2020 CVEs (page 73)
Page 73 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-0593 | Medium | 6.7 | 2020-11-12 | Improper buffer restrictions in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2020-0592 | Medium | 6.7 | 2020-11-12 | Out of bounds write in BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or denial o… |
CVE-2020-0591 | Medium | 6.7 | 2020-11-12 | Improper buffer restrictions in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2020-0590 | High | 7.8 | 2020-11-12 | Improper input validation in BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local… |
CVE-2020-0588 | Medium | 6.7 | 2020-11-12 | Improper conditions check in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2020-0587 | Medium | 6.7 | 2020-11-12 | Improper conditions check in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acc… |
CVE-2020-0584 | Medium | 6.2 | 2020-11-12 | Buffer overflow in firmware for Intel(R) SSD DC P4800X and P4801X Series, Intel(R) Optane(TM) SSD 900P and 905P Series may allow an unauthenticated user to pot… |
CVE-2020-0575 | Medium | 5.5 | 2020-11-12 | Improper buffer restrictions in the Intel(R) Unite Client for Windows* before version 4.2.13064 may allow an authenticated user to potentially enable informati… |
CVE-2020-24443 | Medium | 6.1 | 2020-11-12 | Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to vi… |
CVE-2020-24442 | Medium | 6.1 | 2020-11-12 | Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to vi… |
CVE-2020-24441 | Medium | 5.5 | 2020-11-12 | Adobe Acrobat Reader for Android version 20.6.2 (and earlier) does not properly restrict access to directories created by the application. This could result in… |
CVE-2020-9128 | Medium | 4.4 | 2020-11-12 | FusionCompute versions 8.0.0 have an insecure encryption algorithm vulnerability. Attackers with high permissions can exploit this vulnerability to cause infor… |
CVE-2020-27481 | Critical | 9.8 | 2020-11-12 | An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows a… |
CVE-2020-25706 | Medium | 5.4 | 2020-11-12 | A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import previ… |
CVE-2020-25658 | High | 7.5 | 2020-11-12 | It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the c… |
CVE-2020-13954 | Medium | 6.1 | 2020-11-12 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected C… |
CVE-2020-7770 | Medium | 6.5 | 2020-11-12 | This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the… |
CVE-2020-7333 | Medium | 4.8 | 2020-11-12 | Cross site scripting vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows administrators t… |
CVE-2020-7332 | High | 7.0 | 2020-11-12 | Cross Site Request Forgery vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows an attacke… |
CVE-2020-7331 | High | 7.8 | 2020-11-12 | Unquoted service executable path in McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows local users to cause a denial of service and mal… |
CVE-2020-3639 | Critical | 9.8 | 2020-11-12 | u'When a non standard SIP sigcomp message is received from the network, then there may be chances of using more UDVM cycle or memory overflow' in Snapdragon Au… |
CVE-2020-3632 | High | 7.8 | 2020-11-12 | u'Incorrect validation of ring context fetched from host memory can lead to memory overflow' in Snapdragon Compute, Snapdragon Mobile in QSM8350, SC7180, SDX55… |
CVE-2020-11209 | Medium | 5.5 | 2020-11-12 | Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P… |
CVE-2020-11208 | High | 7.8 | 2020-11-12 | Out of Bound issue in DSP services while processing received arguments due to improper validation of length received as an argument' in SD820, SD821, SD820, QC… |
CVE-2020-11207 | High | 7.8 | 2020-11-12 | Buffer overflow in LibFastCV library due to improper size checks with respect to buffer length' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |
CVE-2020-11206 | High | 7.8 | 2020-11-12 | Possible buffer overflow in Fastrpc while handling received parameters due to lack of validation on input parameters' in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2020-11205 | High | 7.8 | 2020-11-12 | u'Possible integer overflow to heap overflow while processing command due to lack of check of packet length received' in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2020-11202 | High | 7.8 | 2020-11-12 | Buffer overflow/underflow occurs when typecasting the buffer passed by CPU internally in the library which is not aligned with the actual size of the structure… |
