2020 CVEs (page 70)
Page 70 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-28367 | High | 7.5 | 2020-11-18 | Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a… |
CVE-2020-28366 | High | 7.5 | 2020-11-18 | Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in… |
CVE-2020-28362 | High | 7.5 | 2020-11-18 | Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. |
CVE-2020-28091 | High | 7.5 | 2020-11-18 | cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php. |
CVE-2020-26933 | High | 7.2 | 2020-11-18 | Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during… |
CVE-2020-26554 | Medium | 6.1 | 2020-11-18 | REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message. |
CVE-2020-28005 | Medium | 6.5 | 2020-11-18 | httpd on TP-Link TL-WPA4220 devices (hardware versions 2 through 4) allows remote authenticated users to trigger a buffer overflow (causing a denial of service… |
CVE-2020-26884 | Medium | 6.1 | 2020-11-18 | RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability… |
CVE-2020-25406 | High | 7.3 | 2020-11-18 | app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files. |
CVE-2020-24297 | High | 8.8 | 2020-11-18 | httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS commands by sending crafted POST requests… |
CVE-2020-6016 | Critical | 9.8 | 2020-11-18 | Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveUnreliableSegment()… |
CVE-2020-28724 | Medium | 6.1 | 2020-11-18 | Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. |
CVE-2020-7564 | High | 8.8 | 2020-11-18 | A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and M… |
CVE-2020-7563 | High | 8.8 | 2020-11-18 | A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communicatio… |
CVE-2020-7562 | High | 8.1 | 2020-11-18 | A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication… |
CVE-2020-28361 | Medium | 5.4 | 2020-11-18 | Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protecti… |
CVE-2020-24723 | Medium | 4.8 | 2020-11-18 | Cross Site Scripting (XSS) vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & Login and User Management System With ad… |
CVE-2020-28917 | Medium | 6.5 | 2020-11-18 | An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 fronten… |
CVE-2020-28915 | Medium | 5.8 | 2020-11-18 | A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka C… |
CVE-2020-28183 | Critical | 9.8 | 2020-11-17 | SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php. |
CVE-2020-28914 | High | 7.1 | 2020-11-17 | An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or direc… |
CVE-2020-28092 | Medium | 6.1 | 2020-11-17 | PESCMS Team 2.3.2 has multiple reflected XSS via the id parameter:?g=Team&m=Task&a=my&status=3&id=,?g=Team&m=Task&a=my&status=0&id=,?g=Team&m=Task&a=my&status=… |
CVE-2020-28130 | Critical | 9.8 | 2020-11-17 | An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution… |
CVE-2020-28129 | Medium | 6.1 | 2020-11-17 | Stored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index… |
CVE-2020-26553 | Critical | 9.8 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R6.0.2483. Several APIs contain functions that allow arbitrary files to be uploaded to the web tree. |
CVE-2020-26552 | High | 7.5 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R6.0.2483. Multiple executable files, that implement API endpoints, do not require a valid session ID for… |
CVE-2020-26551 | High | 7.5 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file. |
CVE-2020-26550 | High | 7.5 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated systems is protected by a three-characte… |
CVE-2020-26549 | High | 7.5 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R5.4.1290. The htaccess protection mechanism to prevent requests to directories can be bypassed for file… |
CVE-2020-26548 | High | 8.8 | 2020-11-17 | An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the… |
CVE-2020-26216 | High | 8.0 | 2020-11-17 | TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been det… |
CVE-2020-25890 | Medium | 6.1 | 2020-11-17 | The web application of Kyocera printer (ECOSYS M2640IDW) is affected by Stored XSS vulnerability, discovered in the addition a new contact in "Machine Address… |
CVE-2020-28136 | High | 8.8 | 2020-11-17 | An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-packag… |
CVE-2020-28133 | Critical | 9.8 | 2020-11-17 | An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. There was authentication bypass in web login functionality allow… |
CVE-2020-25988 | Medium | 6.5 | 2020-11-17 | UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H) has an action 'X_GetAccess' which leaks the credentials of 'admin', p… |
CVE-2020-28140 | Critical | 9.8 | 2020-11-17 | SourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image upload feature of Products.php. |
CVE-2020-28139 | Medium | 6.1 | 2020-11-17 | SourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail field in offer.php. |
CVE-2020-28138 | Critical | 9.8 | 2020-11-17 | SourceCodester Online Clothing Store 1.0 is affected by a SQL Injection via the txtUserName parameter to login.php. |
CVE-2020-26405 | High | 7.1 | 2020-11-17 | Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Aff… |
CVE-2020-13349 | Medium | 4.3 | 2020-11-17 | An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Searc… |
CVE-2020-13348 | Medium | 5.7 | 2020-11-17 | An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targeting a branch witho… |
CVE-2020-26701 | Medium | 5.4 | 2020-11-17 | Cross-site scripting (XSS) vulnerability in Dashboards section in Kaa IoT Platform v1.2.0 allows remote attackers to inject malicious web scripts or HTML Injec… |
CVE-2020-25400 | High | 7.5 | 2020-11-17 | Cross domain policies in Taskcafe Project Management tool before version 0.1.0 and 0.1.1 allows remote attackers to access sensitive data such as access token. |
CVE-2020-13351 | Medium | 6.5 | 2020-11-17 | Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on… |
CVE-2020-13350 | Low | 3.1 | 2020-11-17 | CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runne… |
CVE-2020-13958 | High | 7.8 | 2020-11-17 | A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target u… |
CVE-2020-27558 | Medium | 6.5 | 2020-11-17 | Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream. |
CVE-2020-27557 | Medium | 5.5 | 2020-11-17 | Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows local users to gain access to the video streaming usern… |
