2020 CVEs (page 75)
Page 75 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26811 | Medium | 5.3 | 2020-11-10 | SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network… |
CVE-2020-26810 | High | 7.5 | 2020-11-10 | SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network… |
CVE-2020-26809 | Medium | 5.3 | 2020-11-10 | SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence… |
CVE-2020-26808 | High | 7.2 | 2020-11-10 | SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 1… |
CVE-2020-26807 | Low | 3.3 | 2020-11-10 | SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder which allows anyone t… |
CVE-2020-25074 | Critical | 9.8 | 2020-11-10 | The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachment… |
CVE-2020-7766 | High | 7.3 | 2020-11-10 | This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.html… |
CVE-2020-28267 | High | 7.5 | 2020-11-10 | Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote code execution. |
CVE-2020-13927 | Critical | 9.8 | 2020-11-10 | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who mi… |
CVE-2020-12485 | Medium | 5.5 | 2020-11-10 | The frame touch module does not make validity judgments on parameter lengths when processing specific parameters,which caused out of the boundary when memory a… |
CVE-2020-5388 | Medium | 6.9 | 2020-11-10 | Dell Inspiron 15 7579 2-in-1 BIOS versions prior to 1.31.0 contain an Improper SMM communication buffer verification vulnerability. A local authenticated malic… |
CVE-2020-4760 | Medium | 5.4 | 2020-11-10 | IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2020-4704 | Medium | 5.4 | 2020-11-10 | IBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2020-4568 | Medium | 5.5 | 2020-11-10 | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157. |
CVE-2020-24384 | Critical | 9.8 | 2020-11-10 | A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability that could be used… |
CVE-2020-0454 | Medium | 5.5 | 2020-11-10 | In callCallbackForRequest of ConnectivityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local inform… |
CVE-2020-0453 | Medium | 5.5 | 2020-11-10 | In updateNotification of BeamTransferManager.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information d… |
CVE-2020-0452 | Critical | 9.8 | 2020-11-10 | In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a thir… |
CVE-2020-0451 | High | 8.8 | 2020-11-10 | In sbrDecoder_AssignQmfChannels2SbrChannels of sbrdecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote… |
CVE-2020-0450 | Medium | 6.5 | 2020-11-10 | In rw_i93_sm_format of rw_i93.cc, there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure over NFC w… |
CVE-2020-0449 | High | 8.8 | 2020-11-10 | In btm_sec_disconnected of btm_sec.cc, there is a possible memory corruption due to a use after free. This could lead to remote code execution in the Bluetooth… |
CVE-2020-0448 | Medium | 5.5 | 2020-11-10 | In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permission check. This could… |
CVE-2020-0447 | Critical | 9.8 | 2020-11-10 | There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168251617 |
CVE-2020-0446 | Critical | 9.8 | 2020-11-10 | There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168264528 |
CVE-2020-0445 | Critical | 9.8 | 2020-11-10 | There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168264527 |
CVE-2020-0443 | Medium | 5.5 | 2020-11-10 | In LocaleList of LocaleList.java, there is a possible forced reboot due to an uncaught exception. This could lead to local denial of service requiring factory… |
CVE-2020-0442 | High | 7.5 | 2020-11-10 | In Message and toBundle of Notification.java, there is a possible UI slowdown or crash due to improper input validation. This could lead to remote denial of se… |
CVE-2020-0441 | High | 7.5 | 2020-11-10 | In Message and toBundle of Notification.java, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of ser… |
CVE-2020-0439 | High | 7.8 | 2020-11-10 | In generatePackageInfo of PackageManagerService.java, there is a possible permissions bypass due to an incorrect permission check. This could lead to local esc… |
CVE-2020-0438 | High | 7.8 | 2020-11-10 | In the AIBinder_Class constructor of ibinder.cpp, there is a possible arbitrary code execution due to uninitialized data. This could lead to local escalation o… |
CVE-2020-0437 | Medium | 5.5 | 2020-11-10 | In CellBroadcastReceiver's intent handlers, there is a possible denial of service due to a missing permission check. This could lead to local denial of service… |
CVE-2020-0424 | Medium | 5.5 | 2020-11-10 | In send_vc of res_send.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no ad… |
CVE-2020-0418 | High | 7.8 | 2020-11-10 | In getPermissionInfosForGroup of Utils.java, there is a logic error. This could lead to local escalation of privilege with User execution privileges needed. Us… |
CVE-2020-0409 | High | 7.8 | 2020-11-10 | In create of FileMap.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no addition… |
CVE-2020-16125 | High | 7.2 | 2020-11-10 | gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu (… |
CVE-2020-27694 | High | 8.8 | 2020-11-09 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may vulnerable to attack. |
CVE-2020-27693 | Medium | 4.4 | 2020-11-09 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated. |
CVE-2020-27019 | Medium | 5.5 | 2020-11-09 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulnerability which could allow an attacker t… |
CVE-2020-27018 | Medium | 5.5 | 2020-11-09 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authen… |
CVE-2020-27017 | Medium | 4.9 | 2020-11-09 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow… |
CVE-2020-27016 | High | 8.8 | 2020-11-09 | Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an… |
CVE-2020-28373 | High | 8.8 | 2020-11-09 | upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. This affects R6400v2 V1.0.4.102_10… |
CVE-2020-28371 | Critical | 9.8 | 2020-11-09 | An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStream.java has a boundary check to preven… |
CVE-2020-26168 | Critical | 9.8 | 2020-11-09 | The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly th… |
CVE-2020-14189 | Critical | 9.8 | 2020-11-09 | The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of… |
CVE-2020-14188 | Critical | 9.8 | 2020-11-09 | The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the context… |
CVE-2020-4759 | High | 7.8 | 2020-11-09 | IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, cause… |
