2020 CVEs (page 48)
Page 48 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26414 | Medium | 4.3 | 2021-01-15 | An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution tim… |
CVE-2020-35733 | High | 7.5 | 2021-01-15 | An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certifica… |
CVE-2020-35582 | Medium | 5.4 | 2021-01-15 | A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp… |
CVE-2020-35581 | Medium | 5.4 | 2021-01-15 | A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp… |
CVE-2020-27220 | High | 8.8 | 2021-01-14 | The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when… |
CVE-2020-27219 | Medium | 6.1 | 2021-01-14 | In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within t… |
CVE-2020-6572 | High | 8.8 | 2021-01-14 | Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2020-29495 | Critical | 10.0 | 2021-01-14 | DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could p… |
CVE-2020-29494 | High | 8.7 | 2021-01-14 | Dell EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a Path Traversal Vulnerability in PDM. A remote user could potentially exploit this vulnerability, t… |
CVE-2020-29493 | Critical | 10.0 | 2021-01-14 | DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potential… |
CVE-2020-16046 | Medium | 6.1 | 2021-01-14 | Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2020-16045 | Critical | 9.6 | 2021-01-14 | Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2020-6777 | Medium | 4.8 | 2021-01-14 | A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10… |
CVE-2020-6776 | High | 8.8 | 2021-01-14 | A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10… |
CVE-2020-29587 | Medium | 5.4 | 2021-01-14 | SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intention… |
CVE-2020-29019 | Medium | 5.3 | 2021-01-14 | A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated attacker to crash the… |
CVE-2020-29018 | High | 8.8 | 2021-01-14 | A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive… |
CVE-2020-29017 | High | 8.8 | 2021-01-14 | An OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, 3.0.0 may allow a remote authenticated attacker to execute arbitrary commands on the syste… |
CVE-2020-29016 | Critical | 9.8 | 2021-01-14 | A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote attacker to overwrite… |
CVE-2020-29015 | Critical | 9.8 | 2021-01-14 | A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute a… |
CVE-2020-27368 | Medium | 5.5 | 2021-01-14 | Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via GET Parameter. |
CVE-2020-26733 | Medium | 5.4 | 2021-01-14 | Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject… |
CVE-2020-26732 | High | 7.5 | 2021-01-14 | SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it eas… |
CVE-2020-28470 | High | 7.3 | 2021-01-14 | This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page. |
CVE-2020-16119 | Medium | 6.3 | 2021-01-14 | Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a li… |
CVE-2020-27267 | Critical | 9.1 | 2021-01-14 | KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Aut… |
CVE-2020-27265 | Critical | 9.8 | 2021-01-14 | KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Aut… |
CVE-2020-27263 | Critical | 9.1 | 2021-01-14 | KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Aut… |
CVE-2020-9209 | Medium | 6.7 | 2021-01-13 | There is a privilege escalation vulnerability in SMC2.0 product. Some files in a directory of a module are located improperly. It does not apply the directory… |
CVE-2020-1866 | Medium | 6.5 | 2021-01-13 | There is an out-of-bounds read vulnerability in several products. The software reads data past the end of the intended buffer when parsing certain crafted DHCP… |
CVE-2020-1865 | Medium | 6.5 | 2021-01-13 | There is an out-of-bounds read vulnerability in Huawei CloudEngine products. The software reads data past the end of the intended buffer when parsing certain P… |
CVE-2020-14102 | High | 7.2 | 2021-01-13 | There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaom… |
CVE-2020-14101 | High | 7.5 | 2021-01-13 | The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiao… |
CVE-2020-14098 | High | 7.5 | 2021-01-13 | The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom v… |
CVE-2020-14097 | High | 7.5 | 2021-01-13 | Wrong nginx configuration, causing specific paths to be downloaded without authorization. This affects Xiaomi router AX6 ROM version < 1.0.18. |
CVE-2020-9203 | Low | 3.3 | 2021-01-13 | There is a resource management errors vulnerability in Huawei P30. Local attackers construct broadcast message for some application, causing this application t… |
CVE-2020-9143 | Medium | 5.3 | 2021-01-13 | There is a missing authentication vulnerability in some Huawei smartphone.Successful exploitation of this vulnerability may lead to low-sensitive information e… |
CVE-2020-9142 | Critical | 9.1 | 2021-01-13 | There is a heap base buffer overflow vulnerability in some Huawei smartphone.Successful exploitation of this vulnerability can cause heap overflow and memory o… |
CVE-2020-9141 | Critical | 9.1 | 2021-01-13 | There is a improper privilege management vulnerability in some Huawei smartphone. Successful exploitation of this vulnerability can cause information disclosur… |
CVE-2020-9140 | Critical | 9.8 | 2021-01-13 | There is a vulnerability with buffer access with incorrect length value in some Huawei Smartphone.Unauthorized users may trigger code execution when a buffer o… |
CVE-2020-9139 | Critical | 9.1 | 2021-01-13 | There is a improper input validation vulnerability in some Huawei Smartphone.Successful exploit of this vulnerability can cause memory access errors and denial… |
CVE-2020-9138 | Medium | 5.3 | 2021-01-13 | There is a heap-based buffer overflow vulnerability in some Huawei Smartphone, Successful exploit of this vulnerability can cause process exceptions during upd… |
CVE-2020-35578 | High | 7.2 | 2021-01-13 | An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload… |
