2020 CVEs (page 79)
Page 79 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27885 | Medium | 6.1 | 2020-10-29 | Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user… |
CVE-2020-26205 | High | 7.6 | 2020-10-29 | Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnera… |
CVE-2020-25646 | High | 7.5 | 2020-10-29 | A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality |
CVE-2020-14323 | Medium | 5.5 | 2020-10-29 | A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this f… |
CVE-2020-27887 | High | 8.8 | 2020-10-29 | An issue was discovered in EyesOfNetwork 5.3 through 5.3-8. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run ar… |
CVE-2020-27886 | Critical | 9.8 | 2020-10-29 | An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker… |
CVE-2020-27998 | Critical | 9.8 | 2020-10-29 | An issue was discovered in FastReport before 2020.4.0. It lacks a ScriptSecurity feature and therefore may mishandle (for example) GetType, typeof, TypeOf, Dll… |
CVE-2020-27996 | High | 8.8 | 2020-10-29 | An issue was discovered in SmartStoreNET before 4.0.1. It does not properly consider the need for a CustomModelPartAttribute decoration in certain ModelBase.Cu… |
CVE-2020-27747 | Medium | 6.8 | 2020-10-29 | An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for entering from a mobile de… |
CVE-2020-27995 | Critical | 9.8 | 2020-10-29 | SQL Injection in Zoho ManageEngine Applications Manager 14 before 14560 allows an attacker to execute commands on the server via the MyPage.do template_resid p… |
CVE-2020-27744 | Critical | 9.8 | 2020-10-29 | An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114. They allow remote code execution with resultant escalation of privileges. |
CVE-2020-25780 | High | 7.5 | 2020-10-29 | In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that… |
CVE-2020-5936 | High | 7.5 | 2020-10-29 | On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel (TMM) process may consume excessive re… |
CVE-2020-5935 | Medium | 5.9 | 2020-10-29 | On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when handli… |
CVE-2020-5934 | Medium | 6.5 | 2020-10-29 | On BIG-IP APM 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when multiple HTTP requests from the same client to configured SAML Single Logout (SLO) UR… |
CVE-2020-5933 | High | 7.5 | 2020-10-29 | On versions 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, when a BIG-IP system that has a virtual server configured… |
CVE-2020-5932 | Medium | 4.8 | 2020-10-29 | On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM Configuration utility response and blocking pages. An authen… |
CVE-2020-5931 | High | 7.5 | 2020-10-29 | On BIG-IP 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, Virtual servers with a OneConnect profile may incorrectly ha… |
CVE-2020-4864 | Medium | 4.3 | 2020-10-29 | IBM Resilient SOAR V38.0 could allow an attacker on the internal net work to provide the server with a spoofed source IP address. IBM X-Force ID: 190567. |
CVE-2020-4724 | High | 7.8 | 2020-10-29 | IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-4723 | High | 7.8 | 2020-10-29 | IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-4722 | High | 7.8 | 2020-10-29 | IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-4721 | High | 7.8 | 2020-10-29 | IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-27993 | Medium | 5.3 | 2020-10-29 | Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files. |
CVE-2020-7384 | High | 7.0 | 2020-10-29 | Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary com… |
CVE-2020-5938 | Medium | 6.5 | 2020-10-29 | On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authenticated peers, the peer may negotiate a… |
CVE-2020-5937 | High | 7.5 | 2020-10-29 | On BIG-IP AFM 15.1.0-15.1.0.5, the Traffic Management Microkernel (TMM) may produce a core file while processing layer 4 (L4) behavioral denial-of-service (DoS… |
CVE-2020-21266 | Medium | 6.1 | 2020-10-29 | Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting (XSS) due to a slow HTTP post vulnerability. |
CVE-2020-25516 | Medium | 5.4 | 2020-10-29 | WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks. |
CVE-2020-27658 | High | 7.1 | 2020-10-29 | Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for rem… |
CVE-2020-27657 | Medium | 6.5 | 2020-10-29 | Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to… |
CVE-2020-27656 | Medium | 6.5 | 2020-10-29 | Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attac… |
CVE-2020-27655 | Medium | 6.5 | 2020-10-29 | Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound Qui… |
CVE-2020-27654 | Critical | 9.8 | 2020-10-29 | Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port… |
CVE-2020-27653 | High | 8.3 | 2020-10-29 | Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and ob… |
CVE-2020-27652 | High | 8.3 | 2020-10-29 | Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof server… |
CVE-2020-27651 | Medium | 5.8 | 2020-10-29 | Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attac… |
CVE-2020-27650 | Medium | 5.8 | 2020-10-29 | Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remo… |
CVE-2020-27649 | High | 8.3 | 2020-10-29 | Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof… |
CVE-2020-27648 | High | 8.3 | 2020-10-29 | Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers t… |
CVE-2020-7746 | High | 7.5 | 2020-10-29 | This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the exist… |
CVE-2020-11616 | High | 7.5 | 2020-10-29 | NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random Number Generator (PR… |
CVE-2020-11615 | High | 7.5 | 2020-10-29 | NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-coded RC4 cipher key, w… |
CVE-2020-11489 | High | 7.5 | 2020-10-29 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain a vulnerability in… |
CVE-2020-11488 | Medium | 6.7 | 2020-10-29 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability i… |
CVE-2020-11487 | High | 7.5 | 2020-10-29 | NVIDIA DGX servers, DGX-1 with BMC firmware versions prior to 3.38.30. DGX-2 with BMC firmware versions prior to 1.06.06 and all DGX A100 Servers with all BMC… |
CVE-2020-11486 | Critical | 9.8 | 2020-10-29 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker… |
CVE-2020-11485 | High | 8.8 | 2020-10-29 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery (CSRF) vulnerability in the AMI BMC firmware i… |