CVE-2020-4651 | Medium | 4.8 | 2020-11-09 | IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute… |
CVE-2020-4650 | Low | 3.3 | 2020-11-09 | IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the syste… |
CVE-2020-28364 | Medium | 6.1 | 2020-11-09 | A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing th… |
CVE-2020-27977 | High | 7.8 | 2020-11-09 | CapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges for an actor who attempts to edit registry values, allowing an a… |
CVE-2020-26542 | Critical | 9.8 | 2020-11-09 | An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLDAP authentication in conjunction with Mi… |
CVE-2020-23140 | High | 8.1 | 2020-11-09 | Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any… |
CVE-2020-23139 | Medium | 5.5 | 2020-11-09 | Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which could result in unauthorized access to… |
CVE-2020-23138 | Critical | 9.8 | 2020-11-09 | An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can upload PHP code or any extension (eg- .ex… |
CVE-2020-23136 | Medium | 5.5 | 2020-11-09 | Microweber v1.1.18 is affected by no session expiry after log-out. |
CVE-2020-14366 | Medium | 6.8 | 2020-11-09 | A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a… |
CVE-2020-9300 | Medium | 6.5 | 2020-11-09 | The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participan… |
CVE-2020-9299 | Medium | 5.4 | 2020-11-09 | There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Ty… |
CVE-2020-8276 | Medium | 5.5 | 2020-11-09 | The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the user last opened an in… |
CVE-2020-8268 | High | 7.5 | 2020-11-09 | Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object… |
CVE-2020-8150 | Medium | 4.1 | 2020-11-09 | A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files. |
CVE-2020-8133 | Medium | 5.3 | 2020-11-09 | A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file. |
CVE-2020-25655 | Medium | 5.7 | 2020-11-09 | An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admi… |
CVE-2020-24353 | Medium | 6.1 | 2020-11-09 | Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header. |
CVE-2020-15297 | High | 7.1 | 2020-11-09 | Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows a… |
CVE-2020-28351 | Medium | 6.1 | 2020-11-09 | The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) att… |
CVE-2020-28349 | Medium | 6.5 | 2020-11-09 | An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequ… |
CVE-2020-24407 | Critical | 9.1 | 2020-11-09 | Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulner… |
CVE-2020-24406 | Low | 3.7 | 2020-11-09 | When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installat… |
CVE-2020-24405 | Medium | 4.3 | 2020-11-09 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could… |
CVE-2020-24404 | Low | 2.7 | 2020-11-09 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability co… |
CVE-2020-24403 | Low | 2.7 | 2020-11-09 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability… |
CVE-2020-24402 | Medium | 4.9 | 2020-11-09 | Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could… |
CVE-2020-24401 | Medium | 6.5 | 2020-11-09 | Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under… |
CVE-2020-24400 | High | 7.1 | 2020-11-09 | Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnera… |
CVE-2020-28347 | Critical | 9.8 | 2020-11-08 | tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter. NOTE: this issue exi… |
CVE-2020-7764 | Medium | 5.9 | 2020-11-08 | This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are n… |
CVE-2020-28345 | High | 7.5 | 2020-11-08 | An issue was discovered on LG mobile devices with Android OS 10 software. The Wi-Fi subsystem may crash because of the lack of a NULL parameter check. The LG I… |
CVE-2020-28344 | High | 7.5 | 2020-11-08 | An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. System services may crash because of the lack of a NULL parameter… |
CVE-2020-28343 | High | 7.8 | 2020-11-08 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 980, 9820, and 9830 chipsets) software. The NPU driver allows attackers to ex… |
CVE-2020-28342 | High | 7.8 | 2020-11-08 | An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (China / India) software. The S Secure application allows attackers to bypass authent… |
CVE-2020-28341 | High | 7.8 | 2020-11-08 | An issue was discovered on Samsung mobile devices with Q(10.0) (Exynos990 chipsets) software. The S3K250AF Secure Element CC EAL 5+ chip allows attackers to ex… |
CVE-2020-28340 | Critical | 9.8 | 2020-11-08 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Attackers can bypass Factory Reset Protection (FRP) via S… |
CVE-2020-28339 | High | 7.5 | 2020-11-07 | The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete… |
CVE-2020-16122 | High | 8.2 | 2020-11-07 | PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individua… |
CVE-2020-16121 | Low | 3.3 | 2020-11-07 | PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be u… |
CVE-2020-28168 | Medium | 5.9 | 2020-11-06 | Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that respon… |
CVE-2020-15259 | High | 8.1 | 2020-11-06 | ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidentia… |
CVE-2020-3604 | High | 7.8 | 2020-11-06 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary co… |
CVE-2020-3603 | High | 7.8 | 2020-11-06 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary co… |
CVE-2020-3600 | High | 7.8 | 2020-11-06 | A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vul… |
CVE-2020-3595 | High | 7.8 | 2020-11-06 | A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root group on the underlying operating system. T… |
CVE-2020-3594 | High | 7.8 | 2020-11-06 | A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vul… |
CVE-2020-3593 | High | 7.8 | 2020-11-06 | A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vul… |
CVE-2020-3592 | Medium | 6.5 | 2020-11-06 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization an… |
CVE-2020-3591 | Medium | 4.3 | 2020-11-06 | A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-sit… |
CVE-2020-3590 | Medium | 6.4 | 2020-11-06 | A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-sit… |
CVE-2020-3588 | High | 7.3 | 2020-11-06 | A vulnerability in virtualization channel messaging in Cisco Webex Meetings Desktop App for Windows could allow a local attacker to execute arbitrary code on a… |
CVE-2020-3587 | Medium | 6.4 | 2020-11-06 | A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-sit… |