2020 CVEs (page 51)
Page 51 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-36174 | Medium | 6.5 | 2021-01-06 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. |
CVE-2020-36173 | Medium | 5.3 | 2021-01-06 | The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields. |
CVE-2020-36172 | Medium | 6.1 | 2021-01-06 | The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS. |
CVE-2020-36171 | Medium | 6.1 | 2021-01-06 | The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads. |
CVE-2020-27285 | Critical | 9.1 | 2021-01-06 | The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify the database without authentication. |
CVE-2020-13545 | High | 7.8 | 2021-01-06 | An exploitable signed conversion vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application. A speci… |
CVE-2020-13544 | High | 7.8 | 2021-01-06 | An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application. A speciall… |
CVE-2020-8884 | High | 8.8 | 2021-01-06 | rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows remote authenticated users to execute arb… |
CVE-2020-36170 | Medium | 5.3 | 2021-01-06 | The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms. |
CVE-2020-10658 | Critical | 9.8 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteImage AP… |
CVE-2020-10657 | High | 7.2 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM web console's ImportAlertRules fea… |
CVE-2020-10656 | Critical | 9.8 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMo… |
CVE-2020-10655 | Critical | 9.8 | 2021-01-06 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMo… |
CVE-2020-4336 | Medium | 5.3 | 2021-01-06 | IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access t… |
CVE-2020-26759 | Critical | 9.8 | 2021-01-06 | clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server re… |
CVE-2020-36169 | Critical | 9.3 | 2021-01-06 | An issue was discovered in Veritas NetBackup through 8.3.0.1 and OpsCenter through 8.3.0.1. Processes using OpenSSL attempt to load and execute libraries from… |
CVE-2020-36168 | Critical | 9.3 | 2021-01-06 | An issue was discovered in Veritas Resiliency Platform 3.4 and 3.5. It leverages OpenSSL on Windows systems when using the Managed Host addon. On start-up, it… |
CVE-2020-36167 | Critical | 9.3 | 2021-01-06 | An issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before hotfix 298543, and 21.1 before hotfix 657517. On start-up, it loads the… |
CVE-2020-36166 | Critical | 9.3 | 2021-01-06 | An issue was discovered in Veritas InfoScale 7.x through 7.4.2 on Windows, Storage Foundation through 6.1 on Windows, Storage Foundation HA through 6.1 on Wind… |
CVE-2020-36165 | Critical | 9.3 | 2021-01-06 | An issue was discovered in Veritas Desktop and Laptop Option (DLO) before 9.4. On start-up, it loads the OpenSSL library from /ReleaseX64/ssl. This library att… |
CVE-2020-36164 | Critical | 9.3 | 2021-01-06 | An issue was discovered in Veritas Enterprise Vault through 14.0. On start-up, it loads the OpenSSL library. The OpenSSL library then attempts to load the open… |
CVE-2020-36163 | Critical | 9.3 | 2021-01-06 | An issue was discovered in Veritas NetBackup and OpsCenter through 8.3.0.1. NetBackup processes using Strawberry Perl attempt to load and execute libraries fro… |
CVE-2020-36162 | Critical | 9.3 | 2021-01-06 | An issue was discovered in Veritas CloudPoint before 8.3.0.1+hotfix. The CloudPoint Windows Agent leverages OpenSSL. This OpenSSL library attempts to load the… |
CVE-2020-36161 | High | 8.8 | 2021-01-06 | An issue was discovered in Veritas APTARE 10.4 before 10.4P9 and 10.5 before 10.5P3. By default, on Windows systems, users can create directories under C:\. A… |
CVE-2020-36160 | Critical | 9.3 | 2021-01-06 | An issue was discovered in Veritas System Recovery before 21.2. On start-up, it loads the OpenSSL library from \usr\local\ssl. This library attempts to load th… |
CVE-2020-7336 | Medium | 6.6 | 2021-01-05 | Cross Site Request Forgery vulnerability in McAfee Network Security Management (NSM) prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to… |
CVE-2020-36052 | Critical | 9.8 | 2021-01-05 | Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter. |
CVE-2020-36051 | High | 7.5 | 2021-01-05 | Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter. |
CVE-2020-35170 | Medium | 6.3 | 2021-01-05 | Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 an… |
CVE-2020-29502 | High | 7.5 | 2021-01-05 | Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticat… |
CVE-2020-29501 | Medium | 6.4 | 2021-01-05 | Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticat… |
CVE-2020-29500 | High | 7.5 | 2021-01-05 | Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments. A locally authenticated a… |
CVE-2020-29490 | High | 7.5 | 2021-01-05 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS exports. A remote auth… |
CVE-2020-29489 | Medium | 6.4 | 2021-01-05 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials (including the… |
CVE-2020-26199 | Medium | 6.4 | 2021-01-05 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials (including the U… |
CVE-2020-26181 | High | 7.0 | 2021-01-05 | Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SmartLock Compliance… |
CVE-2020-23250 | Low | 2.3 | 2021-01-05 | GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database. |
CVE-2020-23249 | Medium | 4.7 | 2021-01-05 | GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext. |
CVE-2020-36067 | High | 7.5 | 2021-01-05 | GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call. |
CVE-2020-36066 | High | 7.5 | 2021-01-05 | GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON. |
CVE-2020-29437 | High | 8.1 | 2021-01-05 | SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/l… |
CVE-2020-36159 | Medium | 5.3 | 2021-01-05 | Veritas Desktop and Laptop Option (DLO) before 9.5 disclosed operational information on the backup processing status through a URL that did not require authent… |
CVE-2020-29478 | High | 7.5 | 2021-01-05 | CA Service Catalog 17.2 and 17.3 contain a vulnerability in the default configuration of the Setup Utility that may allow a remote attacker to cause a denial o… |
CVE-2020-27845 | Medium | 5.5 | 2021-01-05 | There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encod… |
CVE-2020-27844 | High | 7.8 | 2021-01-05 | A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conver… |
