2020 CVEs (page 50)

Page 50 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.

All CVEs published in 2020 — newest first (page 50 of 194)
CVESeverityScorePublishedSummary
CVE-2020-16020High8.82021-01-08Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process…
CVE-2020-16019High8.82021-01-08Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process…
CVE-2020-16018Critical9.62021-01-08Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a s…
CVE-2020-16017Critical9.62021-01-08Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perf…
CVE-2020-16016Critical9.62021-01-08Inappropriate implementation in base in Google Chrome prior to 86.0.4240.193 allowed a remote attacker who had compromised the renderer process to potentially…
CVE-2020-16015High8.82021-01-08Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
CVE-2020-16014Critical9.62021-01-08Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sand…
CVE-2020-16013High8.82021-01-08Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
CVE-2020-16012Medium4.32021-01-08Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2020-28208Medium5.32021-01-08An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
CVE-2020-26664High7.82021-01-08A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv fil…
CVE-2020-25678Medium4.42021-01-08A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for graf…
CVE-2020-17504High7.22021-01-08The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the ad…
CVE-2020-17503High7.22021-01-08The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the ad…
CVE-2020-17502High7.22021-01-08Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a…
CVE-2020-35131Critical9.82021-01-08Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.p…
CVE-2020-8584Critical9.82021-01-08Element OS versions prior to 1.8P1 and 12.2 are susceptible to a vulnerability that could allow an unauthenticated remote attacker to perform arbitrary code ex…
CVE-2020-5805High8.82021-01-08In Marvell QConvergeConsole GUI <= 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. OS-level users on the QCC host who are not authorized to…
CVE-2020-5804High8.12021-01-08Marvell QConvergeConsole GUI <= 5.5.0.74 is affected by a path traversal vulnerability. The deleteEventLogFile method of the GWTTestServiceImpl class lacks pro…
CVE-2020-27262Medium5.42021-01-08Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting (XSS) vulnerability exists in the affected products that allo…
CVE-2020-27260Medium5.32021-01-08Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically pro…
CVE-2020-4667Medium4.32021-01-08IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive information due to improper input validation…
CVE-2020-4666Medium5.42021-01-08IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript…
CVE-2020-4664Medium5.42021-01-08IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript…
CVE-2020-4663Medium5.42021-01-08IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript…
CVE-2020-4606Medium4.42021-01-08IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A local attacker could expl…
CVE-2020-7794Critical9.82021-01-08This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModu…
CVE-2020-7784Critical9.82021-01-08This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vu…
CVE-2020-28468High8.12021-01-08This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection…
CVE-2020-25950Medium4.32021-01-08Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery (CSRF) attacks that can delete a contact from the My Additional Contact page.
CVE-2020-24577High7.52021-01-08An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such…
CVE-2020-36049High7.52021-01-08socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
CVE-2020-36048High7.52021-01-08Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
CVE-2020-13452Critical9.82021-01-07In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can lead to d…
CVE-2020-13451Critical9.82021-01-07An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files a…
CVE-2020-13450Critical9.82021-01-07A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside th…
CVE-2020-13449High7.52021-01-07A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files.
CVE-2020-35745High8.82021-01-07PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, docto…
CVE-2020-17500Critical9.82021-01-07Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has a web administrati…
CVE-2020-6656Medium5.82021-01-07Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execu…
CVE-2020-6655Medium5.82021-01-07The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malic…
CVE-2020-4898High7.52021-01-07IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf…
CVE-2020-4897Medium5.32021-01-07IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when…
CVE-2020-4896Medium6.52021-01-07IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. I…
CVE-2020-4895Medium5.42021-01-07IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbi…
CVE-2020-4893Medium5.92021-01-07IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. This may lead to informatio…
CVE-2020-4892Medium5.42021-01-07IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2020-27835Medium4.42021-01-07A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user calls Ioctl after open dev file and fork. A…
CVE-2020-25680Medium5.42021-01-07A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation…
CVE-2020-13573High7.52021-01-07A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic 2.57.00.14 CPR 9 SR 3. A specially craft…
CVE-2020-25476Medium6.12021-01-07Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker…
CVE-2020-28672High7.22021-01-07MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution. At monofiles/category.php:27, user input can be save…
CVE-2020-26773High8.82021-01-07Restaurant Reservation System 1.0 suffers from an authenticated SQL injection vulnerability, which allows a remote, authenticated attacker to execute arbitrary…
CVE-2020-35114High8.82021-01-07Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and we presume that with enough e…
CVE-2020-35113High8.82021-01-07Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presu…
CVE-2020-35112High8.82021-01-07If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads d…
CVE-2020-35111Medium4.32021-01-07When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web co…
CVE-2020-26979Medium6.12021-01-07When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the…
CVE-2020-26978Medium6.12021-01-07Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on…
CVE-2020-26977Medium6.52021-01-07By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar displayed the original…
CVE-2020-26976Medium6.52021-01-07When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request…
CVE-2020-26975Medium6.52021-01-07When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to…
CVE-2020-26974High8.82021-01-07When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-af…
CVE-2020-26973High8.82021-01-07Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This vulnerab…
CVE-2020-26972Critical9.82021-01-07The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor…
CVE-2020-26971High8.82021-01-07Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Fire…
CVE-2020-26768Medium6.12021-01-07Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-tar…
CVE-2020-24903Medium6.12021-01-07Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could…
CVE-2020-24902Medium4.72021-01-07Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit…
CVE-2020-24901Medium6.12021-01-07The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, p…
CVE-2020-24900Medium6.12021-01-07The default installation of Krpano Panorama Viewer version <=1.20.8 is prone to Reflected XSS due to insecure XML load in file /viewer/krpano.html, parameter x…
CVE-2020-36183High8.12021-01-07FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib…
CVE-2020-36182High8.12021-01-07FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpd…
CVE-2020-36180High8.12021-01-07FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsada…
CVE-2020-36179High8.12021-01-07FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpd…
CVE-2020-26085Critical9.92021-01-07Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs o…
CVE-2020-36189High8.12021-01-06FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.l…
CVE-2020-36188High8.12021-01-06FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.l…
CVE-2020-36187High8.12021-01-06FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.data…
CVE-2020-36186High8.12021-01-06FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.data…
CVE-2020-36185High8.12021-01-06FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.dat…
CVE-2020-36184High8.12021-01-06FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.dat…
CVE-2020-36181High8.12021-01-06FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpds…
CVE-2020-35262Medium6.12021-01-06Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter.
CVE-2020-25498Medium4.82021-01-06Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter.
CVE-2020-8287Medium6.52021-01-06Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fiel…
CVE-2020-8281Medium5.42021-01-06A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting (XSS) attacks.
CVE-2020-8280Medium5.42021-01-06A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting (XSS) attacks.
CVE-2020-8275Medium4.32021-01-06Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored…
CVE-2020-8274Medium6.52021-01-06Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read…
CVE-2020-8265High8.12021-01-06Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socke…
CVE-2020-8264Medium6.12021-01-06In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in an…
CVE-2020-36178Critical9.82021-01-06oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (a…
CVE-2020-29041Medium5.32021-01-06A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehensio…
CVE-2020-36177Critical9.82021-01-06RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size.
CVE-2020-27283Medium5.32021-01-06An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak arbitrary memory locations.
CVE-2020-27279High7.52021-01-06A NULL pointer deference vulnerability has been identified in the protocol converter. An attacker could send a specially crafted packet that could reboot the d…
CVE-2020-8160Medium6.12021-01-06MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This…
CVE-2020-36176High7.52021-01-06The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until…
CVE-2020-36175Medium5.32021-01-06The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.