2020 CVEs (page 6)
Page 6 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26305 | High | 7.5 | 2024-10-26 | CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to Regular Expression De… |
CVE-2020-26304 | High | 7.5 | 2024-10-26 | Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Servi… |
CVE-2020-26303 | High | 7.5 | 2024-10-26 | insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denia… |
CVE-2020-36841 | Medium | 5.3 | 2024-10-16 | The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init… |
CVE-2020-36842 | High | 8.8 | 2024-10-16 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_i… |
CVE-2020-36840 | High | 7.3 | 2024-10-16 | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route… |
CVE-2020-36839 | High | 8.3 | 2024-10-16 | The WP Lead Plus X plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.99. This is due to missing or incorrect… |
CVE-2020-36838 | High | 7.4 | 2024-10-16 | The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versio… |
CVE-2020-36837 | Critical | 9.9 | 2024-10-16 | The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wizard_actions function… |
CVE-2020-36836 | High | 8.0 | 2024-10-16 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capa… |
CVE-2020-36835 | Medium | 4.9 | 2024-10-16 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing c… |
CVE-2020-36834 | Medium | 6.3 | 2024-10-16 | The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2… |
CVE-2020-36833 | Medium | 6.3 | 2024-10-16 | The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 -… |
CVE-2020-36832 | Critical | 9.8 | 2024-10-16 | The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible… |
CVE-2020-36831 | Medium | 5.0 | 2024-10-16 | The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privi… |
CVE-2020-24061 | Medium | 4.3 | 2024-09-12 | Cross Site Scripting (XSS) Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and stea… |
CVE-2020-36830 | Medium | 4.3 | 2024-09-02 | A vulnerability was found in nescalante urlregex up to 0.5.0 and classified as problematic. This issue affects some unknown processing of the file index.js of… |
CVE-2020-11847 | High | 8.2 | 2024-08-21 | SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Man… |
CVE-2020-11846 | High | 8.7 | 2024-08-21 | A vulnerability found in OpenText Privileged Access Manager that issues a token. on successful issuance of the token, a cookie gets set that allows unrestricte… |
CVE-2020-11850 | High | 7.3 | 2024-08-21 | Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS). This issue affects Self Service Password Res… |
CVE-2020-11640 | High | 8.8 | 2024-07-23 | AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the command queue can use it to launch an attack by running any ex… |
CVE-2020-11639 | High | 7.8 | 2024-07-23 | An attacker could exploit the vulnerability by injecting garbage data or specially crafted data. Depending on the data injected each process might be affected… |
CVE-2020-24102 | High | 7.6 | 2024-07-22 | Directory Traversal vulnerability in Punkbuster pbsv.d64 2.351, allows remote attackers to execute arbitrary code. |
CVE-2020-36765 | Medium | 6.5 | 2024-07-16 | Insufficient policy enforcement in Navigation in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2020-25836 | Medium | 6.3 | 2024-07-16 | Exposure of Sensitive Information to an Unauthorized Access vulnerability in OpenText NetIQ Directory and Resource Administrator. This issue affects NetIQ Dire… |
CVE-2020-27352 | Critical | 9.3 | 2024-06-21 | When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move pr… |
CVE-2020-11843 | Medium | 6.5 | 2024-06-11 | This allows the information exposure to unauthorized users. This issue affects NetIQ Access Manager using version 4.5 or before |
CVE-2020-35165 | Medium | 5.1 | 2024-05-22 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vul… |
CVE-2020-36788 | High | 7.8 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: avoid a use-after-free when BO init fails nouveau_bo_init() is backed by ttm… |
CVE-2020-26312 | High | 8.1 | 2024-05-14 | Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsafe handling of symb… |
CVE-2020-18305 | High | 8.0 | 2024-05-14 | Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers… |
CVE-2020-4874 | Medium | 5.9 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive in… |
CVE-2020-27478 | High | 7.1 | 2024-04-30 | Cross Site Scripting vulnerability found in Simplcommerce v.40734964b0811f3cbaf64b6dac261683d256f961 thru 3103357200c70b4767986544e01b19dbf11505a7 allows a rem… |
CVE-2020-5200 | Medium | 5.9 | 2024-04-30 | Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all publ… |
CVE-2020-22540 | Medium | 5.4 | 2024-04-15 | Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive information via crafted payl… |
