2020 CVEs (page 71)
Page 71 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4647 | High | 8.8 | 2020-11-16 | IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQ… |
CVE-2020-4566 | Medium | 6.5 | 2020-11-16 | IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 stores potentially highly sensitive information in log files t… |
CVE-2020-4476 | High | 7.5 | 2020-11-16 | IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information when a detailed tec… |
CVE-2020-4475 | Medium | 6.5 | 2020-11-16 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information… |
CVE-2020-28723 | High | 7.5 | 2020-11-16 | Memory leak in IPv6Param::setAddress in CloudAvid PParam 1.3.1. |
CVE-2020-27991 | Medium | 5.4 | 2020-11-16 | Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field). |
CVE-2020-27990 | Medium | 5.4 | 2020-11-16 | Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent). |
CVE-2020-27989 | Medium | 5.4 | 2020-11-16 | Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard). |
CVE-2020-27988 | Medium | 5.4 | 2020-11-16 | Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field). |
CVE-2020-27627 | Medium | 6.1 | 2020-11-16 | JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection. |
CVE-2020-27623 | High | 7.5 | 2020-11-16 | JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances. |
CVE-2020-27622 | Medium | 5.3 | 2020-11-16 | In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version. |
CVE-2020-27423 | High | 7.5 | 2020-11-16 | Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user… |
CVE-2020-27422 | Critical | 9.8 | 2020-11-16 | In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeove… |
CVE-2020-27191 | High | 7.5 | 2020-11-16 | LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Incl… |
CVE-2020-26129 | Medium | 6.5 | 2020-11-16 | In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible. |
CVE-2020-25952 | Critical | 9.8 | 2020-11-16 | SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System With admin panel 2.1 allows remote attackers to execute arbitrar… |
CVE-2020-13773 | Medium | 5.4 | 2020-11-16 | Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_splitcollapse.aspx, /LDMS/alert_log.aspx, /… |
CVE-2020-13772 | Medium | 5.3 | 2020-11-16 | In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathn… |
CVE-2020-13769 | High | 8.8 | 2020-11-16 | LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request. |
CVE-2020-27629 | Medium | 5.3 | 2020-11-16 | In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts. |
CVE-2020-27628 | Medium | 4.3 | 2020-11-16 | In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records. |
CVE-2020-27626 | Medium | 5.3 | 2020-11-16 | JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF. |
CVE-2020-27625 | Medium | 5.3 | 2020-11-16 | In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues. |
CVE-2020-27624 | Medium | 5.3 | 2020-11-16 | JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF. |
CVE-2020-27459 | Medium | 6.1 | 2020-11-16 | Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees the post, the inserted XSS code is execute… |
CVE-2020-25210 | Medium | 5.3 | 2020-11-16 | In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants. |
CVE-2020-25209 | High | 7.5 | 2020-11-16 | In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API. |
CVE-2020-25207 | Critical | 9.8 | 2020-11-16 | JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler. |
CVE-2020-25013 | High | 7.5 | 2020-11-16 | JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler. |
CVE-2020-24366 | Low | 3.3 | 2020-11-16 | Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups. |
CVE-2020-8897 | Medium | 4.8 | 2020-11-16 | A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing propert… |
CVE-2020-7773 | Medium | 6.5 | 2020-11-16 | This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inl… |
CVE-2020-7765 | Medium | 5.6 | 2020-11-16 | This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user i… |
CVE-2020-5664 | Critical | 9.8 | 2020-11-16 | Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary code via unspecified vectors. |
CVE-2020-5663 | Medium | 5.4 | 2020-11-16 | Stored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors. |
CVE-2020-5662 | Medium | 5.4 | 2020-11-16 | Reflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vecto… |
CVE-2020-5659 | High | 8.8 | 2020-11-16 | SQL injection vulnerability in the XooNIps 3.49 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. |
CVE-2020-28656 | Medium | 6.8 | 2020-11-16 | The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically proximate attackers to execute arbitrary… |
CVE-2020-28650 | Medium | 6.4 | 2020-11-16 | The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for t… |
CVE-2020-28649 | High | 8.8 | 2020-11-16 | The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file. |
CVE-2020-28648 | High | 8.8 | 2020-11-16 | Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code. |
CVE-2020-28642 | Critical | 9.8 | 2020-11-16 | In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attackers to conduct ad… |
CVE-2020-8273 | High | 8.8 | 2020-11-16 | Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.8. |
CVE-2020-8272 | High | 7.5 | 2020-11-16 | Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 |
CVE-2020-8271 | Critical | 9.8 | 2020-11-16 | Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8 |
CVE-2020-8270 | High | 8.8 | 2020-11-16 | An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes C… |
CVE-2020-8269 | High | 8.8 | 2020-11-16 | An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CT… |
CVE-2020-8259 | High | 8.1 | 2020-11-16 | Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys. |
CVE-2020-8152 | Medium | 4.4 | 2020-11-16 | Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on. |
CVE-2020-5666 | High | 7.5 | 2020-11-16 | Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/08/16/32/120(EN)CPU… |
CVE-2020-2492 | High | 7.2 | 2020-11-16 | If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS version… |
