2020 CVEs (page 5)
Page 5 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-36859 | High | 8.8 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple SQL injection vulnerabilities in the object edit pag… |
CVE-2020-36858 | Medium | 5.4 | 2025-10-30 | Nagios Log Server versions prior to 2.1.6 contain cross-site scripting (XSS) vulnerabilities via the web interface on the Create User, Edit User, and Manage Ho… |
CVE-2020-36857 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 5.6.14 contain a post-authentication SQL injection vulnerability in the SNMP Trap Interface page. Exploitation requires an account… |
CVE-2020-36856 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM command_test.php script. Insufficient validation… |
CVE-2020-36855 | Medium | 5.3 | 2025-10-21 | A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of… |
CVE-2020-36854 | Medium | 6.4 | 2025-10-18 | The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing au… |
CVE-2020-36853 | High | 7.2 | 2025-10-18 | The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in versions up to, and including, 1.0.63 due t… |
CVE-2020-36852 | Critical | 9.1 | 2025-10-01 | The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a… |
CVE-2020-36851 | | 2025-09-25 | Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets… | |
CVE-2020-9322 | High | 8.8 | 2025-08-08 | The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScri… |
CVE-2020-36850 | | 2025-07-25 | An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended for one user to be… | |
CVE-2020-26799 | Critical | 9.8 | 2025-07-21 | A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users'… |
CVE-2020-36849 | Critical | 9.8 | 2025-07-12 | The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-i… |
CVE-2020-36848 | High | 7.5 | 2025-07-12 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi… |
CVE-2020-36847 | Critical | 9.8 | 2025-07-12 | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be u… |
CVE-2020-36846 | Critical | 9.8 | 2025-05-30 | A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of… |
CVE-2020-36791 | High | 7.8 | 2025-05-07 | In the Linux kernel, the following vulnerability has been resolved: net_sched: keep alloc_hash updated after hash allocation In commit 599be01ee567 ("net_sch… |
CVE-2020-36790 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a memory leak We forgot to free new_model_number |
CVE-2020-36845 | Medium | 5.3 | 2025-04-20 | The KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect function that does not validate the destination URL before redirectin… |
CVE-2020-36844 | Medium | 6.1 | 2025-04-20 | The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets window.location.href to… |
CVE-2020-36789 | Medium | 5.5 | 2025-04-17 | In the Linux kernel, the following vulnerability has been resolved: can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context If a driver… |
CVE-2020-18243 | Medium | 6.5 | 2025-04-15 | SQL injection vulnerability found in Enricozab CMS v.1.0 allows a remote attacker to execute arbitrary code via /hdo/hdo-view-case.php. |
CVE-2020-9295 | Medium | 4.7 | 2025-03-17 | FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 running AV engine version… |
CVE-2020-29010 | Medium | 5.0 | 2025-03-17 | An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authen… |
CVE-2020-36843 | Medium | 4.3 | 2025-03-13 | The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential… |
CVE-2020-23438 | High | 7.8 | 2025-03-04 | Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation. |
CVE-2020-3122 | Medium | 5.3 | 2025-03-04 | A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, re… |
CVE-2020-19248 | Medium | 5.1 | 2025-02-21 | SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in a malicious user's ability to contaminate template content by… |
CVE-2020-6158 | Medium | 4.7 | 2025-02-21 | Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into… |
CVE-2020-35546 | Critical | 9.1 | 2025-02-19 | Lexmark MX6500 LW75.JD.P296 and previous devices have Incorrect Access Control via the access control settings. |
CVE-2020-13481 | Medium | 6.1 | 2025-02-19 | Certain Lexmark products through 2020-05-25 allow XSS which allows an attacker to obtain session credentials and other sensitive information. |
CVE-2020-10095 | High | 8.1 | 2025-02-19 | Various Lexmark devices have CSRF that allows an attacker to modify the configuration of the device. |
CVE-2020-3432 | Medium | 5.6 | 2025-02-12 | A vulnerability in the uninstaller component of Cisco AnyConnect Secure Mobility Client for Mac OS could allow an authenticated, local attacker to corrupt the… |
CVE-2020-36085 | Medium | 6.3 | 2025-02-06 | Stored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers to inject arbitrary… |
CVE-2020-36084 | Critical | 9.8 | 2025-02-05 | SQL Injection vulnerability in SourceCodester Responsive E-Learning System 1.0 allows remote attackers to inject sql query in /elearning/delete_teacher_student… |
