2020 CVEs (page 56)
Page 56 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-5681 | High | 7.8 | 2020-12-24 | Untrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager versions 2.2.14 and earlier, and Offirio SynergyWare PrintDirecto… |
CVE-2020-2505 | Low | 2.3 | 2020-12-24 | If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in Q… |
CVE-2020-2504 | Medium | 5.8 | 2020-12-24 | If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2… |
CVE-2020-2503 | Critical | 9.0 | 2020-12-24 | If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed thes… |
CVE-2020-2499 | Medium | 6.3 | 2020-12-24 | A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with… |
CVE-2020-35668 | High | 7.5 | 2020-12-23 | RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unquoted string, such as an alias that has n… |
CVE-2020-35666 | High | 8.8 | 2020-12-23 | Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedos_base.js mishandles req.bo… |
CVE-2020-35665 | Critical | 9.8 | 2020-12-23 | An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs… |
CVE-2020-35598 | High | 7.5 | 2020-12-23 | ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=..%2f URI. NOTE: this might be the same… |
CVE-2020-35370 | High | 8.8 | 2020-12-23 | A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific f… |
CVE-2020-35269 | High | 8.8 | 2020-12-23 | Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or serve… |
CVE-2020-35252 | Medium | 6.1 | 2020-12-23 | Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System with Admin Panel 1… |
CVE-2020-28074 | Critical | 9.8 | 2020-12-23 | SourceCodester Online Health Care System 1.0 is affected by SQL Injection which allows a potential attacker to bypass the authentication system and become an a… |
CVE-2020-28073 | Critical | 9.8 | 2020-12-23 | SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and impersonate any user on th… |
CVE-2020-28071 | Medium | 4.8 | 2020-12-23 | SourceCodester Alumni Management System 1.0 is affected by cross-site Scripting (XSS) in /admin/gallery.php. After the admin authentication an attacker can upl… |
CVE-2020-28070 | Critical | 9.8 | 2020-12-23 | SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in view_event.php via the 'id'… |
CVE-2020-27397 | High | 8.8 | 2020-12-23 | Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to gain remote code e… |
CVE-2020-13969 | Medium | 6.1 | 2020-12-23 | CRK Business Platform <= 2019.1 allows reflected XSS via erro.aspx on 'CRK', 'IDContratante', 'Erro', or 'Mod' parameter. This is path-independent. |
CVE-2020-13968 | Critical | 9.8 | 2020-12-23 | CRK Business Platform <= 2019.1 allows can inject SQL statements against the DB on any path using the 'strSessao' parameter. |
CVE-2020-4642 | Medium | 5.5 | 2020-12-23 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow local attacker to cause a denial of service insid… |
CVE-2020-11719 | High | 7.5 | 2020-12-23 | An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. It relies on broken encryption with a weak and guessable static… |
CVE-2020-9439 | Medium | 6.1 | 2020-12-23 | Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject a… |
CVE-2020-6159 | Medium | 6.1 | 2020-12-23 | URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain ci… |
CVE-2020-35650 | Medium | 6.1 | 2020-12-23 | Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaSc… |
CVE-2020-35587 | High | 7.5 | 2020-12-23 | In Solstice Pod before 3.0.3, the firmware can easily be decompiled/disassembled. The decompiled/disassembled files contain non-obfuscated code. NOTE: it is un… |
CVE-2020-29552 | Critical | 9.8 | 2020-12-23 | An issue was discovered in URVE Build 24.03.2020. By using the _internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0%3bpowershell+-c+" substring, it is pos… |
CVE-2020-29551 | Critical | 9.1 | 2020-12-23 | An issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown the system. Among others, the following… |
CVE-2020-29550 | High | 7.5 | 2020-12-23 | An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 Integration Service… |
CVE-2020-11720 | Critical | 9.8 | 2020-12-23 | An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. During the installation, it sets up administrative access by de… |
CVE-2020-11718 | High | 7.4 | 2020-12-23 | An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and below. Its software-update packages are downloaded via cleartext HTTP. |
CVE-2020-35586 | High | 7.5 | 2020-12-23 | In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/initModel?password= S… |
CVE-2020-35585 | High | 7.5 | 2020-12-23 | In Solstice Pod before 3.3.0 (or Open4.3), the screen key can be enumerated using brute-force attacks via the /lookin/info Solstice Open Control API because th… |