CVE-2020-2490 | High | 7.2 | 2020-11-16 | If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS version… |
CVE-2020-25695 | High | 8.8 | 2020-11-16 | A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to… |
CVE-2020-25694 | High | 8.1 | 2020-11-16 | A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that cre… |
CVE-2020-28268 | High | 7.5 | 2020-11-15 | Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code e… |
CVE-2020-7772 | High | 7.5 | 2020-11-15 | This affects the package doc-path before 2.1.2. |
CVE-2020-28638 | Critical | 9.8 | 2020-11-13 | ask_password in Tomb 2.0 through 2.7 returns a warning when pinentry-curses is used and $DISPLAY is non-empty, causing affected users' files to be encrypted wi… |
CVE-2020-15481 | High | 7.8 | 2020-11-13 | An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 Build 1008. The kernel driver exposes IO… |
CVE-2020-6157 | Medium | 4.3 | 2020-11-13 | Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into s… |
CVE-2020-5796 | High | 7.8 | 2020-11-13 | Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low… |
CVE-2020-27217 | High | 7.5 | 2020-11-13 | In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may… |
CVE-2020-13638 | Critical | 9.8 | 2020-11-13 | lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3… |
CVE-2020-12338 | Critical | 9.8 | 2020-11-13 | Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user to potentially enable escalation of priv… |
CVE-2020-12313 | High | 8.8 | 2020-11-13 | Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enab… |
CVE-2020-0599 | Medium | 6.7 | 2020-11-13 | Improper access control in the PMC for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2020-7962 | Medium | 5.3 | 2020-11-13 | An issue was discovered in One Identity Password Manager 5.8. An attacker could enumerate valid answers for a user. It is possible for an attacker to detect a… |
CVE-2020-26230 | High | 7.4 | 2020-11-13 | Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19… |
CVE-2020-26223 | High | 7.7 | 2020-11-13 | Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is… |
CVE-2020-8583 | High | 7.5 | 2020-11-13 | Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker to discover sensitive… |
CVE-2020-8582 | Medium | 6.5 | 2020-11-13 | Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an authenticated user to view sens… |
CVE-2020-6019 | High | 7.5 | 2020-11-13 | Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBase::Received_Data()… |
CVE-2020-26222 | High | 8.7 | 2020-11-13 | Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core… |
CVE-2020-25557 | High | 8.8 | 2020-11-13 | In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. After that, when attacker logs in to the… |
CVE-2020-25538 | High | 8.8 | 2020-11-13 | An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in the web page. In th… |
CVE-2020-25165 | High | 7.5 | 2020-11-13 | BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products are vulnerable to a n… |
CVE-2020-25155 | High | 7.5 | 2020-11-13 | The affected product transmits unencrypted sensitive information, which may allow an attacker to access this information on the NIO 50 (all versions). |
CVE-2020-25151 | High | 7.5 | 2020-11-13 | The affected product does not properly validate input, which may allow an attacker to execute a denial-of-service attack on the NIO 50 (all versions). |
CVE-2020-21667 | High | 7.2 | 2020-11-13 | In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL in… |
CVE-2020-9129 | Medium | 6.7 | 2020-11-13 | HUAWEI Mate 30 versions earlier than 10.1.0.159(C00E159R7P2) have a vulnerability of improper buffer operation. Due to improper restrictions, local attackers w… |
CVE-2020-9127 | Medium | 6.7 | 2020-11-13 | Some Huawei products have a command injection vulnerability. Due to insufficient input validation, an attacker with high privilege may inject some malicious co… |
CVE-2020-6156 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, th… |
CVE-2020-6155 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed fi… |
CVE-2020-6150 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow. |
CVE-2020-6149 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, th… |
CVE-2020-6148 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. An instance exists in USDC file f… |
CVE-2020-6147 | High | 7.8 | 2020-11-13 | A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. This instance exists in the USDC… |
CVE-2020-4886 | Low | 3.3 | 2020-11-13 | IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system… |
CVE-2020-26825 | Medium | 6.1 | 2020-11-13 | SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Applicati… |
CVE-2020-1847 | High | 7.5 | 2020-11-13 | There is a denial of service vulnerability in some Huawei products. There is no protection against the attack scenario of specific protocol. A remote, unauthor… |
CVE-2020-7032 | Medium | 6.5 | 2020-11-13 | An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request for… |
CVE-2020-7033 | Medium | 6.3 | 2020-11-13 | A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authenticated user to perf… |
CVE-2020-27193 | Medium | 6.1 | 2020-11-12 | A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading… |
CVE-2020-24719 | Critical | 9.8 | 2020-11-12 | Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic… |
CVE-2020-17494 | Medium | 5.3 | 2020-11-12 | Untangle Firewall NG before 16.0 uses MD5 for passwords. |
CVE-2020-13877 | Critical | 9.8 | 2020-11-12 | SQL Injection issues in various ASPX pages of ResourceXpress Meeting Monitor 4.9 could lead to remote code execution and information disclosure. |
CVE-2020-28415 | Medium | 6.1 | 2020-11-12 | A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute a… |
CVE-2020-28414 | Medium | 6.1 | 2020-11-12 | A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute a… |
CVE-2020-15783 | High | 7.5 | 2020-11-12 | A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC TDC CPU555 (All version… |
CVE-2020-13774 | Critical | 9.9 | 2020-11-12 | An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code… |