CVE-2020-11201 | High | 7.8 | 2020-11-12 | Arbitrary access to DSP memory due to improper check in loaded library for data received from CPU side' in Snapdragon Auto, Snapdragon Compute, Snapdragon Cons… |
CVE-2020-11196 | Critical | 9.8 | 2020-11-12 | u'Integer overflow to buffer overflow occurs while playback of ASF clip having unexpected number of codec entries' in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2020-11193 | Critical | 9.8 | 2020-11-12 | u'Buffer over read can happen while parsing mkv clip due to improper typecasting of data returned from atomsize' in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2020-11184 | Critical | 9.8 | 2020-11-12 | u'Possible buffer overflow will occur in video while parsing mp4 clip with crafted esds atom size.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industri… |
CVE-2020-11175 | High | 7.8 | 2020-11-12 | u'Use after free issue in Bluetooth transport driver when a method in the object is accessed after the object has been deleted due to improper timer handling.'… |
CVE-2020-11168 | Critical | 9.8 | 2020-11-12 | u'Null-pointer dereference can occur while accessing data buffer beyond its size that leads to access the buffer beyond its range' in Snapdragon Auto, Snapdrag… |
CVE-2020-11132 | High | 7.1 | 2020-11-12 | u'Buffer over read in boot due to size check ignored before copying GUID attribute from request to response' in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2020-11131 | High | 7.8 | 2020-11-12 | u'Possible buffer overflow in WMA message processing due to integer overflow occurs when processing command received from user space' in Snapdragon Auto, Snapd… |
CVE-2020-11130 | High | 7.8 | 2020-11-12 | u'Possible buffer overflow in WIFI hal process due to copying data without checking the buffer length' in Snapdragon Auto, Snapdragon Compute, Snapdragon Indus… |
CVE-2020-11127 | High | 7.8 | 2020-11-12 | u'Integer overflow can cause a buffer overflow due to lack of table length check in the extensible boot Loader during the validation of security metadata while… |
CVE-2020-11123 | Medium | 5.5 | 2020-11-12 | u'information disclosure in gatekeeper trustzone implementation as the throttling mechanism to prevent brute force attempts at getting user`s lock-screen passw… |
CVE-2020-11121 | High | 7.8 | 2020-11-12 | u'Possible buffer overflow in WIFI hal process due to usage of memcpy without checking length of destination buffer' in Snapdragon Auto, Snapdragon Compute, Sn… |
CVE-2020-7769 | High | 8.6 | 2020-11-12 | This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transpor… |
CVE-2020-26070 | High | 8.6 | 2020-11-12 | A vulnerability in the ingress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauth… |
CVE-2020-2050 | High | 8.2 | 2020-11-12 | An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass al… |
CVE-2020-2048 | Low | 3.3 | 2020-11-12 | An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed… |
CVE-2020-2022 | High | 7.5 | 2020-11-12 | An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's se… |
CVE-2020-2000 | High | 7.2 | 2020-11-12 | An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system p… |
CVE-2020-1999 | Medium | 5.3 | 2020-11-12 | A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the netwo… |
CVE-2020-5992 | High | 7.8 | 2020-11-11 | NVIDIA GeForce NOW application software on Windows, all versions prior to 2.0.25.119, contains a vulnerability in its open-source software dependency in which… |
CVE-2020-26221 | High | 8.0 | 2020-11-11 | touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could… |
CVE-2020-26220 | Low | 3.5 | 2020-11-11 | toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain i… |
CVE-2020-26219 | Medium | 4.7 | 2020-11-11 | touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to… |
CVE-2020-26218 | High | 8.0 | 2020-11-11 | touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defac… |
CVE-2020-8354 | Medium | 6.4 | 2020-11-11 | A potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook models may allow arbitrary code execution. |
CVE-2020-8353 | Medium | 6.7 | 2020-11-11 | Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabl… |
CVE-2020-8352 | Low | 2.4 | 2020-11-11 | In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes. |
CVE-2020-5426 | Critical | 9.8 | 2020-11-11 | Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended… |
CVE-2020-15275 | High | 8.7 | 2020-11-11 | MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. Thi… |
CVE-2020-27524 | High | 7.1 | 2020-11-11 | On Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7 MMI Multiplayer with version (N+R_CN_AU_P0395) mishandles %x and %s format string specifiers in a… |