CVE-2020-9145 | Critical | 9.1 | 2021-01-13 | There is an Out-of-bounds Write vulnerability in some Huawei smartphone. Successful exploitation of this vulnerability may cause out-of-bounds access to the ph… |
CVE-2020-27488 | Critical | 9.8 | 2021-01-13 | Loxone Miniserver devices with firmware before 11.1 (aka 11.1.9.3) are unable to use an authentication method that is based on the "signature of the update pac… |
CVE-2020-9144 | Critical | 9.8 | 2021-01-13 | There is a heap overflow vulnerability in some Huawei smartphone, attackers can exploit this vulnerability to cause heap overflows due to improper restriction… |
CVE-2020-4604 | Medium | 4.4 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID: 184861. |
CVE-2020-4602 | Medium | 4.4 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184836. |
CVE-2020-4600 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2020-4599 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2020-4597 | Medium | 4.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie valu… |
CVE-2020-4596 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4595 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4594 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-26262 | High | 7.2 | 2021-01-13 | Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to… |
CVE-2020-23653 | Critical | 9.8 | 2021-01-13 | An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/ap… |
CVE-2020-35687 | Medium | 4.3 | 2021-01-13 | PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim. |
CVE-2020-15221 | Medium | 6.8 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, by modifying target browser local storage, an XSS can be gener… |
CVE-2020-15220 | Medium | 6.1 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, two cookies are created for the same session, which leads to a… |
CVE-2020-15219 | Medium | 4.3 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, when a download error is triggered in the user portal, an SQL… |
CVE-2020-15218 | Medium | 6.8 | 2021-01-13 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 3.0.0, admin pages are cached, so that their content is visible after… |
CVE-2020-5686 | High | 7.5 | 2021-01-13 | Incorrect implementation of authentication algorithm issue in UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to access… |
CVE-2020-5685 | Critical | 9.8 | 2021-01-13 | UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service (DoS) cond… |
CVE-2020-5633 | Critical | 9.8 | 2021-01-13 | Multiple NEC products (Express5800/T110j, Express5800/T110j-S, Express5800/T110j (2nd-Gen), Express5800/T110j-S (2nd-Gen), iStorage NS100Ti, and Express5800/GT… |
CVE-2020-35686 | High | 7.8 | 2021-01-13 | The SECOMN service in Sound Research DCHU model software component modules (APO) through 2.0.9.17, delivered on HP Windows 10 computers, may allow escalation o… |
CVE-2020-36191 | Medium | 4.5 | 2021-01-13 | JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user ac… |
CVE-2020-28374 | High | 8.1 | 2021-01-13 | In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote att… |
CVE-2020-28395 | Medium | 5.9 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variant… |
CVE-2020-28391 | Medium | 5.9 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2020-28390 | Medium | 5.5 | 2021-01-12 | A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerab… |
CVE-2020-28386 | High | 7.8 | 2021-01-12 | A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack… |
CVE-2020-28384 | High | 7.8 | 2021-01-12 | A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack… |
CVE-2020-28383 | High | 7.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE202… |
CVE-2020-28382 | High | 7.8 | 2021-01-12 | A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack… |
CVE-2020-28381 | High | 7.8 | 2021-01-12 | A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack… |
CVE-2020-26996 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26995 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26994 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26993 | High | 7.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26992 | High | 7.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26991 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper… |
CVE-2020-26990 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper… |
CVE-2020-26989 | High | 7.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE202… |
CVE-2020-26988 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26987 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26986 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26985 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26984 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26983 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26982 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-26981 | Medium | 6.5 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). When opening a specially crafted xml… |
CVE-2020-26980 | High | 8.8 | 2021-01-12 | A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper val… |
CVE-2020-25226 | Critical | 9.8 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2020-15800 | Critical | 9.8 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2020-15799 | Medium | 6.5 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2020-4079 | High | 7.7 | 2021-01-12 | Combodo iTop is a web based IT Service Management tool. In iTop before versions 2.7.2 and 2.8.0, when the ajax endpoint for the "excel export" portal functiona… |
CVE-2020-36190 | Medium | 6.1 | 2021-01-12 | RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms. |
CVE-2020-13116 | Medium | 5.4 | 2021-01-12 | OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation. |
CVE-2020-27148 | High | 7.1 | 2021-01-12 | The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-on… |
CVE-2020-4838 | Medium | 5.4 | 2021-01-12 | IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |