2020 CVEs (page 62)
Page 62 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26409 | Medium | 4.3 | 2020-12-11 | A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassin… |
CVE-2020-25838 | Medium | 6.5 | 2020-12-11 | Unauthorized disclosure of sensitive information vulnerability in Micro Focus Filr product. Affecting all 3.x and 4.x versions. The vulnerability could be expl… |
CVE-2020-25191 | High | 7.5 | 2020-12-11 | Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a function that could reboo… |
CVE-2020-24637 | High | 7.2 | 2020-12-11 | Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead… |
CVE-2020-24634 | Critical | 9.8 | 2020-12-11 | An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UD… |
CVE-2020-24633 | Critical | 9.8 | 2020-12-11 | There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted packets destined to t… |
CVE-2020-17530 | Critical | 9.8 | 2020-12-11 | Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts… |
CVE-2020-7560 | High | 8.6 | 2020-12-11 | A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Exp… |
CVE-2020-7549 | Medium | 5.3 | 2020-12-11 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modic… |
CVE-2020-7543 | High | 7.5 | 2020-12-11 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modico… |
CVE-2020-7542 | High | 7.5 | 2020-12-11 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modico… |
CVE-2020-7541 | Medium | 5.3 | 2020-12-11 | A CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and ass… |
CVE-2020-7540 | Critical | 9.8 | 2020-12-11 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premi… |
CVE-2020-7539 | High | 7.5 | 2020-12-11 | A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modico… |
CVE-2020-7537 | High | 7.5 | 2020-12-11 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modico… |
CVE-2020-7536 | High | 7.5 | 2020-12-11 | A CWE-754:Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M340 CPUs (BMXP34* versions prior to V3.30) Modicon M340 Communi… |
CVE-2020-7535 | High | 7.5 | 2020-12-11 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerability exists in the Web Server on Modicon M… |
CVE-2020-28220 | Medium | 6.8 | 2020-12-11 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258 Firmware (All versions prior to V5.0.4… |
CVE-2020-28219 | High | 7.8 | 2020-12-11 | A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 20… |
CVE-2020-28218 | Medium | 6.5 | 2020-12-11 | A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to… |
CVE-2020-28217 | High | 7.5 | 2020-12-11 | A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to read network tra… |
CVE-2020-28216 | High | 7.5 | 2020-12-11 | A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to read network tra… |
CVE-2020-28215 | Critical | 9.8 | 2020-12-11 | A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide range of problems, including informatio… |
CVE-2020-28214 | Medium | 5.5 | 2020-12-11 | A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could allow an attacker to p… |
CVE-2020-8908 | Low | 3.3 | 2020-12-10 | A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a tempor… |
CVE-2020-4829 | High | 7.8 | 2020-12-10 | IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the ksu user command to gain root privileges. IBM X-Force ID: 189960. |
CVE-2020-29311 | Critical | 9.8 | 2020-12-10 | Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and being triggered by an… |
CVE-2020-26270 | Medium | 4.4 | 2020-12-10 | In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using… |
CVE-2020-26269 | High | 7.5 | 2020-12-10 | In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out… |
CVE-2020-26268 | Medium | 4.4 | 2020-12-10 | In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutab… |
CVE-2020-26267 | Medium | 4.4 | 2020-12-10 | In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that th… |
CVE-2020-26266 | Medium | 4.4 | 2020-12-10 | In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having te… |
CVE-2020-26201 | Critical | 9.8 | 2020-12-10 | Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. This allows an attacker to gain unauthori… |
CVE-2020-25967 | High | 8.8 | 2020-12-10 | The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability. |
CVE-2020-19527 | Critical | 9.8 | 2020-12-10 | iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB_NAME parameter to install/install.php. |
CVE-2020-19142 | Critical | 9.8 | 2020-12-10 | iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB_PREFIX parameter to install/install.php. |
CVE-2020-16608 | Critical | 9.6 | 2020-12-10 | Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true). |
CVE-2020-13526 | High | 8.8 | 2020-12-10 | SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. The… |
CVE-2020-26271 | Medium | 4.4 | 2020-12-10 | In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph… |
CVE-2020-8920 | Low | 3.5 | 2020-12-10 | An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the Filter… |
CVE-2020-8919 | Low | 3.5 | 2020-12-10 | An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST AP… |
CVE-2020-29667 | Critical | 9.8 | 2020-12-10 | In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control o… |
CVE-2020-29666 | Medium | 5.3 | 2020-12-10 | In Lan ATMService M3 ATM Monitoring System 6.1.0, due to a directory-listing vulnerability, a remote attacker can view log files, located in /websocket/logs/… |
CVE-2020-29668 | Low | 3.7 | 2020-12-10 | Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie… |
CVE-2020-26407 | Medium | 5.5 | 2020-12-10 | A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site sc… |
CVE-2020-24445 | Critical | 9.0 | 2020-12-10 | AEM's Cloud Service offering, as well as version 6.5.6.0 (and below), are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by… |
