2020-35272 | Medium | 4.8 | 2021-01-20 | Employee Performance Evaluation System in PHP/MySQLi with Source Code 1.0 is affected by cross-site scripting (XSS) in the Admin Portal in the Task and Descrip… |
CVE-2020-35271 | Medium | 4.8 | 2021-01-20 | Employee Performance Evaluation System in PHP/MySQLi with Source Code 1.0 is affected by cross-site scripting (XSS) in the Employees, First Name and Last Name… |
CVE-2020-25685 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded… |
CVE-2020-25684 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destin… |
CVE-2020-25683 | Medium | 5.9 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the rece… |
CVE-2020-20949 | Medium | 5.9 | 2021-01-20 | Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability ca… |
CVE-2020-14360 | High | 7.8 | 2021-01-20 | A flaw was found in the X.Org Server before version 1.20.10. An out-of-bounds access in the XkbSetMap function may lead to a privilege escalation vulnerability… |
CVE-2020-4983 | High | 7.8 | 2021-01-20 | IBM Spectrum LSF 10.1 and IBM Spectrum LSF Suite 10.2 could allow a user on the local network who has privileges to submit LSF jobs to execute arbitrary comman… |
CVE-2020-4921 | High | 8.8 | 2021-01-20 | IBM Security Guardium 10.6 and 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attack… |
CVE-2020-4887 | Medium | 5.5 | 2021-01-20 | IBM AIX 7.1, 7.2 and AIX VIOS 3.1 could allow a local user to exploit a vulnerability in the gencore user command to create arbitrary files in any directory. I… |
CVE-2020-4688 | High | 7.8 | 2021-01-20 | IBM Security Guardium 10.6 and 11.2 could allow a local attacker to execute arbitrary commands on the system as an unprivileged user, caused by command injecti… |
CVE-2020-14756 | Critical | 9.8 | 2021-01-20 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1… |
CVE-2020-35217 | High | 8.8 | 2021-01-20 | Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in… |
CVE-2020-27852 | Medium | 5.4 | 2021-01-20 | A stored Cross-Site Scripting (XSS) vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary… |
CVE-2020-27851 | Medium | 5.4 | 2021-01-20 | Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allow… |
CVE-2020-27850 | Medium | 4.8 | 2021-01-20 | A stored Cross-Site Scripting (XSS) vulnerability in forms import feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitra… |
CVE-2020-13134 | Medium | 4.8 | 2021-01-20 | Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS pa… |
CVE-2020-13133 | Medium | 6.1 | 2021-01-20 | Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS pa… |
CVE-2020-25385 | Medium | 6.1 | 2021-01-20 | Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter… |
CVE-2020-19364 | High | 8.8 | 2021-01-20 | OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php. |
CVE-2020-19363 | Medium | 6.5 | 2021-01-20 | Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories. |
CVE-2020-19362 | Medium | 6.1 | 2021-01-20 | Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performing malicious actions to users who open… |
CVE-2020-19361 | Medium | 6.1 | 2021-01-20 | Reflected XSS in Medintux v2.16.000 CCAM.php by manipulating the mot1 parameter can result in an attacker performing malicious actions to users who open a mali… |
CVE-2020-19360 | High | 7.5 | 2021-01-20 | Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead to sensitive informat… |
CVE-2020-28707 | Medium | 6.1 | 2021-01-19 | The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plu… |
CVE-2020-27269 | Medium | 5.7 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile app… |
CVE-2020-27268 | Medium | 6.5 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A m… |
CVE-2020-27266 | Medium | 6.5 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A m… |
CVE-2020-11997 | Medium | 4.3 | 2021-01-19 | Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the sa… |
CVE-2020-27264 | High | 8.8 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile app… |
CVE-2020-27258 | Medium | 6.5 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, an information disclosure vulnerability in the communication protocol of the insulin pump… |
CVE-2020-27256 | Medium | 6.8 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump allows attackers wit… |
CVE-2020-14410 | Medium | 5.4 | 2021-01-19 | SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP fil… |
