2020 CVEs (page 64)
Page 64 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27754 | Low | 3.3 | 2020-12-08 | In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller when ImageMagick proc… |
CVE-2020-27753 | Medium | 5.5 | 2020-12-08 | There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file… |
CVE-2020-27752 | High | 7.1 | 2020-12-08 | A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap b… |
CVE-2020-27751 | Low | 3.3 | 2020-12-08 | A flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined… |
CVE-2020-27750 | Medium | 5.5 | 2020-12-08 | A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageM… |
CVE-2020-26256 | Medium | 5.7 | 2020-12-08 | Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDo… |
CVE-2020-25676 | Medium | 5.5 | 2020-12-08 | In CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo(), which are all functions in /MagickCor… |
CVE-2020-25675 | Low | 3.3 | 2020-12-08 | In the CropImage() and CropImageToTiles() routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsets was causing undefi… |
CVE-2020-25674 | Medium | 5.5 | 2020-12-08 | WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ via heap-buffer-overfl… |
CVE-2020-27950 | Medium | 5.5 | 2020-12-08 | A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High… |
CVE-2020-27932 | High | 7.8 | 2020-12-08 | A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Securit… |
CVE-2020-27930 | High | 7.8 | 2020-12-08 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Se… |
CVE-2020-27929 | Medium | 5.5 | 2020-12-08 | A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.4.9. A use… |
CVE-2020-27927 | High | 7.8 | 2020-12-08 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, wat… |
CVE-2020-27926 | High | 7.8 | 2020-12-08 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.2 and iPadOS 14.2. Processing maliciously crafted web conte… |
CVE-2020-27925 | Medium | 5.5 | 2020-12-08 | An issue existed in the handling of incoming calls. The issue was addressed with additional state checks. This issue is fixed in iOS 14.2 and iPadOS 14.2. A us… |
CVE-2020-27917 | High | 7.8 | 2020-12-08 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iClou… |
CVE-2020-27916 | High | 7.8 | 2020-12-08 | An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS… |
CVE-2020-27912 | High | 7.8 | 2020-12-08 | An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud… |
CVE-2020-27911 | High | 7.8 | 2020-12-08 | An integer overflow was addressed through improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud… |
CVE-2020-27910 | High | 7.8 | 2020-12-08 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7… |
CVE-2020-27909 | High | 7.8 | 2020-12-08 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. Processing a malic… |
CVE-2020-27906 | High | 8.8 | 2020-12-08 | Multiple integer overflows were addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1. A remote attacker may be able to cause u… |
CVE-2020-27905 | High | 7.8 | 2020-12-08 | A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. A malicious ap… |
CVE-2020-27904 | High | 7.8 | 2020-12-08 | A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1. An applic… |
CVE-2020-27903 | High | 7.8 | 2020-12-08 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.0.1. An application may be able to gain elevated privileges. |
CVE-2020-27902 | Medium | 4.6 | 2020-12-08 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 14.2 and iPadOS 14.2. A person with physical access to an iOS… |
CVE-2020-27900 | Medium | 5.5 | 2020-12-08 | An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A malicious… |
CVE-2020-27898 | Medium | 5.5 | 2020-12-08 | A denial of service issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1. An attacker may be able to bypass Managed Fr… |
CVE-2020-27895 | Low | 3.3 | 2020-12-08 | An information disclosure issue existed in the transition of program state. This issue was addressed with improved state handling. This issue is fixed in iTune… |
CVE-2020-25667 | Medium | 5.5 | 2020-12-08 | TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` within `profile` due… |
CVE-2020-25666 | Low | 3.3 | 2020-12-08 | There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations. This occurs in the rg… |
CVE-2020-25665 | Medium | 5.5 | 2020-12-08 | The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be offset by 256. This c… |
CVE-2020-25664 | Medium | 6.1 | 2020-12-08 | In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds write later when Po… |
CVE-2020-25663 | Medium | 5.5 | 2020-12-08 | A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow REA… |
