2020 CVEs (page 57)
Page 57 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4840 | Medium | 6.1 | 2020-12-21 | IBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a spe… |
CVE-2020-4794 | Medium | 5.4 | 2020-12-21 | IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could all… |
CVE-2020-4757 | Medium | 6.4 | 2020-12-21 | IBM FileNet Content Manager and IBM Content Navigator 3.0.CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2020-4555 | Medium | 5.4 | 2020-12-21 | IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user… |
CVE-2020-27254 | High | 7.5 | 2020-12-21 | Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisions, The affected products are vulnerable to improper authenticatio… |
CVE-2020-26422 | Low | 3.7 | 2020-12-21 | Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file |
CVE-2020-26275 | Medium | 6.1 | 2020-12-21 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and… |
CVE-2020-25860 | Medium | 6.6 | 2020-12-21 | The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on… |
CVE-2020-14225 | Medium | 6.5 | 2020-12-21 | HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote unauthenticated attacker could use this vu… |
CVE-2020-35497 | Medium | 6.5 | 2020-12-21 | A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public S… |
CVE-2020-26263 | High | 7.5 | 2020-12-21 | tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the cod… |
CVE-2020-17526 | High | 7.7 | 2020-12-21 | Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log… |
CVE-2020-3999 | Medium | 6.5 | 2020-12-21 | VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x pri… |
CVE-2020-27846 | Critical | 9.8 | 2020-12-21 | A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnera… |
CVE-2020-35276 | Critical | 9.8 | 2020-12-21 | EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remo… |
CVE-2020-35275 | Medium | 5.4 | 2020-12-21 | Coastercms v5.8.18 is affected by cross-site Scripting (XSS). A user can steal a cookie and make the user redirect to any malicious website because it is trigg… |
CVE-2020-35274 | Medium | 4.8 | 2020-12-21 | DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attacker could compromise the security of a… |
CVE-2020-35273 | High | 8.0 | 2020-12-21 | EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User Pr… |
CVE-2020-26049 | Medium | 6.1 | 2020-12-21 | Nifty-PM CPE 2.3 is affected by stored HTML injection. The impact is remote arbitrary code execution. |
CVE-2020-35590 | Critical | 9.8 | 2020-12-21 | LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Fo… |
CVE-2020-35589 | Medium | 5.4 | 2020-12-21 | The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user c… |
CVE-2020-29447 | Medium | 4.3 | 2020-12-21 | Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the file… |
CVE-2020-35579 | High | 7.5 | 2020-12-20 | tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request… |
CVE-2020-35573 | High | 7.5 | 2020-12-20 | srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address. |
CVE-2020-7203 | Critical | 9.8 | 2020-12-18 | A potential security vulnerability has been identified in HPE iLO Amplifier Pack server version 1.70. The vulnerability could be exploited to allow remote code… |
CVE-2020-7201 | High | 8.8 | 2020-12-18 | A potential security vulnerability has been identified in the HPE StoreEver MSL2024 Tape Library and HPE StoreEver 1/8 G2 Tape Autoloaders. The vulnerability c… |
CVE-2020-7200 | Critical | 9.8 | 2020-12-18 | A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. The vulnerability could be exploited to allow remote c… |
CVE-2020-14271 | Medium | 6.1 | 2020-12-18 | HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated… |
CVE-2020-14224 | Critical | 9.8 | 2020-12-18 | A vulnerability in the MIME message handling of the HCL Notes v9 client could potentially be exploited by an unauthenticated attacker resulting in a stack buff… |
CVE-2020-4080 | Medium | 6.1 | 2020-12-18 | HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remot… |
CVE-2020-5803 | High | 8.1 | 2020-12-18 | Relative Path Traversal in Marvell QConvergeConsole GUI 5.5.0.74 allows a remote, authenticated attacker to delete arbitrary files on disk as SYSTEM or root. |
CVE-2020-27781 | High | 7.1 | 2020-12-18 | User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manil… |
CVE-2020-17520 | Medium | 6.5 | 2020-12-18 | In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's admin, permission verification mechanism by constructing special U… |
