2020 CVEs (page 53)
Page 53 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-35901 | High | 7.5 | 2020-12-31 | An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream. |
CVE-2020-35900 | Medium | 5.5 | 2020-12-31 | An issue was discovered in the array-queue crate through 2020-09-26 for Rust. A pop_back() call may lead to a use-after-free. |
CVE-2020-35899 | Medium | 5.5 | 2020-12-31 | An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same… |
CVE-2020-35898 | Critical | 9.1 | 2020-12-31 | An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same da… |
CVE-2020-35851 | High | 8.1 | 2020-12-31 | HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute ar… |
CVE-2020-35743 | High | 7.0 | 2020-12-31 | HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages. |
CVE-2020-35742 | High | 7.0 | 2020-12-31 | HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter. |
CVE-2020-35741 | High | 7.0 | 2020-12-31 | HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks. |
CVE-2020-35740 | High | 7.0 | 2020-12-31 | HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks. |
CVE-2020-25850 | High | 8.1 | 2020-12-31 | The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary syste… |
CVE-2020-25848 | Critical | 9.8 | 2020-12-31 | HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism. |
CVE-2020-25846 | High | 7.5 | 2020-12-31 | The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a maliciou… |
CVE-2020-25845 | High | 7.5 | 2020-12-31 | Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malicious host, resulting… |
CVE-2020-25844 | High | 8.1 | 2020-12-31 | The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole. Remote attackers… |
CVE-2020-25843 | High | 8.1 | 2020-12-31 | NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers can use the leak to… |
CVE-2020-25842 | High | 7.5 | 2020-12-31 | The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without… |
CVE-2020-19664 | High | 8.8 | 2020-12-31 | DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi. |
CVE-2020-17363 | Critical | 9.9 | 2020-12-31 | USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter to LastHundredReque… |
CVE-2020-13654 | High | 7.5 | 2020-12-31 | XWiki Platform before 12.8 mishandles escaping in the property displayer. |
CVE-2020-12658 | Critical | 9.8 | 2020-12-31 | gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We… |
CVE-2020-11947 | Low | 3.8 | 2020-12-31 | iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker. |
CVE-2020-26291 | Medium | 6.5 | 2020-12-31 | URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) charac… |
CVE-2020-27534 | Medium | 5.3 | 2020-12-30 | util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed wit… |
CVE-2020-26296 | High | 8.7 | 2020-12-30 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega befo… |
CVE-2020-28413 | Medium | 5.3 | 2020-12-30 | In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP. |
CVE-2020-28095 | High | 7.5 | 2020-12-30 | On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will trigger the router to crash and enter an… |
CVE-2020-11103 | Critical | 9.8 | 2020-12-30 | JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution. |
CVE-2020-35737 | High | 7.5 | 2020-12-30 | In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIn… |
CVE-2020-35173 | Critical | 9.8 | 2020-12-30 | The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server (aka services.ftpservice.FTPRecei… |
CVE-2020-26288 | High | 7.7 | 2020-12-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server be… |
CVE-2020-35849 | High | 7.5 | 2020-12-30 | An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bug_revision_view_page.php allows an unprivileged attacker to view the Summary… |
CVE-2020-29231 | Medium | 5.4 | 2020-12-30 | EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page. This vulnerability c… |
CVE-2020-29230 | Medium | 6.1 | 2020-12-30 | EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Panel - Manage User tab using the… |
CVE-2020-29228 | High | 7.5 | 2020-12-30 | EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Page. |
CVE-2020-28925 | Medium | 5.3 | 2020-12-30 | Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Your PHP for Better… |
CVE-2020-28736 | High | 8.8 | 2020-12-30 | Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only availabl… |
CVE-2020-28735 | High | 8.8 | 2020-12-30 | Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). |
CVE-2020-28734 | High | 8.8 | 2020-12-30 | Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. |
CVE-2020-28365 | Medium | 6.1 | 2020-12-30 | Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For HTTP header during the login process. W… |
CVE-2020-27848 | High | 8.8 | 2020-12-30 | dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorOrdered classes that are used to paginate… |
CVE-2020-26247 | Low | 2.6 | 2020-12-30 | Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE v… |
CVE-2020-5811 | Medium | 6.5 | 2020-12-30 | An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files bein… |
CVE-2020-5810 | Medium | 5.4 | 2020-12-30 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which a… |
CVE-2020-5809 | Medium | 5.4 | 2020-12-30 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing cont… |
CVE-2020-35241 | Medium | 4.8 | 2020-12-30 | FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in… |