CVE-2020-27843 | Medium | 5.5 | 2021-01-05 | A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding function… |
CVE-2020-27842 | Medium | 5.5 | 2021-01-05 | There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a… |
CVE-2020-27841 | Medium | 5.5 | 2021-01-05 | There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpe… |
CVE-2020-13541 | High | 8.8 | 2021-01-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directory. Depending on the… |
CVE-2020-13540 | High | 7.8 | 2021-01-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via WIN-911 A… |
CVE-2020-13539 | High | 7.8 | 2021-01-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via “WIN-911… |
CVE-2020-7202 | Medium | 5.3 | 2021-01-05 | A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4) firmware. The vulnerability c… |
CVE-2020-4899 | Critical | 9.1 | 2021-01-05 | IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or allow for data corruption due to plain text transmission of sensitive… |
CVE-2020-4762 | High | 8.8 | 2021-01-05 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow an authenticated user to create a priv… |
CVE-2020-4761 | Medium | 5.3 | 2021-01-05 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive… |
CVE-2020-35488 | High | 7.5 | 2021-01-05 | The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted S… |
CVE-2020-26046 | Medium | 5.4 | 2021-01-05 | FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be e… |
CVE-2020-26045 | Critical | 9.8 | 2021-01-05 | FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the applica… |
CVE-2020-17519 | High | 7.5 | 2021-01-05 | A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobMana… |
CVE-2020-17518 | High | 7.5 | 2021-01-05 | Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously… |
CVE-2020-36158 | High | 8.8 | 2021-01-05 | mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbit… |
CVE-2020-5361 | Medium | 5.1 | 2021-01-04 | Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customers who forget their… |
CVE-2020-29498 | Medium | 6.1 | 2021-01-04 | Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote unauthenticated attacker could potentially exploit this vulne… |
CVE-2020-29497 | Medium | 5.4 | 2021-01-04 | Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with low privileges… |
CVE-2020-29496 | Medium | 4.8 | 2021-01-04 | Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with high privilege… |
CVE-2020-29492 | Critical | 10.0 | 2021-01-04 | Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit th… |
CVE-2020-29491 | Critical | 10.0 | 2021-01-04 | Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit th… |
CVE-2020-26297 | High | 8.2 | 2021-01-04 | mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerability affectin… |
CVE-2020-26294 | High | 7.4 | 2021-01-04 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnera… |
CVE-2020-26293 | Medium | 6.1 | 2021-01-04 | HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372… |
CVE-2020-36157 | Critical | 10.0 | 2021-01-04 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of… |
CVE-2020-36156 | Critical | 9.9 | 2021-01-04 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-… |
CVE-2020-36155 | Critical | 10.0 | 2021-01-04 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could su… |
CVE-2020-35219 | Critical | 9.8 | 2021-01-04 | The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authentication via a POST r… |
CVE-2020-26292 | Low | 3.1 | 2021-01-04 | Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary re… |
CVE-2020-36154 | High | 7.8 | 2021-01-04 | The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEMDRIVE%\Pearson VUE" directory, which all… |
CVE-2020-25275 | High | 7.5 | 2021-01-04 | Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices fo… |
CVE-2020-24386 | Medium | 6.8 | 2021-01-04 | An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, l… |
CVE-2020-36112 | Critical | 9.8 | 2021-01-04 | CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php and in c… |
CVE-2020-35507 | Medium | 5.5 | 2021-01-04 | There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted… |
CVE-2020-35496 | Medium | 5.5 | 2021-01-04 | There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by o… |
CVE-2020-35495 | Medium | 5.5 | 2021-01-04 | There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer… |
CVE-2020-35494 | Medium | 6.1 | 2021-01-04 | There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninit… |
CVE-2020-35493 | Medium | 5.5 | 2021-01-04 | A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-… |
CVE-2020-22550 | High | 7.5 | 2021-01-04 | Veno File Manager 3.5.6 is affected by a directory traversal vulnerability. Using the traversal allows an attacker to download sensitive files from the server. |
CVE-2020-4942 | High | 8.8 | 2021-01-04 | IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unautho… |
CVE-2020-4928 | Medium | 6.7 | 2021-01-04 | IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request and modifying the file extention, the a… |
CVE-2020-4919 | Low | 3.8 | 2021-01-04 | IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system. IBM X-F… |
CVE-2020-4918 | Medium | 4.4 | 2021-01-04 | IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direct object reference in sell service conso… |
CVE-2020-4917 | High | 8.8 | 2021-01-04 | IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted fr… |
CVE-2020-4916 | Medium | 4.8 | 2021-01-04 | IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2020-4913 | Medium | 4.4 | 2021-01-04 | IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-Force ID: 191288. |
CVE-2020-4912 | High | 7.2 | 2021-01-04 | IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-F… |
CVE-2020-4910 | Medium | 4.8 | 2021-01-04 | IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2020-4909 | Medium | 4.8 | 2021-01-04 | IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2020-7771 | High | 7.5 | 2021-01-04 | The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function. |
CVE-2020-28464 | Critical | 9.8 | 2021-01-04 | This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine. |
CVE-2020-35965 | High | 7.5 | 2021-01-04 | decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations. |
CVE-2020-35964 | Medium | 6.5 | 2021-01-03 | track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing. |
CVE-2020-35963 | High | 7.8 | 2021-01-03 | flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-… |