CVE-2020-11484 | Medium | 4.9 | 2020-10-29 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attacker with administr… |
CVE-2020-11483 | Critical | 9.8 | 2020-10-29 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability i… |
CVE-2020-27986 | High | 7.5 | 2020-10-28 | SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the ve… |
CVE-2020-25374 | Low | 2.6 | 2020-10-28 | CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle t… |
CVE-2020-24713 | High | 7.5 | 2020-10-28 | Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. |
CVE-2020-24712 | Medium | 5.4 | 2020-10-28 | Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page. |
CVE-2020-24711 | Medium | 6.5 | 2020-10-28 | The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack |
CVE-2020-24710 | Medium | 5.3 | 2020-10-28 | Gophish before 0.11.0 allows SSRF attacks. |
CVE-2020-24709 | Medium | 5.4 | 2020-10-28 | Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. |
CVE-2020-24708 | Medium | 5.4 | 2020-10-28 | Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form. |
CVE-2020-24707 | High | 7.8 | 2020-10-28 | Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. |
CVE-2020-27980 | Medium | 5.4 | 2020-10-28 | Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to perform malicious actions in which the… |
CVE-2020-27742 | Medium | 6.5 | 2020-10-28 | An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msg… |
CVE-2020-27741 | Medium | 6.1 | 2020-10-28 | Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pa… |
CVE-2020-27740 | Medium | 5.3 | 2020-10-28 | Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a pub… |
CVE-2020-27739 | Critical | 9.8 | 2020-10-28 | A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOT… |
CVE-2020-25204 | Medium | 5.5 | 2020-10-28 | The God Kings application 0.60.1 for Android exposes a broadcast receiver to other apps called com.innogames.core.frontend.notifications.receivers.LocalNotific… |
CVE-2020-24990 | High | 7.5 | 2020-10-28 | An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69, a remote attacker can perform a directory traver… |
CVE-2020-26133 | High | 7.8 | 2020-10-28 | An issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in the default installation directory, an attacker can elevate pr… |
CVE-2020-26132 | High | 7.8 | 2020-10-28 | An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privile… |
CVE-2020-26131 | High | 7.8 | 2020-10-28 | Issues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0.1Beta. Due to insufficient access restrictions in the default ins… |
CVE-2020-26130 | High | 7.8 | 2020-10-28 | Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66. Due to insufficient access restrictions in the default ins… |
CVE-2020-25966 | High | 7.5 | 2020-10-28 | Sectona Spectra before 3.4.0 has a vulnerable SOAP API endpoint that leaks sensitive information about the configured assets without proper authentication. Thi… |
CVE-2020-16263 | Critical | 9.1 | 2020-10-28 | Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins. |
CVE-2020-16262 | High | 7.8 | 2020-10-28 | Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation. |
CVE-2020-16261 | Medium | 6.8 | 2020-10-28 | Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access. |
CVE-2020-16260 | High | 7.5 | 2020-10-28 | Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitati… |
CVE-2020-16259 | Critical | 9.8 | 2020-10-28 | Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user. |
CVE-2020-16258 | High | 7.1 | 2020-10-28 | Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials. |
CVE-2020-16256 | High | 8.8 | 2020-10-28 | The API on Winston 1.5.4 devices is vulnerable to CSRF. |
CVE-2020-4782 | Medium | 6.5 | 2020-10-28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially… |
CVE-2020-4767 | High | 7.5 | 2020-10-28 | IBM Sterling Connect Direct for Microsoft Windows 4.7, 4.8, 6.0, and 6.1 could allow a remote attacker to cause a denial of service, caused by a buffer over-re… |
CVE-2020-16257 | Critical | 9.8 | 2020-10-28 | Winston 1.5.4 devices are vulnerable to command injection via the API. |
CVE-2020-15278 | High | 7.7 | 2020-10-28 | Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privileg… |
CVE-2020-27978 | High | 7.5 | 2020-10-28 | Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhau… |
CVE-2020-27976 | Critical | 9.8 | 2020-10-28 | osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This… |
CVE-2020-27975 | High | 8.8 | 2020-10-28 | osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF. |
CVE-2020-27974 | Medium | 6.1 | 2020-10-28 | NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUS_SCM_BlockStart.php?code= XSS. |
CVE-2020-24303 | Medium | 6.1 | 2020-10-28 | Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. |
CVE-2020-22552 | High | 7.5 | 2020-10-28 | The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-unit flag set to No and S7 writes a var f… |
CVE-2020-8263 | Medium | 5.4 | 2020-10-28 | A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) through the… |
CVE-2020-8262 | Medium | 6.1 | 2020-10-28 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection… |
CVE-2020-8261 | Medium | 4.3 | 2020-10-28 | A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection. |
CVE-2020-8260 | High | 7.2 | 2020-10-28 | A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using unco… |
CVE-2020-8255 | Medium | 4.9 | 2020-10-28 | A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary file reading vulnerabilit… |
CVE-2020-8254 | High | 8.8 | 2020-10-28 | A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server. This vul… |
CVE-2020-8250 | High | 7.8 | 2020-10-28 | A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege. |
CVE-2020-8249 | High | 7.8 | 2020-10-28 | A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer overflow. |
CVE-2020-8248 | High | 7.8 | 2020-10-28 | A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege. |
CVE-2020-8241 | High | 7.5 | 2020-10-28 | A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a MITM Attack if end users are convinced to connect to a malicio… |
CVE-2020-8240 | High | 7.8 | 2020-10-28 | A vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an endpoint machine can use system-level privileges if the Embedded Brow… |
CVE-2020-8239 | Critical | 9.8 | 2020-10-28 | A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry privilege escalation attack. This fix also requires Server Side… |