CVE-2020-14409 | High | 7.8 | 2021-01-19 | SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a… |
CVE-2020-8581 | Medium | 6.5 | 2021-01-19 | Clustered Data ONTAP versions prior to 9.3P20 and 9.5 are susceptible to a vulnerability which could allow an authenticated but unauthorized attacker to overwr… |
CVE-2020-35929 | Critical | 9.8 | 2021-01-19 | In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This inf… |
CVE-2020-27276 | Medium | 5.7 | 2021-01-19 | SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A mobile apps doesn't u… |
CVE-2020-27272 | Medium | 5.7 | 2021-01-19 | SOOIL Developments CoLtd DiabecareRS, AnyDana-i, AnyDana-A, The communication protocol of the insulin pump and AnyDana-i,AnyDana-A mobile apps doesn't use adeq… |
CVE-2020-27270 | Medium | 5.7 | 2021-01-19 | SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDana-A mobile apps doesnt use adequate me… |
CVE-2020-4881 | High | 7.5 | 2021-01-19 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server hostname verification for SSL/TLS commun… |
CVE-2020-4873 | Medium | 5.3 | 2021-01-19 | IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836. |
CVE-2020-4871 | Medium | 5.5 | 2021-01-19 | IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 190834. |
CVE-2020-27733 | High | 8.8 | 2021-01-19 | Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request. |
CVE-2020-28482 | Medium | 5.9 | 2021-01-19 | This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path… |
CVE-2020-28481 | Medium | 5.3 | 2021-01-19 | The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. |
CVE-2020-28480 | High | 7.3 | 2021-01-19 | The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setBy… |
CVE-2020-28479 | Medium | 5.9 | 2021-01-19 | The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function. |
CVE-2020-35129 | Critical | 9.0 | 2021-01-19 | Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including admini… |
CVE-2020-35128 | Critical | 9.0 | 2021-01-19 | Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including adm… |
CVE-2020-23342 | High | 8.8 | 2021-01-19 | A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users. |
CVE-2020-23522 | Medium | 6.8 | 2021-01-19 | Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter. |
CVE-2020-20950 | Medium | 5.9 | 2021-01-19 | Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow on… |
CVE-2020-28478 | High | 7.5 | 2021-01-19 | This affects the package gsap before 3.6.0. |
CVE-2020-28477 | High | 7.5 | 2021-01-19 | This affects all versions of package immer. |
CVE-2020-28472 | High | 7.3 | 2021-01-19 | This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to… |
CVE-2020-29450 | Medium | 6.5 | 2021-01-19 | Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS)… |
CVE-2020-36193 | High | 7.5 | 2021-01-18 | Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-202… |
CVE-2020-36192 | Medium | 5.3 | 2021-01-18 | An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either… |
CVE-2020-7343 | Medium | 5.5 | 2021-01-18 | Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a direct… |
CVE-2020-28473 | Medium | 6.8 | 2021-01-18 | The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate… |
CVE-2020-29446 | Medium | 5.3 | 2021-01-18 | Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in… |
CVE-2020-15864 | Medium | 6.1 | 2021-01-17 | An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL, with a constructor.constructor subst… |
CVE-2020-25533 | High | 7.0 | 2021-01-15 | An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch dae… |
CVE-2020-24641 | High | 7.5 | 2021-01-15 | In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited ca… |
CVE-2020-24640 | Critical | 9.8 | 2021-01-15 | There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment within Airwave Glas… |
CVE-2020-24639 | Critical | 9.8 | 2021-01-15 | There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment within Airwave Glass… |
CVE-2020-24638 | High | 7.2 | 2021-01-15 | Multiple authenticated remote command executions are possible in Airwave Glass before 1.3.3 via the glassadmin cli. These allow for a user with glassadmin priv… |
CVE-2020-16255 | Medium | 6.1 | 2021-01-15 | ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.' |
CVE-2020-35749 | High | 7.7 | 2021-01-15 | Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows r… |
CVE-2020-35748 | Medium | 5.4 | 2021-01-15 | Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authen… |