CVE-2020-11936 | Low | 3.1 | 2025-01-31 | gdbus setgid privilege escalation |
CVE-2020-8094 | High | 7.8 | 2025-01-15 | An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM… |
CVE-2020-1824 | Low | 3.7 | 2024-12-28 | There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some Huawei products. Th… |
CVE-2020-1823 | Low | 3.7 | 2024-12-28 | There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some Huawei products. Th… |
CVE-2020-1822 | Low | 3.7 | 2024-12-28 | There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some Huawei products. Th… |
CVE-2020-1821 | Low | 3.7 | 2024-12-28 | There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some Huawei products. Th… |
CVE-2020-1820 | Low | 3.7 | 2024-12-28 | There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some Huawei products. Th… |
CVE-2020-9253 | Medium | 6.3 | 2024-12-27 | There is a stack overflow vulnerability in some Huawei smart phone. An attacker can craft specific packet to exploit this vulnerability. Due to insufficient ve… |
CVE-2020-9236 | High | 8.8 | 2024-12-27 | There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. A… |
CVE-2020-9222 | High | 7.0 | 2024-12-27 | There is a privilege escalation vulnerability in Huawei FusionCompute product. Due to insufficient verification on specific files that need to be deserialized… |
CVE-2020-9211 | Medium | 6.4 | 2024-12-27 | There is an out-of-bound read and write vulnerability in Huawei smartphone. A module dose not verify the input sufficiently. Attackers can exploit this vulnera… |
CVE-2020-9210 | Medium | 6.8 | 2024-12-27 | There is an insufficient integrity vulnerability in Huawei products. A module does not perform sufficient integrity check in a specific scenario. Attackers can… |
CVE-2020-9089 | Low | 3.3 | 2024-12-27 | There is an information vulnerability in Huawei smartphones. A function in a module can be called without verifying the caller's access. Attackers with user ac… |
CVE-2020-9086 | Medium | 4.3 | 2024-12-27 | There is a buffer error vulnerability in some Huawei product. An unauthenticated attacker may send special UPNP message to the affected products. Due to insuff… |
CVE-2020-9085 | Medium | 5.3 | 2024-12-27 | There is a NULL pointer dereference vulnerability in some Huawei products. An attacker may send specially crafted POST messages to the affected products. Due t… |
CVE-2020-9082 | Low | 3.5 | 2024-12-27 | There is an information disclosure vulnerability in several smartphones. The system has a logic judging error under certain scenario, the attacker should gain… |
CVE-2020-9081 | Low | 3.5 | 2024-12-27 | There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of operation in specific mode to exploit this v… |
CVE-2020-9080 | High | 7.8 | 2024-12-27 | There is an improper privilege management vulnerability in Huawei smart phone product. A local, authenticated attacker could craft a specific input to exploit… |
CVE-2020-1819 | Low | 3.7 | 2024-12-27 | There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some Huawei products. Th… |
CVE-2020-1818 | Low | 3.7 | 2024-12-27 | There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some Huawei products. Th… |
CVE-2020-13712 | High | 7.8 | 2024-12-20 | A command injection is possible through the user interface, allowing arbitrary command execution as the root user. oMG2000 running MGOS 3.15.1 or earlier is a… |
CVE-2020-9250 | Low | 3.3 | 2024-12-20 | There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker can crafts software package to exploit thi… |
CVE-2020-6923 | Medium | 5.7 | 2024-12-19 | The HP Linux Imaging and Printing (HPLIP) software may potentially be affected by memory buffer overflow. |
CVE-2020-15934 | High | 8.8 | 2024-12-19 | An execution with unnecessary privileges vulnerability in the VCM engine of FortiClient for Linux versions 6.2.7 and below, version 6.4.0. may allow local user… |
CVE-2020-12820 | Medium | 5.4 | 2024-12-19 | Under non-default configuration, a stack-based buffer overflow in FortiOS version 6.0.10 and below, version 5.6.12 and below may allow a remote attacker authen… |
CVE-2020-12819 | Medium | 5.4 | 2024-12-19 | A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 and 6.4.1 and earlie… |
CVE-2020-12487 | High | 7.0 | 2024-12-17 | Due to the flaws in the verification of input parameters, the attacker can input carefully constructed commands to make the ABE service execute some commands w… |
CVE-2020-12484 | Medium | 6.4 | 2024-12-17 | When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterprise wifi through a ca… |
CVE-2020-28398 | High | 8.8 | 2024-12-10 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (Al… |
CVE-2020-12492 | | 2024-11-25 | Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information. | |
CVE-2020-12491 | | 2024-11-25 | Improper control of framework service permissions with possibility of some sensitive device information leakage. | |
