2020 CVEs (page 49)
Page 49 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4674 | Medium | 4.3 | 2021-01-12 | IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-Force ID: 186287. |
CVE-2020-4673 | Medium | 4.3 | 2021-01-12 | IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286. |
CVE-2020-35459 | High | 7.8 | 2021-01-12 | An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via sh… |
CVE-2020-35458 | Critical | 9.8 | 2021-01-12 | An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_… |
CVE-2020-26713 | Medium | 6.1 | 2021-01-12 | REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the r… |
CVE-2020-26712 | Critical | 9.8 | 2021-01-12 | REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information… |
CVE-2020-25657 | Medium | 5.9 | 2021-01-12 | A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed proce… |
CVE-2020-14341 | Low | 2.7 | 2021-01-12 | The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempt… |
CVE-2020-14275 | Critical | 9.8 | 2021-01-12 | Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of us… |
CVE-2020-14274 | High | 7.5 | 2021-01-12 | Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain user personal data… |
CVE-2020-35655 | Medium | 5.4 | 2021-01-12 | In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled. |
CVE-2020-35654 | High | 8.8 | 2021-01-12 | In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF… |
CVE-2020-35653 | High | 7.1 | 2021-01-12 | In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculat… |
CVE-2020-24701 | Medium | 6.1 | 2021-01-12 | OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI). |
CVE-2020-24700 | Medium | 5.4 | 2021-01-12 | OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. substring. |
CVE-2020-27637 | Critical | 9.8 | 2021-01-12 | The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability… |
CVE-2020-26050 | High | 7.8 | 2021-01-12 | SaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low privileged users to SYSTEM via a crafted openssl configuratio… |
CVE-2020-16146 | High | 7.5 | 2021-01-12 | Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buffer Overflow in Blu… |
CVE-2020-0471 | Critical | 9.8 | 2021-01-11 | In reassemble_and_dispatch of packet_fragmenter.cc, there is a possible way to inject packets into an encrypted Bluetooth connection due to improper input vali… |
CVE-2020-27059 | High | 7.8 | 2021-01-11 | In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This c… |
CVE-2020-24027 | Critical | 9.8 | 2021-01-11 | In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the comma… |
CVE-2020-23631 | Medium | 6.1 | 2021-01-11 | Cross-site request forgery (CSRF) in admin/global/manage.php in WDJA CMS 1.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via the tong… |
CVE-2020-26298 | Medium | 6.8 | 2021-01-11 | Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scrip… |
CVE-2020-24025 | Medium | 5.3 | 2021-01-11 | Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. |
CVE-2020-13559 | High | 7.5 | 2021-01-11 | A denial-of-service vulnerability exists in the traffic-logging functionality of FreyrSCADA IEC-60879-5-104 Server Simulator 21.04.028. A specially crafted pac… |
CVE-2020-4869 | Medium | 6.5 | 2021-01-11 | IBM MQ Appliance 9.2 CD and 9.2 LTS is vulnerable to a denial of service, caused by a buffer overflow. A remote attacker could send a specially crafted SNMP qu… |
CVE-2020-35701 | High | 8.8 | 2021-01-11 | An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitra… |
CVE-2020-27293 | High | 7.8 | 2021-01-11 | Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a type confusion issue while processing project files, which may allow an attacker to execute arbitr… |
CVE-2020-27291 | High | 7.8 | 2021-01-11 | Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to ex… |
CVE-2020-27289 | High | 7.8 | 2021-01-11 | Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a null pointer dereference issue while processing project files, which may allow an attacker to exec… |
CVE-2020-27287 | High | 7.8 | 2021-01-11 | Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to e… |
CVE-2020-27281 | High | 7.8 | 2021-01-11 | A stack-based buffer overflow may exist in Delta Electronics CNCSoft ScreenEditor versions 1.01.26 and prior when processing specially crafted project files, w… |
CVE-2020-27277 | High | 7.8 | 2021-01-11 | Delta Electronics DOPSoft Version 4.0.8.21 and prior has a null pointer dereference issue while processing project files, which may allow an attacker to execut… |
CVE-2020-27275 | High | 7.8 | 2021-01-11 | Delta Electronics DOPSoft Version 4.0.8.21 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to exe… |
CVE-2020-25659 | Medium | 5.9 | 2021-01-11 | python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext. |
CVE-2020-24003 | Low | 3.3 | 2021-01-11 | Microsoft Skype through 8.59.0.77 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtain… |
CVE-2020-23960 | High | 8.8 | 2021-01-11 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as… |
CVE-2020-17534 | High | 7.0 | 2021-01-11 | There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API ve… |
CVE-2020-35483 | High | 7.8 | 2021-01-11 | AnyDesk before 6.1.0 on Windows, when run in portable mode on a system where the attacker has write access to the application directory, allows this attacker t… |
CVE-2020-2508 | High | 7.2 | 2021-01-11 | A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary command… |
CVE-2020-26118 | High | 8.8 | 2021-01-11 | In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerabilit… |
CVE-2020-23630 | High | 8.8 | 2021-01-11 | A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection). |
CVE-2020-23849 | Medium | 6.1 | 2021-01-11 | Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript. |
CVE-2020-23644 | Medium | 6.1 | 2021-01-11 | XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php. |
CVE-2020-23643 | Medium | 6.1 | 2021-01-11 | XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php. |