CVE-2020-13535 | High | 7.8 | 2020-12-18 | A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker can globally overwrite service configurat… |
CVE-2020-11974 | Critical | 9.8 | 2020-12-18 | In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database. |
CVE-2020-13519 | High | 8.8 | 2020-12-18 | A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c402088 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (I… |
CVE-2020-13515 | High | 8.8 | 2020-12-18 | A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c40a148 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (I… |
CVE-2020-13514 | High | 8.8 | 2020-12-18 | A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O reques… |
CVE-2020-13513 | High | 8.8 | 2020-12-18 | A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O reques… |
CVE-2020-13512 | High | 8.8 | 2020-12-18 | A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O reques… |
CVE-2020-27687 | High | 8.8 | 2020-12-18 | ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emai… |
CVE-2020-26280 | High | 8.9 | 2020-12-18 | OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3… |
CVE-2020-20300 | Critical | 9.8 | 2020-12-18 | SQL injection vulnerability in the wp_where function in WeiPHP 5.0. |
CVE-2020-20299 | High | 7.5 | 2020-12-18 | WeiPHP 5.0 does not properly restrict access to pages, related to using POST. |
CVE-2020-20298 | Critical | 9.8 | 2020-12-18 | Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attackers to execute arbi… |
CVE-2020-20285 | Medium | 5.4 | 2020-12-18 | There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php |
CVE-2020-20277 | Critical | 9.8 | 2020-12-18 | There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper imple… |
CVE-2020-20276 | Critical | 9.8 | 2020-12-18 | An unauthenticated stack-based buffer overflow vulnerability in common.c's handle_PORT in uftpd FTP server versions 2.10 and earlier can be abused to cause a c… |
CVE-2020-26251 | Medium | 4.7 | 2020-12-18 | Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3… |
CVE-2020-4764 | Medium | 6.5 | 2020-12-18 | IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2020-25901 | Medium | 6.1 | 2020-12-18 | Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpage… |
CVE-2020-25495 | Medium | 6.1 | 2020-12-18 | A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote attackers to inject arbitrary web script… |
CVE-2020-25494 | Critical | 9.8 | 2020-12-18 | Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-… |
CVE-2020-26178 | Medium | 5.3 | 2020-12-18 | In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authenticated. |
CVE-2020-26177 | Medium | 4.3 | 2020-12-18 | In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. Ho… |
CVE-2020-26176 | Medium | 4.3 | 2020-12-18 | An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API… |
CVE-2020-26175 | Medium | 6.5 | 2020-12-18 | In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change profile information of… |
CVE-2020-26174 | High | 8.8 | 2020-12-18 | tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. Howe… |
CVE-2020-26173 | Low | 3.1 | 2020-12-18 | An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid docume… |
CVE-2020-26172 | Medium | 4.2 | 2020-12-18 | Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The J… |
CVE-2020-26171 | Medium | 4.3 | 2020-12-18 | In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users ca… |
CVE-2020-35555 | High | 7.8 | 2020-12-18 | An issue was discovered on LG mobile devices with Android OS 10 software. When a dual-screen configuration is supported, the device does not lock upon disconne… |
CVE-2020-35554 | High | 7.8 | 2020-12-18 | An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. There is a WebView SSL error-handler vulnerability. The LG ID is L… |
CVE-2020-35553 | High | 7.5 | 2020-12-18 | An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Qualcomm SM8250 chipsets) software. They allows attackers to cause a denial of serv… |
CVE-2020-35552 | Medium | 5.3 | 2020-12-18 | An issue was discovered in the GPS daemon on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (non-Qualcomm chipsets) software. Attackers can obtain sen… |
CVE-2020-35551 | Critical | 9.8 | 2020-12-18 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. They allow attackers to conduct RPMB state-chang… |
CVE-2020-35550 | Critical | 9.8 | 2020-12-18 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Attackers can bypass Factory Reset Protection (FRP) via S… |