CVE-2020-10017 | High | 7.8 | 2020-12-08 | An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS… |
CVE-2020-9999 | High | 7.8 | 2020-12-08 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, iTunes for Windows 12.10.9. Processing a m… |
CVE-2020-9996 | High | 7.8 | 2020-12-08 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.0 and iPadOS 14.0. A malicious applic… |
CVE-2020-9993 | Medium | 4.3 | 2020-12-08 | The issue was addressed with improved UI handling. This issue is fixed in watchOS 7.0, Safari 14.0, iOS 14.0 and iPadOS 14.0. Visiting a malicious website may… |
CVE-2020-9989 | Medium | 5.5 | 2020-12-08 | The issue was addressed with improved deletion. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0. A local user may be able to… |
CVE-2020-9988 | Medium | 5.5 | 2020-12-08 | The issue was addressed with improved deletion. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.0 and iPadOS 14.0. A local user may be able to discover a u… |
CVE-2020-9987 | Medium | 4.3 | 2020-12-08 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 14.0. Visiting a malicious website may lead to… |
CVE-2020-9981 | High | 7.8 | 2020-12-08 | A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9… |
CVE-2020-9977 | Medium | 5.5 | 2020-12-08 | A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed i… |
CVE-2020-9974 | Medium | 5.5 | 2020-12-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. A ma… |
CVE-2020-9972 | High | 7.8 | 2020-12-08 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted USD file… |
CVE-2020-9969 | Medium | 5.5 | 2020-12-08 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, tvOS 14.0, iOS 14.0 and iPadOS 14… |
CVE-2020-9966 | High | 7.8 | 2020-12-08 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, tvOS 14.0, iOS 14.0 and iPadOS 14… |
CVE-2020-9965 | High | 7.8 | 2020-12-08 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, tvOS 14.0, iOS 14.0 and iPadOS 14… |
CVE-2020-9963 | Medium | 5.5 | 2020-12-08 | The issue was addressed with improved handling of icon caches. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.0 and iPadOS 14.0. A malicious app may be ab… |
CVE-2020-9954 | High | 7.8 | 2020-12-08 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in watchOS 7.0, tvOS 14.0, macOS Catalina 10.15.7, Security Update 202… |
CVE-2020-9950 | High | 8.8 | 2020-12-08 | A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, tvOS 14.0, Safari 14.0, iOS 14.0 and iPadOS 14.0. Pro… |
CVE-2020-9949 | High | 7.8 | 2020-12-08 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0, macOS… |
CVE-2020-9947 | High | 8.8 | 2020-12-08 | A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9… |
CVE-2020-9945 | Medium | 4.3 | 2020-12-08 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, Safari… |
CVE-2020-9944 | Medium | 5.5 | 2020-12-08 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, tvOS 14.0, iOS 14.0 and iPadOS 14… |
CVE-2020-9943 | Medium | 5.5 | 2020-12-08 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, tvOS 14.0, iOS 14.0 and iPadOS 14… |
CVE-2020-9942 | Medium | 4.3 | 2020-12-08 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, Safari 13.1.2. Visiting a malic… |
CVE-2020-9922 | Medium | 6.5 | 2020-12-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 202… |
CVE-2020-9849 | Medium | 6.5 | 2020-12-08 | An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14… |
CVE-2020-28946 | High | 7.5 | 2020-12-08 | An improper webserver configuration on Plum IK-401 devices with firmware before 1.02 allows an attacker (with network access to the device) to obtain the confi… |
CVE-2020-27894 | Medium | 5.5 | 2020-12-08 | The issue was addressed with additional user controls. This issue is fixed in macOS Big Sur 11.0.1. Users may be unable to remove metadata indicating where fil… |
CVE-2020-26233 | High | 7.3 | 2020-12-08 | Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core befo… |
CVE-2020-14207 | Medium | 5.3 | 2020-12-08 | The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via… |
CVE-2020-14206 | Medium | 6.1 | 2020-12-08 | The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter). |
CVE-2020-14205 | Medium | 5.3 | 2020-12-08 | The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization checks. An attacker… |
CVE-2020-10016 | High | 7.8 | 2020-12-08 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watch… |
CVE-2020-10014 | Medium | 6.3 | 2020-12-08 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Big Sur 11.0.1. A malicious applic… |