CVE-2020-26800 | Medium | 5.5 | 2021-01-11 | A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a specially crafted a config.json file may result in a denial of service. |
CVE-2020-17509 | High | 7.5 | 2021-01-11 | ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Se… |
CVE-2020-17508 | High | 7.5 | 2021-01-11 | The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0… |
CVE-2020-13922 | Medium | 6.5 | 2021-01-11 | Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface. |
CVE-2020-11995 | Critical | 9.8 | 2021-01-11 | A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as… |
CVE-2020-35727 | Medium | 5.4 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseD… |
CVE-2020-35726 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/… |
CVE-2020-35725 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/… |
CVE-2020-35724 | Medium | 5.4 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the Error.j… |
CVE-2020-35723 | Medium | 5.4 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the ReportP… |
CVE-2020-35722 | Medium | 6.5 | 2021-01-11 | CSRF in Web Compliance Manager in Quest Policy Authority 8.1.2.200 allows remote attackers to force user modification/creation via a specially crafted link to… |
CVE-2020-35721 | Medium | 5.4 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseA… |
CVE-2020-35720 | Medium | 5.4 | 2021-01-11 | Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (first name, last name, and logon name) when… |
CVE-2020-35719 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/… |
CVE-2020-35206 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially… |
CVE-2020-35205 | Critical | 9.8 | 2021-01-11 | Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal ports and make outbo… |
CVE-2020-35204 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the Policy… |
CVE-2020-35203 | Medium | 6.1 | 2021-01-11 | Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially… |
CVE-2020-5147 | Medium | 5.3 | 2021-01-09 | SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to gain elevated privileges in the host op… |
CVE-2020-5146 | High | 7.2 | 2021-01-09 | A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerabi… |
CVE-2020-4733 | Medium | 5.4 | 2021-01-08 | IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2020-4697 | Medium | 5.4 | 2021-01-08 | IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2020-4691 | Medium | 5.4 | 2021-01-08 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2020-4544 | Medium | 4.3 | 2021-01-08 | IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2020-4487 | Medium | 4.3 | 2021-01-08 | IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2020-5022 | Medium | 5.3 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining infor… |
CVE-2020-5021 | Medium | 4.4 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user o… |
CVE-2020-5020 | Medium | 6.1 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a ma… |
CVE-2020-5019 | Medium | 6.5 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending… |
CVE-2020-5018 | High | 7.5 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being caputured by an att… |
CVE-2020-5017 | Medium | 5.5 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permissions. IBM X-Force… |
CVE-2020-26186 | Medium | 6.8 | 2021-01-08 | Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to system memory may… |
CVE-2020-16043 | High | 8.8 | 2021-01-08 | Insufficient data validation in networking in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to bypass discretionary access control via malicio… |
CVE-2020-16042 | Medium | 6.5 | 2021-01-08 | Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a… |
CVE-2020-16041 | High | 8.1 | 2021-01-08 | Out of bounds read in networking in Google Chrome prior to 87.0.4280.88 allowed a remote attacker who had compromised the renderer process to obtain potentiall… |
CVE-2020-16040 | Medium | 6.5 | 2021-01-08 | Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-16039 | High | 8.8 | 2021-01-08 | Use after free in extensions in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16038 | High | 8.8 | 2021-01-08 | Use after free in media in Google Chrome on OS X prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16037 | High | 8.8 | 2021-01-08 | Use after free in clipboard in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16036 | Medium | 6.5 | 2021-01-08 | Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass cookie restrictions via a crafted HTML page. |
CVE-2020-16035 | High | 8.8 | 2021-01-08 | Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process… |
CVE-2020-16034 | Medium | 4.3 | 2021-01-08 | Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to bypass policy restrictions via a crafted HTML page. |
CVE-2020-16033 | Medium | 4.3 | 2021-01-08 | Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-16032 | Medium | 4.3 | 2021-01-08 | Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2020-16031 | Medium | 4.3 | 2021-01-08 | Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
CVE-2020-16030 | Medium | 6.1 | 2021-01-08 | Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2020-16029 | High | 8.8 | 2021-01-08 | Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass navigation restrictions via a crafted PDF fil… |
CVE-2020-16028 | High | 8.8 | 2021-01-08 | Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16027 | Medium | 6.5 | 2021-01-08 | Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2020-16026 | High | 8.8 | 2021-01-08 | Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16025 | Critical | 9.6 | 2021-01-08 | Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perf… |
CVE-2020-16024 | Critical | 9.6 | 2021-01-08 | Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2020-16023 | High | 8.8 | 2021-01-08 | Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16022 | High | 8.8 | 2021-01-08 | Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a cr… |
CVE-2020-16021 | High | 7.5 | 2021-01-08 | Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to perform OS-level p… |