2020 CVEs (page 76)
Page 76 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3579 | Medium | 6.1 | 2020-11-06 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site… |
CVE-2020-3574 | High | 7.5 | 2020-11-06 | A vulnerability in the TCP packet processing functionality of Cisco IP Phones could allow an unauthenticated, remote attacker to cause the phone to stop respon… |
CVE-2020-3573 | High | 7.8 | 2020-11-06 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary co… |
CVE-2020-3556 | High | 7.3 | 2020-11-06 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacke… |
CVE-2020-3551 | Medium | 6.1 | 2020-11-06 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2020-3444 | High | 7.5 | 2020-11-06 | A vulnerability in the packet filtering features of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters… |
CVE-2020-3371 | Medium | 6.3 | 2020-11-06 | A vulnerability in the web UI of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary code and execut… |
CVE-2020-3284 | Critical | 9.8 | 2020-11-06 | A vulnerability in the enhanced Preboot eXecution Environment (PXE) boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacke… |
CVE-2020-28328 | High | 8.8 | 2020-11-06 | SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account… |
CVE-2020-28327 | Medium | 5.3 | 2020-11-06 | A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. and Cert… |
CVE-2020-27129 | Medium | 6.7 | 2020-11-06 | A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and… |
CVE-2020-27128 | Medium | 6.5 | 2020-11-06 | A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an… |
CVE-2020-27123 | Medium | 5.5 | 2020-11-06 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2020-27122 | Medium | 6.7 | 2020-11-06 | A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to elevate p… |
CVE-2020-27121 | Medium | 4.3 | 2020-11-06 | A vulnerability in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) Software could allow an authenticated, remote attacker… |
CVE-2020-26086 | Medium | 4.3 | 2020-11-06 | A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, remote attacker to ga… |
CVE-2020-26084 | Medium | 6.5 | 2020-11-06 | A vulnerability in the REST API of Cisco Edge Fog Fabric could allow an authenticated, remote attacker to access files outside of their authorization sphere on… |
CVE-2020-26083 | Medium | 4.8 | 2020-11-06 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative… |
CVE-2020-26214 | Critical | 9.1 | 2020-11-06 | In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP a… |
CVE-2020-8577 | Medium | 5.9 | 2020-11-06 | SANtricity OS Controller Software versions 11.50.1 and higher are susceptible to a vulnerability which could allow an attacker to discover sensitive informatio… |
CVE-2020-5794 | High | 7.8 | 2020-11-06 | A vulnerability in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows could allow an authenticated local attacker to execute arbitrary code… |
CVE-2020-26213 | Medium | 5.9 | 2020-11-06 | In teler before version 0.0.1, if you run teler inside a Docker container and encounter `errors.Exit` function, it will cause denial-of-service (`SIGSEGV`) bec… |
CVE-2020-25174 | High | 7.8 | 2020-11-06 | A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged… |
CVE-2020-25172 | Critical | 9.8 | 2020-11-06 | A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files. |
CVE-2020-25170 | High | 7.8 | 2020-11-06 | An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are m… |
CVE-2020-8580 | High | 7.5 | 2020-11-06 | SANtricity OS Controller Software versions 11.30 and higher are susceptible to a vulnerability which allows an unauthenticated attacker with access to the syst… |
CVE-2020-7198 | High | 8.8 | 2020-11-06 | There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer. HPE has provided updates to… |
CVE-2020-5795 | Medium | 6.2 | 2020-11-06 | UNIX Symbolic Link (Symlink) Following in TP-Link Archer A7(US)_V5_200721 allows an authenticated admin user, with physical access and network access, to execu… |
CVE-2020-4484 | Medium | 4.3 | 2020-11-06 | IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could disclose sensitive information to an authenticated user that could be used in further a… |
CVE-2020-4483 | Medium | 4.3 | 2020-11-06 | IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error… |
CVE-2020-4482 | Medium | 6.5 | 2020-11-06 | IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow an authenticated user to bypass security. A user with access to a snapshot could… |
CVE-2020-27589 | High | 7.5 | 2020-11-06 | Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases. |
CVE-2020-27196 | High | 7.5 | 2020-11-06 | An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type head… |
CVE-2020-26883 | High | 7.5 | 2020-11-06 | In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents. |
CVE-2020-26882 | High | 7.5 | 2020-11-06 | In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input. |
CVE-2020-10292 | High | 8.2 | 2020-11-06 | Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes… |
CVE-2020-10291 | High | 7.5 | 2020-11-06 | Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes… |
CVE-2020-28196 | High | 7.5 | 2020-11-06 | MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/as… |
CVE-2020-27617 | Medium | 6.5 | 2020-11-06 | eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lack… |
CVE-2020-27616 | Medium | 6.5 | 2020-11-06 | ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process. |
CVE-2020-27152 | Medium | 5.5 | 2020-11-06 | An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper intera… |
CVE-2020-26892 | Critical | 9.8 | 2020-11-06 | The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled. |
CVE-2020-26521 | High | 7.5 | 2020-11-06 | The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code). |
CVE-2020-25592 | Critical | 9.8 | 2020-11-06 | In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. |
CVE-2020-17490 | Medium | 5.5 | 2020-11-06 | The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. |
CVE-2020-16846 | Critical | 9.8 | 2020-11-06 | An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injectio… |
CVE-2020-28250 | Critical | 9.8 | 2020-11-06 | Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi because authentication is on the client s… |
CVE-2020-28249 | Medium | 6.1 | 2020-11-06 | Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. |