CVE-2020-35549 | Medium | 5.5 | 2020-12-18 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Any application may establish itself as the default dialer, withou… |
CVE-2020-35548 | Medium | 5.5 | 2020-12-18 | An issue was discovered in Finder on Samsung mobile devices with Q(10.0) software. A call to a non-existent provider allows attackers to cause a denial of serv… |
CVE-2020-35480 | Medium | 5.3 | 2020-12-18 | An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due t… |
CVE-2020-35479 | Medium | 6.1 | 2020-12-18 | MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return… |
CVE-2020-35478 | Medium | 6.1 | 2020-12-18 | MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter… |
CVE-2020-35477 | Medium | 5.3 | 2020-12-18 | MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visi… |
CVE-2020-35475 | High | 7.5 | 2020-12-18 | In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:U… |
CVE-2020-35474 | Medium | 6.1 | 2020-12-18 | In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchli… |
CVE-2020-27640 | High | 8.1 | 2020-12-18 | The Bluetooth handset of Mitel MiVoice 6940 and 6930 MiNet phones with firmware before 1.5.3 could allow an unauthenticated attacker within Bluetooth range to… |
CVE-2020-27639 | High | 8.1 | 2020-12-18 | The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth… |
CVE-2020-27340 | Medium | 6.1 | 2020-12-18 | The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to… |
CVE-2020-27154 | High | 8.8 | 2020-12-18 | The chat window of Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.11 and 7.x before 7.0.3 could allow an attacker to gain access to user in… |
CVE-2020-25612 | Medium | 4.9 | 2020-12-18 | The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files due to insufficient access control. Su… |
CVE-2020-25611 | Medium | 6.1 | 2020-12-18 | The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due to improper input va… |
CVE-2020-25610 | Medium | 5.3 | 2020-12-18 | The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web conference due to insufficient access control for conference cod… |
CVE-2020-25609 | Medium | 5.4 | 2020-12-18 | The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validati… |
CVE-2020-25608 | High | 7.2 | 2020-12-18 | The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection. |
CVE-2020-25606 | Medium | 6.1 | 2020-12-18 | The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper input validation, a… |
CVE-2020-24693 | Low | 3.3 | 2020-12-18 | The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow a local attacker to view system information due to insufficient output sanitiza… |
CVE-2020-7838 | High | 8.8 | 2020-12-18 | A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code whe… |
CVE-2020-28052 | High | 8.1 | 2020-12-18 | An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when check… |
CVE-2020-27780 | Critical | 9.8 | 2020-12-18 | A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to au… |
CVE-2020-14232 | High | 8.8 | 2020-12-18 | A vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by an authenticated attacker resulting in a stack buffer overflo… |
CVE-2020-13931 | Critical | 9.8 | 2020-12-18 | If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is mi… |
CVE-2020-13528 | Medium | 5.3 | 2020-12-18 | An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4… |
CVE-2020-13527 | Medium | 4.5 | 2020-12-18 | An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. A speci… |
CVE-2020-13518 | Medium | 6.5 | 2020-12-18 | An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c402084 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet… |
CVE-2020-13517 | Medium | 5.5 | 2020-12-18 | An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406104 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet… |
CVE-2020-13516 | Medium | 6.5 | 2020-12-18 | An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406144 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet… |
CVE-2020-13511 | Medium | 6.5 | 2020-12-18 | An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O requ… |
CVE-2020-13510 | Medium | 6.5 | 2020-12-18 | An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O requ… |
CVE-2020-13509 | Medium | 6.5 | 2020-12-18 | An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. A specially crafted I/O requ… |
CVE-2020-20142 | Medium | 6.1 | 2020-12-17 | Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table & Charts 2.7.17. |