2020 CVEs (page 77)
Page 77 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14240 | Medium | 6.1 | 2020-11-05 | HCL Notes versions previous to releases 9.0.1 FP10 IF8, 10.0.1 FP6 and 11.0.1 FP1 is susceptible to a Stored Cross-site Scripting (XSS) vulnerability. An attac… |
CVE-2020-14222 | Medium | 6.1 | 2020-11-05 | HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attack… |
CVE-2020-26506 | Medium | 4.3 | 2020-11-05 | An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain control to files uploade… |
CVE-2020-25399 | High | 7.8 | 2020-11-05 | Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat. |
CVE-2020-25398 | High | 8.8 | 2020-11-05 | CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality. |
CVE-2020-28115 | High | 8.8 | 2020-11-05 | SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the object_path… |
CVE-2020-28047 | Medium | 5.4 | 2020-11-05 | AudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cross-Site-Scripting). If the recommended security configuration parameter "unique_error_numbers" is no… |
CVE-2020-27955 | Critical | 9.8 | 2020-11-05 | Git LFS 2.12.0 allows Remote Code Execution. |
CVE-2020-27688 | High | 7.5 | 2020-11-05 | RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and ke… |
CVE-2020-27402 | High | 7.8 | 2020-11-05 | The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port… |
CVE-2020-24849 | High | 8.8 | 2020-11-05 | A remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly escaped shell metacharacters obtained from the POST request at… |
CVE-2020-15952 | Critical | 9.0 | 2020-11-05 | Immuta v2.8.2 is affected by stored XSS that allows a low-privileged user to escalate privileges to administrative permissions. Additionally, unauthenticated a… |
CVE-2020-15951 | Medium | 6.1 | 2020-11-05 | Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML content that is rendered a… |
CVE-2020-15950 | High | 8.8 | 2020-11-05 | Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout. |
CVE-2020-15949 | High | 7.5 | 2020-11-05 | Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover. |
CVE-2020-7763 | High | 7.5 | 2020-11-05 | This affects the package phantom-html-to-pdf before 0.6.1. |
CVE-2020-7762 | Medium | 6.5 | 2020-11-05 | This affects the package jsreport-chrome-pdf before 1.10.0. |
CVE-2020-7761 | Medium | 5.3 | 2020-11-05 | This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails. |
CVE-2020-27387 | High | 8.8 | 2020-11-05 | An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and exec… |
CVE-2020-25201 | High | 7.5 | 2020-11-04 | HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft… |
CVE-2020-26207 | High | 8.0 | 2020-11-04 | DatabaseSchemaViewer before version 2.7.4.3 is vulnerable to arbitrary code execution if a user is tricked into opening a specially crafted `.dbschema` file. T… |
CVE-2020-27692 | High | 8.8 | 2020-11-04 | The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers ca… |
CVE-2020-27691 | Medium | 6.1 | 2020-11-04 | The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log Settings. |
CVE-2020-27690 | Medium | 5.5 | 2020-11-04 | The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains a buffer overflow within its web management portal. When a POST request is s… |
CVE-2020-7129 | High | 7.2 | 2020-11-04 | A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. |
CVE-2020-7128 | Critical | 9.8 | 2020-11-04 | A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. |
CVE-2020-27689 | Critical | 9.8 | 2020-11-04 | The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web management interface. A r… |
CVE-2020-28049 | Medium | 6.3 | 2020-11-04 | An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unprivileged users to… |
CVE-2020-8037 | High | 7.5 | 2020-11-04 | The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. |
CVE-2020-8036 | High | 7.5 | 2020-11-04 | The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way. |
CVE-2020-22274 | Critical | 9.8 | 2020-11-04 | JomSocial (Joomla Social Network Extention) 4.7.6 allows CSV injection via a customer's profile. |
CVE-2020-22273 | Medium | 6.5 | 2020-11-04 | Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed (such as Payment Settings) |
CVE-2020-26167 | Critical | 9.8 | 2020-11-04 | In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one. |
CVE-2020-22278 | High | 8.8 | 2020-11-04 | phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the dat… |
CVE-2020-22277 | High | 8.0 | 2020-11-04 | Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile. |
CVE-2020-22276 | Critical | 9.8 | 2020-11-04 | WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry. |
CVE-2020-22275 | High | 8.8 | 2020-11-04 | Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system admini… |
CVE-2020-2319 | Medium | 6.5 | 2020-11-04 | Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller where it can b… |
CVE-2020-2318 | Medium | 6.5 | 2020-11-04 | Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they… |
CVE-2020-2317 | Medium | 5.4 | 2020-11-04 | Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability ex… |
CVE-2020-2316 | Medium | 5.4 | 2020-11-04 | Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS)… |
CVE-2020-2315 | Medium | 6.5 | 2020-11-04 | Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2314 | Medium | 5.5 | 2020-11-04 | Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by… |
CVE-2020-2313 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of cred… |
CVE-2020-2312 | Medium | 6.5 | 2020-11-04 | Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs. |
CVE-2020-2311 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS c… |
CVE-2020-2310 | Medium | 4.3 | 2020-11-04 | Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials st… |
CVE-2020-2309 | Medium | 4.3 | 2020-11-04 | A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials… |