CVE-2020-22539 | High | 7.2 | 2024-04-15 | An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2020-8006 | High | 8.8 | 2024-04-12 | The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the devi… |
CVE-2020-36829 | High | 7.5 | 2024-04-08 | The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only… |
CVE-2020-25730 | High | 8.2 | 2024-04-04 | Cross Site Scripting (XSS) vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain… |
CVE-2020-36828 | Low | 3.5 | 2024-03-31 | A vulnerability was found in DiscuzX up to 3.4-20200818. It has been classified as problematic. Affected is the function show_next_step of the file upload/inst… |
CVE-2020-36826 | Low | 3.5 | 2024-03-25 | A vulnerability was found in AwesomestCode LiveBot. It has been classified as problematic. Affected is the function parseSend of the file js/parseMessage.js. T… |
CVE-2020-36825 | Medium | 6.3 | 2024-03-24 | ** UNSUPPORTED WHEN ASSIGNED ** ** DISPUTED ** A vulnerability has been found in cyberaz0r WebRAT up to 20191222 and classified as critical. This vulnerability… |
CVE-2020-36827 | Medium | 5.4 | 2024-03-24 | The XAO::Web module before 1.84 for Perl mishandles < and > characters in JSON output during use of json-embed in Web::Action. |
CVE-2020-26942 | Critical | 9.1 | 2024-03-21 | An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a setAdminPassword op… |
CVE-2020-11862 | High | 8.6 | 2024-03-13 | Allocation of Resources Without Limits or Throttling vulnerability in OpenText NetIQ Privileged Account Manager on Linux, Windows, 64 bit allows Flooding.This… |
CVE-2020-36787 | High | 7.8 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: media: aspeed: fix clock handling logic Video engine uses eclk and vclk for its clock sou… |
CVE-2020-36786 | Medium | 5.5 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: media: [next] staging: media: atomisp: fix memory leak of object flash In the case where… |
CVE-2020-36785 | High | 7.8 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() The "s3a_buf" is free… |
CVE-2020-36784 | Medium | 5.5 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: i2c: cadence: fix reference leak when pm_runtime_get_sync fails The PM reference count is… |
CVE-2020-36783 | Medium | 5.5 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: i2c: img-scb: fix reference leak when pm_runtime_get_sync fails The PM reference count is… |
CVE-2020-36782 | Medium | 5.5 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails The PM reference count… |
CVE-2020-36781 | Medium | 5.5 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix reference leak when pm_runtime_get_sync fails In i2c_imx_xfer() and i2c_imx… |
CVE-2020-36780 | Medium | 4.7 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: i2c: sprd: fix reference leak when pm_runtime_get_sync fails The PM reference count is no… |
CVE-2020-36779 | Medium | 5.5 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails The PM reference count is… |
CVE-2020-36778 | Medium | 5.5 | 2024-02-28 | In the Linux kernel, the following vulnerability has been resolved: i2c: xiic: fix reference leak when pm_runtime_get_sync fails The PM reference count is no… |
CVE-2020-36777 | Medium | 5.5 | 2024-02-27 | In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: Fix memory leak in dvb_media_device_free() dvb_media_device_free() is leak… |
CVE-2020-36776 | Medium | 5.5 | 2024-02-27 | In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/cpufreq_cooling: Fix slab OOB issue Slab OOB issue is scanned by KASAN in… |
CVE-2020-36775 | Medium | 5.5 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadlock Using f2fs_trylock_op() in f2fs_write_compressed_pa… |
CVE-2020-36774 | Medium | 5.5 | 2024-02-19 | plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service… |
CVE-2020-36773 | Critical | 9.8 | 2024-02-04 | Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in… |
CVE-2020-29504 | High | 7.4 | 2024-02-02 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Missing Required Cryptographic… |
CVE-2020-24682 | High | 7.2 | 2024-02-02 | Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with Ele… |
CVE-2020-24681 | High | 8.2 | 2024-02-02 | Incorrect Permission Assignment for Critical Resource vulnerability in B&R Industrial Automation Automation Studio allows Privilege Escalation.This issue affec… |
CVE-2020-36772 | Medium | 4.4 | 2024-01-22 | CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitr… |
CVE-2020-36771 | High | 7.8 | 2024-01-22 | CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. In some configurations this allows local users to view the authe… |
CVE-2020-36770 | Critical | 9.8 | 2024-01-15 | pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This cou… |
CVE-2020-26630 | Medium | 4.9 | 2024-01-10 | A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a speci… |