CVE-2020-27556 | Medium | 5.3 | 2020-11-17 | A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device. |
CVE-2020-27555 | Critical | 9.8 | 2020-11-17 | Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to execute arbitrary system commands a… |
CVE-2020-27554 | High | 7.5 | 2020-11-17 | Cleartext Transmission of Sensitive Information vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 exists which could leak sensitive information tra… |
CVE-2020-27553 | High | 7.5 | 2020-11-17 | In BASETech GE-131 BT-1837836 firmware 20180921, the web-server on the system is configured with the option “DocumentRoot /etc“. This allows an attacker with n… |
CVE-2020-25798 | Medium | 5.4 | 2020-11-17 | A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbit… |
CVE-2020-21665 | High | 7.2 | 2020-11-17 | In fastadmin V1.0.0.20191212_beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/aja… |
CVE-2020-7841 | High | 8.8 | 2020-11-17 | Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string is begun with http… |
CVE-2020-28688 | High | 8.8 | 2020-11-17 | The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files. |
CVE-2020-28687 | High | 8.8 | 2020-11-17 | The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files. |
CVE-2020-28647 | Medium | 5.4 | 2020-11-17 | In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer inst… |
CVE-2020-25746 | Medium | 4.6 | 2020-11-17 | QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obtain sensitive information via the debug… |
CVE-2020-7774 | High | 7.3 | 2020-11-17 | The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. |
CVE-2020-27131 | High | 8.1 | 2020-11-17 | Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute… |
CVE-2020-27130 | Critical | 9.1 | 2020-11-17 | A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to… |
CVE-2020-27125 | High | 7.4 | 2020-11-17 | A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerabil… |
CVE-2020-27192 | High | 7.8 | 2020-11-17 | BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker to inject code int… |
CVE-2020-25833 | Medium | 4.8 | 2020-11-17 | Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. The vulnerability could be exploited to… |
CVE-2020-25832 | Medium | 5.4 | 2020-11-17 | Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability could be exploited to perform Reflected XS… |
CVE-2020-25705 | High | 7.4 | 2020-11-17 | A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively by… |
CVE-2020-15349 | High | 7.8 | 2020-11-17 | BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC interface that allows… |
CVE-2020-14389 | High | 8.1 | 2020-11-17 | It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing a… |
CVE-2020-11851 | Critical | 9.8 | 2020-11-17 | Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploi… |
CVE-2020-10776 | Medium | 4.8 | 2020-11-17 | A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to… |
CVE-2020-26406 | Medium | 5.3 | 2020-11-17 | Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to… |
CVE-2020-25834 | Medium | 5.4 | 2020-11-17 | Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploited resulting in Cr… |
CVE-2020-13358 | Medium | 4.7 | 2020-11-17 | A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. Affected versions a… |
CVE-2020-13354 | Medium | 4.3 | 2020-11-17 | A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of ba… |
CVE-2020-13353 | Low | 2.5 | 2020-11-17 | When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. |
CVE-2020-13352 | Low | 3.7 | 2020-11-17 | Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10… |
CVE-2020-11860 | Medium | 6.1 | 2020-11-17 | Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited… |
CVE-2020-26225 | High | 8.7 | 2020-11-16 | In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The… |
CVE-2020-26224 | High | 7.5 | 2020-11-16 | In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows… |
CVE-2020-28693 | High | 8.8 | 2020-11-16 | An unrestricted file upload issue in HorizontCMS 1.0.0-beta allows an authenticated remote attacker to upload PHP code through a zip file by uploading a theme… |
CVE-2020-27486 | Critical | 9.9 | 2020-11-16 | Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the att… |
CVE-2020-27485 | Critical | 9.9 | 2020-11-16 | Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the a… |
CVE-2020-27484 | Critical | 9.9 | 2020-11-16 | Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the at… |
CVE-2020-27483 | Critical | 9.9 | 2020-11-16 | Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the a… |
CVE-2020-26217 | High | 8.0 | 2020-11-16 | XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by mani… |
CVE-2020-26510 | Critical | 9.8 | 2020-11-16 | Airleader Master <= 6.21 devices have default credentials that can be used to access the exposed Tomcat Manager for deployment of a new .war file, with resulta… |
CVE-2020-26509 | High | 7.5 | 2020-11-16 | Airleader Master and Easy <= 6.21 devices have default credentials that can be used for a denial of service. |
CVE-2020-26508 | Critical | 9.8 | 2020-11-16 | The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export feature, even though thes… |
CVE-2020-28692 | High | 7.2 | 2020-11-16 | In Gila CMS 1.16.0, an attacker can upload a shell to tmp directy and abuse .htaccess through the logs function for executing PHP files. |
CVE-2020-23490 | High | 7.5 | 2020-11-16 | There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrar… |
CVE-2020-23489 | High | 8.8 | 2020-11-16 | The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to ce… |
CVE-2020-4763 | Medium | 4.3 | 2020-11-16 | IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Att… |
CVE-2020-4705 | Medium | 4.8 | 2020-11-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2020-4700 | High | 8.8 | 2020-11-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user belonging to a specific user… |
CVE-2020-4692 | Medium | 6.5 | 2020-11-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user to obtain sensitive informat… |
CVE-2020-4672 | Medium | 5.4 | 2020-11-16 | IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2020-4671 | Medium | 6.5 | 2020-11-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 stores potentially sensitive information in log files that cou… |
CVE-2020-4665 | Medium | 4.3 | 2020-11-16 | IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on authorization tokens or session cookies. Att… |
CVE-2020-4655 | High | 8.8 | 2020-11-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send s… |