CVE-2020-24444 | Medium | 5.8 | 2020-12-10 | AEM Forms SP6 add-on for AEM 6.5.6.0 and Forms add-on package for AEM 6.4 Service Pack 8 Cumulative Fix Pack 2 (6.4.8.2) have a blind Server-Side Request Forge… |
CVE-2020-12595 | Medium | 4.9 | 2020-12-10 | An information disclosure flaw allows a malicious, authenticated, privileged web UI user to obtain a password for a remote SCP backup server that they might no… |
CVE-2020-12594 | High | 7.2 | 2020-12-10 | A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SM… |
CVE-2020-2498 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fix… |
CVE-2020-2497 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed… |
CVE-2020-2496 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vuln… |
CVE-2020-2495 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vuln… |
CVE-2020-2494 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the fo… |
CVE-2020-2493 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in M… |
CVE-2020-2491 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the… |
CVE-2020-27351 | Low | 2.0 | 2020-12-10 | Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affec… |
CVE-2020-27350 | Medium | 5.7 | 2020-12-10 | APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/… |
CVE-2020-12516 | High | 7.5 | 2020-12-10 | Older firmware versions (FW1 up to FW10) of the WAGO PLC family 750-88x and 750-352 are vulnerable for a special denial of service attack. |
CVE-2020-7339 | Medium | 6.3 | 2020-12-10 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in McAfee Database Security Server and Sensor prior to 4.8.0 in the form of a SHA1 signed certif… |
CVE-2020-17159 | High | 7.8 | 2020-12-10 | Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability |
CVE-2020-17158 | High | 8.8 | 2020-12-10 | Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability |
CVE-2020-17156 | High | 7.8 | 2020-12-10 | Visual Studio Remote Code Execution Vulnerability |
CVE-2020-17153 | Medium | 4.3 | 2020-12-10 | Microsoft Edge for Android Spoofing Vulnerability |
CVE-2020-17152 | High | 8.8 | 2020-12-10 | Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability |
CVE-2020-17150 | High | 7.8 | 2020-12-10 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2020-17148 | High | 7.8 | 2020-12-10 | Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability |
CVE-2020-17147 | High | 8.7 | 2020-12-10 | Dynamics CRM Webclient Cross-site Scripting Vulnerability |
CVE-2020-17145 | Medium | 5.4 | 2020-12-10 | Azure DevOps Server and Team Foundation Services Spoofing Vulnerability |
CVE-2020-17144 | High | 8.4 | 2020-12-10 | Microsoft Exchange Remote Code Execution Vulnerability |
CVE-2020-17143 | High | 8.8 | 2020-12-10 | Microsoft Exchange Server Information Disclosure Vulnerability |
CVE-2020-17142 | Critical | 9.1 | 2020-12-10 | Microsoft Exchange Remote Code Execution Vulnerability |
CVE-2020-17141 | High | 8.4 | 2020-12-10 | Microsoft Exchange Remote Code Execution Vulnerability |
CVE-2020-17140 | High | 8.1 | 2020-12-10 | Windows SMB Information Disclosure Vulnerability |
CVE-2020-17139 | High | 7.8 | 2020-12-10 | Windows Overlay Filter Security Feature Bypass Vulnerability |
CVE-2020-17138 | Medium | 5.5 | 2020-12-10 | Windows Error Reporting Information Disclosure Vulnerability |
CVE-2020-17137 | High | 7.8 | 2020-12-10 | DirectX Graphics Kernel Elevation of Privilege Vulnerability |
CVE-2020-17136 | High | 7.8 | 2020-12-10 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2020-17135 | Medium | 6.4 | 2020-12-10 | Azure DevOps Server Spoofing Vulnerability |
CVE-2020-17134 | High | 7.8 | 2020-12-10 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2020-17133 | Medium | 6.5 | 2020-12-10 | Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability |
CVE-2020-17132 | Critical | 9.1 | 2020-12-10 | Microsoft Exchange Remote Code Execution Vulnerability |
CVE-2020-17131 | Medium | 4.2 | 2020-12-10 | Chakra Scripting Engine Memory Corruption Vulnerability |
CVE-2020-17130 | Medium | 6.5 | 2020-12-10 | Microsoft Excel Security Feature Bypass Vulnerability |
CVE-2020-17129 | High | 7.8 | 2020-12-10 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2020-17128 | High | 7.8 | 2020-12-10 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2020-17127 | High | 7.8 | 2020-12-10 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2020-17126 | Medium | 5.5 | 2020-12-10 | Microsoft Excel Information Disclosure Vulnerability |
CVE-2020-17125 | High | 7.8 | 2020-12-10 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2020-17124 | High | 7.8 | 2020-12-10 | Microsoft PowerPoint Remote Code Execution Vulnerability |
CVE-2020-17123 | High | 7.8 | 2020-12-10 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2020-17122 | High | 7.8 | 2020-12-10 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2020-17121 | High | 8.8 | 2020-12-10 | Microsoft SharePoint Remote Code Execution Vulnerability |
CVE-2020-17120 | Medium | 5.3 | 2020-12-10 | Microsoft SharePoint Information Disclosure Vulnerability |
CVE-2020-17119 | Medium | 6.5 | 2020-12-10 | Microsoft Outlook Information Disclosure Vulnerability |
CVE-2020-17118 | High | 8.1 | 2020-12-10 | Microsoft SharePoint Remote Code Execution Vulnerability |
CVE-2020-17117 | Medium | 6.6 | 2020-12-10 | Microsoft Exchange Remote Code Execution Vulnerability |
CVE-2020-17115 | High | 8.0 | 2020-12-10 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2020-17103 | High | 7.0 | 2020-12-10 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2020-17099 | Medium | 6.8 | 2020-12-10 | Windows Lock Screen Security Feature Bypass Vulnerability |