CVE-2020-26629 | Critical | 9.8 | 2024-01-10 | A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated attacker to upload… |
CVE-2020-26628 | Medium | 6.1 | 2024-01-10 | A Cross-Site Scripting (XSS) vulnerability was discovered in Hospital Management System V4.0 which allows an attacker to execute arbitrary web scripts or HTML… |
CVE-2020-26627 | Medium | 4.9 | 2024-01-10 | A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database information via a craft… |
CVE-2020-13880 | Critical | 9.8 | 2024-01-05 | IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write. |
CVE-2020-13879 | Critical | 9.8 | 2024-01-05 | IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write. |
CVE-2020-13878 | Critical | 9.8 | 2024-01-05 | IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27ef heap-based out-of-bounds write. |
CVE-2020-26625 | Low | 3.8 | 2024-01-02 | A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'user_id' p… |
CVE-2020-26624 | Low | 3.8 | 2024-01-02 | A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the ID paramete… |
CVE-2020-26623 | Low | 3.8 | 2024-01-02 | SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under th… |
CVE-2020-17163 | High | 7.8 | 2023-12-29 | Visual Studio Code Python Extension Remote Code Execution Vulnerability |
CVE-2020-36769 | High | 7.4 | 2023-12-23 | The Widget Settings Importer/Exporter Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_ajax_import_widget_dataparameter AJAX actio… |
CVE-2020-17485 | Critical | 9.8 | 2023-12-16 | A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions. The web server can be compromised by uploading and executing a web/reverse s… |
CVE-2020-17484 | Medium | 6.1 | 2023-12-16 | An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application that causes a redir… |
CVE-2020-17483 | High | 7.5 | 2023-12-16 | An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all the connected device… |
CVE-2020-10676 | High | 8.8 | 2023-12-12 | In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move tha… |
CVE-2020-28369 | High | 7.8 | 2023-12-12 | In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location… |
CVE-2020-12614 | High | 7.8 | 2023-12-12 | An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. If the publisher criteria is selected, it defines the name of a publisher… |
CVE-2020-12612 | High | 7.8 | 2023-12-12 | An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When specifying a program to elevate, it can typically be found within the… |
CVE-2020-12615 | High | 7.8 | 2023-12-12 | An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When adding the Add Admin token to a process, and specifying that it runs… |
CVE-2020-12613 | High | 8.8 | 2023-12-11 | An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. An attacker can spawn a process with multiple users as part of the securit… |
CVE-2020-25835 | Medium | 5.9 | 2023-12-09 | A potential vulnerability has been identified in Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited resulting in stored Cros… |
CVE-2020-36768 | High | 7.3 | 2023-12-03 | A vulnerability was found in rl-institut NESP2 Initial Release/1.0. It has been classified as critical. Affected is an unknown function of the file app/databas… |
CVE-2020-11448 | Medium | 6.1 | 2023-11-17 | An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page. |
CVE-2020-11447 | Medium | 4.3 | 2023-11-17 | An issue was discovered on Bell HomeHub 3000 SG48222070 devices. Remote authenticated users can retrieve the serial number via cgi/json-req - this is an inform… |
CVE-2020-28407 | High | 7.1 | 2023-11-03 | In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a temporary file such as T… |
CVE-2020-36767 | High | 7.5 | 2023-10-30 | tinyfiledialogs (aka tiny file dialogs) before 3.8.0 allows shell metacharacters in titles, messages, and other input data. |
CVE-2020-17477 | Medium | 6.5 | 2023-10-26 | Incorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@school before 4.4v5-errata allow remote teachers, staff, and school administrators to read LDAP passw… |
CVE-2020-36759 | Medium | 4.3 | 2023-10-20 | The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or inc… |
CVE-2020-36758 | Medium | 4.3 | 2023-10-20 | The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing o… |
CVE-2020-36755 | Medium | 4.3 | 2023-10-20 | The Customizr theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.0. This is due to missing or incorrect nonc… |
CVE-2020-36754 | Medium | 4.3 | 2023-10-20 | The Paid Memberships Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.2. This is due to missing or i… |
CVE-2020-36753 | Medium | 4.3 | 2023-10-20 | The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing or incorrect nonce v… |
CVE-2020-36751 | Medium | 4.3 | 2023-10-20 | The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect… |