CVE-2020-35240 | Medium | 4.8 | 2020-12-30 | FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in "Bl… |
CVE-2020-29477 | Medium | 4.8 | 2020-12-30 | Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload… |
CVE-2020-29469 | Medium | 5.4 | 2020-12-30 | WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Sett… |
CVE-2020-29233 | Medium | 5.4 | 2020-12-30 | WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allow an attacker to inject the XSS payload… |
CVE-2020-29594 | Critical | 9.8 | 2020-12-30 | Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login. |
CVE-2020-35850 | Medium | 6.5 | 2020-12-30 | An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states "I don't thin… |
CVE-2020-35848 | Critical | 9.8 | 2020-12-30 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. |
CVE-2020-35847 | Critical | 9.8 | 2020-12-30 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. |
CVE-2020-35846 | Critical | 9.8 | 2020-12-30 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. |
CVE-2020-35842 | Medium | 6.9 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JNR1010v2 before 1.1.0.62, JR6150 before 1.0.1… |
CVE-2020-35841 | Medium | 6.9 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JNR1010v2 before 1.1.0.62, JR6150 before 1.0.1… |
CVE-2020-35840 | Medium | 6.9 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JNR1010v2 before 1.1.0.62, JR6150 before 1.0.1… |
CVE-2020-35839 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by Stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-35838 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35837 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35836 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35835 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35834 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-35833 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-35832 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-35831 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-35830 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35829 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.74, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RA… |
CVE-2020-35828 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, RBK20 before 2.3.5.26, RBR20 before 2.3.5.26, RBS20 before 2.3.5.26, RB… |
CVE-2020-35827 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, R7… |
CVE-2020-35826 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35825 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35824 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35823 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35822 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35821 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.74, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RA… |
CVE-2020-35820 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35819 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35818 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35817 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35816 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35815 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35814 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.74, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RA… |
CVE-2020-35813 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, RB… |
CVE-2020-35812 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-35811 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-35810 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35809 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35808 | Medium | 4.8 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.63, DM200 before 1.0.0.61, R7800 before 1.0.2.52, R8900 before 1.0.4.12, R9… |
CVE-2020-35807 | Medium | 6.0 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, RAX120 before 1.0.0.78, RBK22 before 2.3.5.26, R… |
CVE-2020-35806 | Medium | 6.0 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, RAX120 before 1.0.0.78… |
CVE-2020-35805 | Medium | 6.1 | 2020-12-30 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28… |
CVE-2020-35804 | High | 7.6 | 2020-12-30 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects D7800 before 1.0.1.58, R7800 before 1.0.2.74, R8900 before 1.0.5.18… |
CVE-2020-35803 | Medium | 4.4 | 2020-12-30 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.46… |
CVE-2020-35802 | High | 7.5 | 2020-12-30 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects CBR40 before 2.5.0.14, RBW30 before 2.6.1.4, RAX75 before 1.0.3.102… |
CVE-2020-35801 | High | 8.3 | 2020-12-30 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524P… |
CVE-2020-35800 | Critical | 9.4 | 2020-12-30 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects AC2100 before 1.2.0.72, AC2400 before 1.2.0.72, AC2600 befor… |
CVE-2020-35799 | High | 8.8 | 2020-12-30 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.78… |
CVE-2020-35798 | Critical | 9.3 | 2020-12-30 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1.0.4.84, R6700v3 before 1.0.4.84, R6900P… |
CVE-2020-35797 | Critical | 9.8 | 2020-12-30 | NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an unauthenticated attacker. |