CVE-2020-2308 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names. |
CVE-2020-2307 | Medium | 4.3 | 2020-11-04 | Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variables. |
CVE-2020-2306 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured M… |
CVE-2020-2305 | Medium | 6.5 | 2020-11-04 | Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2304 | Medium | 6.5 | 2020-11-04 | Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2303 | Medium | 4.3 | 2020-11-04 | A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting… |
CVE-2020-2302 | Medium | 4.3 | 2020-11-04 | A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check… |
CVE-2020-2301 | Critical | 9.8 | 2020-11-04 | Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication of that user is sti… |
CVE-2020-2300 | Critical | 9.8 | 2020-11-04 | Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers to log in to Jenki… |
CVE-2020-2299 | Critical | 9.8 | 2020-11-04 | Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password. |
CVE-2020-26211 | High | 7.7 | 2020-11-03 | In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or… |
CVE-2020-1909 | Critical | 9.8 | 2020-11-03 | A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory cor… |
CVE-2020-1908 | Medium | 4.6 | 2020-11-03 | Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact wit… |
CVE-2020-26210 | High | 7.7 | 2020-11-03 | In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicke… |
CVE-2020-4785 | Medium | 5.4 | 2020-11-03 | IBM App Connect Enterprise Certified Container 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 could allow a remote attacker to hijack the clicking action of the victim… |
CVE-2020-4649 | Medium | 4.3 | 2020-11-03 | IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions… |
CVE-2020-6557 | Medium | 6.5 | 2020-11-03 | Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2020-16011 | Critical | 9.6 | 2020-11-03 | Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2020-16010 | Critical | 9.6 | 2020-11-03 | Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2020-16009 | High | 8.8 | 2020-11-03 | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-16008 | High | 8.8 | 2020-11-03 | Stack buffer overflow in WebRTC in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit stack corruption via a crafted WebRTC… |
CVE-2020-16007 | High | 7.8 | 2020-11-03 | Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege via a crafted files… |
CVE-2020-16006 | High | 8.8 | 2020-11-03 | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-16005 | High | 8.8 | 2020-11-03 | Insufficient policy enforcement in ANGLE in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2020-16004 | High | 8.8 | 2020-11-03 | Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2020-16003 | High | 8.8 | 2020-11-03 | Use after free in printing in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16002 | High | 8.8 | 2020-11-03 | Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2020-16001 | High | 8.8 | 2020-11-03 | Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16000 | High | 8.8 | 2020-11-03 | Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2020-15999 | Critical | 9.6 | 2020-11-03 | Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2020-15998 | High | 8.8 | 2020-11-03 | Use after free in USB in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbo… |
CVE-2020-15997 | High | 8.8 | 2020-11-03 | Use after free in Mojo in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandb… |
CVE-2020-15996 | High | 8.8 | 2020-11-03 | Use after free in passwords in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2020-15995 | High | 8.8 | 2020-11-03 | Out of bounds write in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15994 | High | 8.8 | 2020-11-03 | Use after free in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15993 | Critical | 9.8 | 2020-11-03 | Use after free in printing in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15992 | High | 8.8 | 2020-11-03 | Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2020-15991 | High | 8.8 | 2020-11-03 | Use after free in password manager in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2020-15990 | High | 8.8 | 2020-11-03 | Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2020-15989 | Medium | 5.5 | 2020-11-03 | Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2020-15988 | Medium | 6.3 | 2020-11-03 | Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files t… |
CVE-2020-15987 | High | 8.8 | 2020-11-03 | Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC stream. |
CVE-2020-15986 | Medium | 6.5 | 2020-11-03 | Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15985 | Medium | 6.5 | 2020-11-03 | Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-15984 | Medium | 6.5 | 2020-11-03 | Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote attacker to spoof the contents of the Omnibox (URL ba… |
CVE-2020-15983 | High | 7.8 | 2020-11-03 | Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local attacker to bypass content security policy via a craft… |
CVE-2020-15982 | Medium | 6.5 | 2020-11-03 | Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process… |
CVE-2020-15981 | Medium | 6.5 | 2020-11-03 | Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
CVE-2020-15980 | High | 7.8 | 2020-11-03 | Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed a local attacker to bypass navigation restrictions via cra… |
CVE-2020-15979 | High | 8.8 | 2020-11-03 | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-15978 | High | 8.8 | 2020-11-03 | Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process… |
CVE-2020-15977 | Medium | 6.5 | 2020-11-03 | Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information fr… |