CVE-2020-10013 | High | 7.8 | 2020-12-08 | A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.0, iOS 14.0 and iPadOS 14.0. An application may be able to execute a… |
CVE-2020-10012 | Medium | 6.1 | 2020-12-08 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.0.1. Processing a maliciously crafted document may lea… |
CVE-2020-10011 | High | 7.8 | 2020-12-08 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 14.2 and iPadOS 14.2, macOS Catalina 10.15.7, Security Update 202… |
CVE-2020-10010 | High | 7.8 | 2020-12-08 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. A… |
CVE-2020-10009 | Medium | 5.5 | 2020-12-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1. A sandboxed process may be able to circumvent sandbox… |
CVE-2020-10007 | Medium | 5.5 | 2020-12-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to determine kerne… |
CVE-2020-10006 | Medium | 5.5 | 2020-12-08 | This issue was addressed with improved entitlements. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to access restricted file… |
CVE-2020-10004 | High | 7.8 | 2020-12-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2. Opening a maliciously crafte… |
CVE-2020-10003 | High | 7.8 | 2020-12-08 | An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in macOS Big Sur… |
CVE-2020-10002 | Medium | 5.5 | 2020-12-08 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Wind… |
CVE-2020-29602 | Critical | 9.8 | 2020-12-08 | The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user. System using the irssi docker container deployed… |
CVE-2020-29601 | Critical | 9.8 | 2020-12-08 | The official notary docker images before signer-0.6.1-1 contain a blank password for a root user. System using the notary docker container deployed by affected… |
CVE-2020-29581 | Critical | 9.8 | 2020-12-08 | The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped docker container deployed by affected ve… |
CVE-2020-29580 | Critical | 9.8 | 2020-12-08 | The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker container deployed by affected versions… |
CVE-2020-29579 | Critical | 9.8 | 2020-12-08 | The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed… |
CVE-2020-29577 | Critical | 9.8 | 2020-12-08 | The official znc docker images before 1.7.1-slim contain a blank password for a root user. Systems using the znc docker container deployed by affected versions… |
CVE-2020-29576 | Critical | 9.8 | 2020-12-08 | The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop Docker container deployed by affected ve… |
CVE-2020-29575 | Critical | 9.8 | 2020-12-08 | The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. Systems using the elixir Linux Docker contain… |
CVE-2020-29564 | Critical | 9.8 | 2020-12-08 | The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected v… |
CVE-2020-1971 | Medium | 5.9 | 2020-12-08 | The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a fu… |
CVE-2020-29578 | Critical | 9.8 | 2020-12-08 | The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docker container deploye… |
CVE-2020-26255 | Medium | 6.8 | 2020-12-08 | Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upl… |
CVE-2020-26254 | High | 7.7 | 2020-12-08 | omniauth-apple is the OmniAuth strategy for "Sign In with Apple" (RubyGem omniauth-apple). In omniauth-apple before version 1.0.1 attackers can fake their emai… |
CVE-2020-25955 | Medium | 5.4 | 2020-12-08 | SourceCodester Student Management System Project in PHP version 1.0 is vulnerable to stored a cross-site scripting (XSS) via the 'add subject' tab. |
CVE-2020-29540 | High | 7.5 | 2020-12-08 | API calls in the Translation API feature in Systran Pure Neural Server before 9.7.0 allow a threat actor to use the Systran Pure Neural Server as a Denial-of-S… |
CVE-2020-29539 | Medium | 5.4 | 2020-12-08 | A Cross-Site Scripting (XSS) issue in WebUI Translation in Systran Pure Neural Server before 9.7.0 allows a threat actor to have a remote authenticated user ru… |
CVE-2020-25889 | Critical | 9.8 | 2020-12-08 | Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attacker… |
CVE-2020-17531 | Critical | 9.8 | 2020-12-08 | A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the pa… |
CVE-2020-26253 | Medium | 6.8 | 2020-12-08 | Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may b… |
CVE-2020-27822 | Medium | 5.9 | 2020-12-08 | A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTraci… |
CVE-2020-27818 | Low | 3.3 | 2020-12-08 | A flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be processed by pngcheck could cause a temp… |
CVE-2020-25692 | High | 7.5 | 2020-12-08 | A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could… |