CVE-2020-28242 | Medium | 6.5 | 2020-11-06 | An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk bef… |
CVE-2020-28241 | Medium | 6.5 | 2020-11-06 | libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c. |
CVE-2020-5667 | Medium | 5.5 | 2020-11-06 | Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service. By exploiting this… |
CVE-2020-5649 | High | 7.5 | 2020-11-06 | Resource management error vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD"… |
CVE-2020-5648 | Critical | 9.8 | 2020-11-06 | Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of G… |
CVE-2020-5647 | Critical | 9.8 | 2020-11-06 | Improper access control vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ a… |
CVE-2020-5646 | High | 7.5 | 2020-11-06 | NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD"… |
CVE-2020-5645 | High | 7.5 | 2020-11-06 | Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earl… |
CVE-2020-5644 | Critical | 9.8 | 2020-11-06 | Buffer overflow vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earli… |
CVE-2020-5643 | Medium | 6.5 | 2020-11-06 | Improper input validation vulnerability in Cybozu Garoon 5.0.0 to 5.0.2 allows a remote authenticated attacker to delete some data of the bulletin board via un… |
CVE-2020-27347 | High | 8.8 | 2020-11-06 | In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by termin… |
CVE-2020-15708 | Critical | 9.3 | 2020-11-06 | Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary fi… |
CVE-2020-7207 | Medium | 6.8 | 2020-11-05 | A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This at… |
CVE-2020-6877 | High | 8.8 | 2020-11-05 | A ZTE product is impacted by an information leak vulnerability. An attacker could use this vulnerability to obtain the authentication password of the handheld… |
CVE-2020-25837 | High | 7.5 | 2020-11-05 | Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. The vulnerability affects versions 4.4.0.0 to 4.4.0.6… |
CVE-2020-25662 | Medium | 5.3 | 2020-11-05 | A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memor… |
CVE-2020-25661 | High | 7.5 | 2020-11-05 | A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with A2MP CID. This flaw… |
CVE-2020-17510 | Critical | 9.8 | 2020-11-05 | Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. |
CVE-2020-13537 | High | 7.8 | 2020-11-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector… |
CVE-2020-13536 | High | 7.8 | 2020-11-05 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector… |
CVE-2020-6015 | Medium | 5.5 | 2020-11-05 | Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent the storage of servic… |
CVE-2020-5946 | High | 7.5 | 2020-11-05 | In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format client-side alerts sent… |
CVE-2020-5945 | High | 8.4 | 2020-11-05 | In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The… |
CVE-2020-5944 | Medium | 4.3 | 2020-11-05 | In BIG-IQ 7.1.0, accessing the DoS Summary events and DNS Overview pages in the BIG-IQ system interface returns an error message due to disabled Grafana revers… |
CVE-2020-5943 | Medium | 6.5 | 2020-11-05 | In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in… |
CVE-2020-5942 | High | 7.5 | 2020-11-05 | In BIG-IP PEM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when processing Capabilities-E… |
CVE-2020-5941 | High | 7.5 | 2020-11-05 | On BIG-IP versions 16.0.0-16.0.0.1 and 15.1.0-15.1.0.5, using the RESOLV::lookup command within an iRule may cause the Traffic Management Microkernel (TMM) to… |
CVE-2020-5940 | Medium | 5.4 | 2020-11-05 | In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-I… |
CVE-2020-5939 | High | 7.5 | 2020-11-05 | In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on VMware, with an Int… |
CVE-2020-5793 | High | 7.8 | 2020-11-05 | A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to c… |
CVE-2020-24439 | Low | 2.8 | 2020-11-05 | Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security fea… |
CVE-2020-24438 | Low | 3.3 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnera… |
CVE-2020-24437 | High | 7.8 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnera… |
CVE-2020-24436 | High | 7.8 | 2020-11-05 | Acrobat Pro DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds write vuln… |
CVE-2020-24435 | High | 7.8 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer over… |
CVE-2020-24434 | Low | 3.3 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vu… |
CVE-2020-24433 | High | 7.8 | 2020-11-05 | Adobe Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a local privilege… |
CVE-2020-24432 | Medium | 6.7 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) and Adobe Acrobat Pro DC 2017.011.30175… |
CVE-2020-24431 | Medium | 4.4 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a security fea… |
CVE-2020-24430 | High | 7.8 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnera… |
CVE-2020-24429 | High | 7.7 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a signature ve… |
CVE-2020-24428 | High | 7.7 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a time-of-chec… |
CVE-2020-24427 | Low | 3.3 | 2020-11-05 | Acrobat Reader versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an input validation vulnera… |
CVE-2020-24426 | Low | 3.3 | 2020-11-05 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vu… |
CVE-2020-8267 | Medium | 5.3 | 2020-11-05 | A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improper… |
CVE-2020-13661 | High | 8.8 | 2020-11-05 | Telerik Fiddler through 5.0.20202.18177 allows attackers to execute arbitrary programs via a hostname with a trailing space character, followed by --utility-an… |
CVE-2020-12147 | Medium | 6.6 | 2020-11-05 | In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchest… |
CVE-2020-12146 | Medium | 6.6 | 2020-11-05 | In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted files on the… |
CVE-2020-12145 | Medium | 6.6 | 2020-11-05 | Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it po… |
CVE-2020-26507 | High | 7.8 | 2020-11-05 | A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote con… |
CVE-2020-4097 | Medium | 6.8 | 2020-11-05 | In HCL Notes version 9 previous to release 9.0.1 FixPack 10 Interim Fix 8, version 10 previous to release 10.0.1 FixPack 6 and version 11 previous to 11.0.1 Fi… |
CVE-2020-26505 | Medium | 6.1 | 2020-11-05 | A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be… |