CVE-2020-35584 | Medium | 5.9 | 2020-12-23 | In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature. An attacker suitably p… |
CVE-2020-35136 | High | 7.2 | 2020-12-23 | Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by… |
CVE-2020-25198 | High | 8.8 | 2020-12-23 | The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allo… |
CVE-2020-25196 | Critical | 9.8 | 2020-12-23 | The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to… |
CVE-2020-25194 | High | 8.8 | 2020-12-23 | The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user priv… |
CVE-2020-25192 | Medium | 5.3 | 2020-12-23 | The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without proper authorization. |
CVE-2020-25190 | High | 7.5 | 2020-12-23 | The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext. |
CVE-2020-25153 | Critical | 9.8 | 2020-12-23 | The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords. |
CVE-2020-35658 | Medium | 5.3 | 2020-12-23 | SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted. |
CVE-2020-35657 | High | 7.2 | 2020-12-23 | Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP archive containing… |
CVE-2020-35656 | High | 7.2 | 2020-12-23 | Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?reqGadget=Components&reqAction=InstallGadg… |
CVE-2020-28641 | High | 7.1 | 2020-12-22 | In Malwarebytes Free 4.1.0.56, a symbolic link may be used delete an arbitrary file on the system by exploiting the local quarantine system. |
CVE-2020-29583 | Critical | 9.8 | 2020-12-22 | Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found i… |
CVE-2020-27338 | Medium | 5.9 | 2020-12-22 | An issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the DHCPv6 client component allows an unauthenticated remote attacker to ca… |
CVE-2020-27337 | High | 7.3 | 2020-12-22 | An issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the IPv6 component allows an unauthenticated remote attacker to cause an Ou… |
CVE-2020-27336 | Low | 3.7 | 2020-12-22 | An issue was discovered in Treck IPv6 before 6.0.1.68. Improper input validation in the IPv6 component when handling a packet sent by an unauthenticated remote… |
CVE-2020-25066 | Critical | 10.0 | 2020-12-22 | A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denial of service (crash/reset) or to possib… |
CVE-2020-24683 | Critical | 9.8 | 2020-12-22 | The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (cl… |
CVE-2020-24680 | High | 7.0 | 2020-12-22 | In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database. |
CVE-2020-24679 | High | 7.5 | 2020-12-22 | A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbi… |
CVE-2020-24678 | High | 8.8 | 2020-12-22 | An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by… |
CVE-2020-24677 | High | 8.8 | 2020-12-22 | Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewh… |
CVE-2020-24676 | High | 7.8 | 2020-12-22 | In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. An unprivileged (but authenticated) u… |
CVE-2020-24675 | Critical | 9.8 | 2020-12-22 | In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server (or standalone S+ History ser… |
CVE-2020-24674 | High | 8.8 | 2020-12-22 | In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execu… |
CVE-2020-24673 | Critical | 9.8 | 2020-12-22 | In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), e… |
CVE-2020-14874 | Medium | 4.7 | 2020-12-22 | Vulnerability in the Oracle Cloud Infrastructure Identity and Access Management product of Oracle Cloud Services. Easily exploitable vulnerability allows high… |
CVE-2020-14270 | Medium | 5.3 | 2020-12-22 | HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. An unauthenticated at… |
CVE-2020-35609 | Medium | 5.5 | 2020-12-22 | A denial-of-service vulnerability exists in the asynchronous ioctl functionality of Microsoft Azure Sphere 20.05. A sequence of specially crafted ioctl calls c… |
CVE-2020-35608 | High | 7.8 | 2020-12-22 | A code execution vulnerability exists in the normal world’s signed code execution functionality of Microsoft Azure Sphere 20.07. A specially crafted AF_PACKET… |
CVE-2020-14231 | High | 8.8 | 2020-12-22 | A vulnerability in the input parameter handling of HCL Client Application Access v9 could potentially be exploited by an authenticated attacker resulting in a… |
CVE-2020-24581 | High | 8.0 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It contains an execute_cmd.cgi feature (that is not reachable v… |
CVE-2020-24580 | High | 7.5 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. Lack of authentication functionality allows an attacker to assi… |