CVE-2020-26067 | Medium | 5.4 | 2024-11-18 | A vulnerability in the web-based interface of Cisco Webex Teams could allow an authenticated, remote attacker to conduct cross-site scripting attacks. Th… |
CVE-2020-26066 | Medium | 6.5 | 2024-11-18 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information… |
CVE-2020-3548 | Medium | 5.3 | 2024-11-18 | A vulnerability in the Transport Layer Security (TLS) protocol implementation of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) coul… |
CVE-2020-3539 | Medium | 6.3 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to view, modify… |
CVE-2020-3538 | Medium | 4.6 | 2024-11-18 | A vulnerability in a certain REST API endpoint of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to perfo… |
CVE-2020-3532 | Medium | 6.1 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Managemen… |
CVE-2020-3525 | Medium | 4.3 | 2024-11-18 | A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to recover service account passw… |
CVE-2020-3431 | Medium | 6.1 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco Small Business RV042 Dual WAN VPN Routers and Cisco Small Business RV042G Dual Gigabit… |
CVE-2020-3420 | Medium | 5.4 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2020-27124 | High | 8.6 | 2024-11-18 | A vulnerability in the SSL/TLS handler of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause the af… |
CVE-2020-26074 | High | 7.8 | 2024-11-18 | A vulnerability in system file transfer functions of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to gain escalated privileg… |
CVE-2020-26073 | High | 7.5 | 2024-11-18 | A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to gain access to sensi… |
CVE-2020-26071 | High | 8.4 | 2024-11-18 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to create or overwrite arbitrary files on an affected dev… |
CVE-2020-26063 | Medium | 5.4 | 2024-11-18 | A vulnerability in the API endpoints of Cisco Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and t… |
CVE-2020-26062 | Medium | 5.3 | 2024-11-18 | A vulnerability in Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to enumerate valid usernames within the vulnerab… |
CVE-2020-25720 | High | 7.5 | 2024-11-17 | A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the new… |
CVE-2020-10370 | High | 8.8 | 2024-11-11 | Certain Cypress (and Broadcom) Wireless Combo chips such as CYW43455, when a 2021-01-26 Bluetooth firmware update is not present, allow a Bluetooth outage via… |
CVE-2020-10369 | Medium | 5.5 | 2024-11-10 | Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory content via a "Spectra"… |
CVE-2020-10368 | Low | 3.5 | 2024-11-10 | Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory read access via a "Spectra" attack. |
CVE-2020-10367 | Medium | 5.5 | 2024-11-10 | Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra" attack. |
CVE-2020-8007 | Critical | 9.8 | 2024-11-08 | The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via three fields of the c… |
CVE-2020-11926 | High | 7.5 | 2024-11-07 | An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Clients can authenticate themselves to the device using a username and password. Th… |
CVE-2020-11921 | High | 8.8 | 2024-11-07 | An issue was discovered in Lush 2 through 2020-02-25. Due to the lack of Bluetooth traffic encryption, it is possible to hijack an ongoing Bluetooth connection… |
CVE-2020-11919 | High | 8.0 | 2024-11-07 | An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. There is no CSRF protection. |
CVE-2020-11918 | Medium | 5.4 | 2024-11-07 | An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. When a backup file is created through the web interface, information on all users, including… |
CVE-2020-11917 | Medium | 4.3 | 2024-11-07 | An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. It uses a default SSID value, which makes it easier for remote attackers to discover the phy… |
CVE-2020-11916 | Medium | 6.3 | 2024-11-07 | An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. The password for the root user is hashed using an old and deprecated hashing technique. Beca… |
CVE-2020-11859 | High | 7.6 | 2024-11-06 | Improper Input Validation vulnerability in OpenText iManager allows Cross-Site Scripting (XSS). This issue affects iManager before 3.2.3 |
CVE-2020-26311 | High | 7.5 | 2024-10-26 | Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Exp… |
CVE-2020-26310 | | 2024-10-26 | Validate.js provides a declarative way of validating javascript objects. All versions as of 30 November 2020 contain one or more regular expressions that are v… | |
CVE-2020-26309 | | 2024-10-26 | Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable… | |
CVE-2020-26308 | High | 7.5 | 2024-10-26 | Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions that are vulnerable… |
CVE-2020-26307 | | 2024-10-26 | HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expressions that are vuln… | |
CVE-2020-26306 | | 2024-10-26 | Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior contain one or mor… |