CVE-2020-27523 | High | 7.5 | 2020-11-11 | Solstice-Pod up to 5.0.2 WEBRTC server mishandles the format-string specifiers %x; %p; %c and %s in the screen_key, display_name, browser_name, and operation_s… |
CVE-2020-4685 | High | 7.2 | 2020-11-11 | A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is insta… |
CVE-2020-7768 | High | 7.5 | 2020-11-11 | The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. |
CVE-2020-7767 | Medium | 5.3 | 2020-11-11 | All versions of package express-validators are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-crafted invalid urls. |
CVE-2020-7329 | High | 7.2 | 2020-11-11 | Server-side request forgery vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers trigger server-side DNS reques… |
CVE-2020-7328 | High | 7.2 | 2020-11-11 | External entity attack vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers to gain control of a resource or tr… |
CVE-2020-1599 | Medium | 5.5 | 2020-11-11 | Windows Spoofing Vulnerability |
CVE-2020-1325 | Medium | 5.4 | 2020-11-11 | Azure DevOps Server and Team Foundation Services Spoofing Vulnerability |
CVE-2020-17113 | Medium | 5.5 | 2020-11-11 | Windows Camera Codec Information Disclosure Vulnerability |
CVE-2020-17110 | High | 7.8 | 2020-11-11 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2020-17109 | High | 7.8 | 2020-11-11 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2020-17108 | High | 7.8 | 2020-11-11 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2020-17107 | High | 7.8 | 2020-11-11 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2020-17106 | High | 7.8 | 2020-11-11 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2020-17105 | High | 7.8 | 2020-11-11 | AV1 Video Extension Remote Code Execution Vulnerability |
CVE-2020-17104 | High | 7.8 | 2020-11-11 | Visual Studio Code JSHint Extension Remote Code Execution Vulnerability |
CVE-2020-17102 | Medium | 5.5 | 2020-11-11 | WebP Image Extensions Information Disclosure Vulnerability |
CVE-2020-17101 | High | 7.8 | 2020-11-11 | HEIF Image Extensions Remote Code Execution Vulnerability |
CVE-2020-17100 | Medium | 5.5 | 2020-11-11 | Visual Studio Tampering Vulnerability |
CVE-2020-17091 | High | 7.8 | 2020-11-11 | Microsoft Teams Remote Code Execution Vulnerability |
CVE-2020-17090 | Medium | 5.3 | 2020-11-11 | Microsoft Defender for Endpoint Security Feature Bypass Vulnerability |
CVE-2020-17088 | High | 7.8 | 2020-11-11 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2020-17087 | High | 7.8 | 2020-11-11 | Windows Kernel Local Elevation of Privilege Vulnerability |
CVE-2020-17086 | High | 7.8 | 2020-11-11 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2020-17085 | Medium | 6.2 | 2020-11-11 | Microsoft Exchange Server Denial of Service Vulnerability |
CVE-2020-17084 | High | 8.5 | 2020-11-11 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2020-17083 | Medium | 5.5 | 2020-11-11 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2020-17082 | High | 7.8 | 2020-11-11 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2020-17081 | Medium | 5.5 | 2020-11-11 | Microsoft Raw Image Extension Information Disclosure Vulnerability |
CVE-2020-17079 | High | 7.8 | 2020-11-11 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2020-17078 | High | 7.8 | 2020-11-11 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2020-17077 | High | 7.8 | 2020-11-11 | Windows Update Stack Elevation of Privilege Vulnerability |
CVE-2020-17076 | High | 7.8 | 2020-11-11 | Windows Update Orchestrator Service Elevation of Privilege Vulnerability |
CVE-2020-17075 | High | 7.8 | 2020-11-11 | Windows USO Core Worker Elevation of Privilege Vulnerability |
CVE-2020-17074 | High | 7.8 | 2020-11-11 | Windows Update Orchestrator Service Elevation of Privilege Vulnerability |
CVE-2020-17073 | High | 7.8 | 2020-11-11 | Windows Update Orchestrator Service Elevation of Privilege Vulnerability |
CVE-2020-17071 | Medium | 5.5 | 2020-11-11 | Windows Delivery Optimization Information Disclosure Vulnerability |
CVE-2020-17070 | High | 7.8 | 2020-11-11 | Windows Update Medic Service Elevation of Privilege Vulnerability |
CVE-2020-17069 | Medium | 5.5 | 2020-11-11 | Windows NDIS Information Disclosure Vulnerability |
CVE-2020-17068 | High | 7.8 | 2020-11-11 | Windows GDI+ Remote Code Execution Vulnerability |
CVE-2020-17067 | High | 7.8 | 2020-11-11 | Microsoft Excel Security Feature Bypass Vulnerability |
CVE-2020-17066 | High | 7.8 | 2020-11-11 | Microsoft Excel Remote Code Execution Vulnerability |