CVE-2020-24579 | High | 8.8 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to acce… |
CVE-2020-24578 | Medium | 6.5 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It has a misconfigured FTP service that allows a malicious netw… |
CVE-2020-13547 | High | 8.8 | 2020-12-22 | A type confusion vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can… |
CVE-2020-25106 | High | 7.8 | 2020-12-22 | Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan ho… |
CVE-2020-13570 | High | 8.8 | 2020-12-22 | A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.0.37527. A specially crafted PDF document can trigg… |
CVE-2020-13560 | High | 8.8 | 2020-12-22 | A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can… |
CVE-2020-13557 | High | 8.8 | 2020-12-22 | A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. A specially crafted PDF document can… |
CVE-2020-29396 | High | 8.8 | 2020-12-22 | A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticate… |
CVE-2020-28460 | Medium | 5.6 | 2020-12-22 | This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array… |
CVE-2020-28448 | Medium | 5.6 | 2020-12-22 | This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array. |
CVE-2020-35626 | High | 8.8 | 2020-12-21 | An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1. The primary form did not implement an anti-CSRF token and therefore was comp… |
CVE-2020-35625 | High | 8.8 | 2020-12-21 | An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call… |
CVE-2020-35624 | Medium | 5.3 | 2020-12-21 | An issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1. The non-admin vote list contains a full vote timestamp, which may provide uni… |
CVE-2020-35623 | High | 7.5 | 2020-12-21 | An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial… |
CVE-2020-35622 | Medium | 6.1 | 2020-12-21 | An issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1. SpecialGlobalUsage.php calls WikiMap::makeForeignLink unsafely. The $page va… |
CVE-2020-26284 | High | 7.7 | 2020-12-21 | Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if t… |
CVE-2020-8995 | Critical | 9.8 | 2020-12-21 | Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers… |
CVE-2020-29596 | High | 7.5 | 2020-12-21 | MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash) via a long name for the first parameter in a POST request. |
CVE-2020-26281 | Medium | 6.8 | 2020-12-21 | async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerabili… |
CVE-2020-26277 | Medium | 6.1 | 2020-12-21 | DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged… |
CVE-2020-35151 | High | 8.8 | 2020-12-21 | The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection. |
CVE-2020-11717 | Critical | 9.8 | 2020-12-21 | An issue was discovered in Programi 014 31.01.2020. It has multiple SQL injection vulnerabilities. |
CVE-2020-35606 | High | 8.8 | 2020-12-21 | Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root priv… |
CVE-2020-35605 | Critical | 9.8 | 2020-12-21 | The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special char… |
CVE-2020-35604 | Critical | 9.8 | 2020-12-21 | An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used. |
CVE-2020-21378 | Critical | 9.8 | 2020-12-21 | SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin_members_group.php. |
CVE-2020-21377 | Critical | 9.8 | 2020-12-21 | SQL injection vulnerability in yunyecms V2.0.1 via the selcart parameter. |
CVE-2020-6882 | High | 7.5 | 2020-12-21 | ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials on the device. The r… |
CVE-2020-6881 | High | 7.5 | 2020-12-21 | ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of abnormal messages… |
CVE-2020-5808 | High | 7.5 | 2020-12-21 | In certain scenarios in Tenable.sc prior to 5.17.0, a scanner could potentially be used outside the user's defined scan zone without a particular zone being sp… |
CVE-2020-4988 | Critical | 9.8 | 2020-12-21 | Loopback 8.0.0 contains a vulnerability that could allow an attacker to manipulate or pollute Javascript values and cause a denial of service or possibly execu… |
CVE-2020-4870 | High | 7.5 | 2020-12-21 | IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications. IBM X-Force ID: 190833. |
CVE-2020-4843 | Medium | 4.3 | 2020-12-21 | IBM Security Secret Server 10.6 stores potentially sensitive information in config files that could be read by an authenticated user. IBM X-Force ID: 190048. |
CVE-2020-4842 | Medium | 4.9 | 2020-12-21 | IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2020-4841 | Medium | 5.9 | 2020-12-21 | IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport S… |