2020 CVEs (page 8)
Page 8 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-36037 | High | 8.8 | 2023-08-11 | An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php. |
CVE-2020-36034 | Critical | 9.8 | 2023-08-11 | SQL Injection vulnerability in oretnom23 School Faculty Scheduling System version 1.0, allows remote attacker to execute arbitrary code, escalate privilieges… |
CVE-2020-36024 | Medium | 5.5 | 2023-08-11 | An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C… |
CVE-2020-36023 | Medium | 6.5 | 2023-08-11 | An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C… |
CVE-2020-35990 | Medium | 5.5 | 2023-08-11 | Buffer Overflow vulnerability in cFilenameInit parameter in browseForDoc function in Foxit Software Foxit PDF Reader version 10.1.0.37527, allows local attacke… |
CVE-2020-35141 | High | 7.5 | 2023-08-11 | An issue was discovered in OFPQueueGetConfigReply in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infi… |
CVE-2020-35139 | High | 7.5 | 2023-08-11 | An issue was discovered in OFPBundleCtrlMsg in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite l… |
CVE-2020-28849 | Medium | 5.4 | 2023-08-11 | Cross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafte… |
CVE-2020-28848 | High | 8.8 | 2023-08-11 | CSV Injection vulnerability in ChurchCRM version 4.2.0, allows remote attackers to execute arbitrary code via crafted CSV file. |
CVE-2020-28840 | High | 7.8 | 2023-08-11 | Buffer Overflow vulnerability in jpgfile.c in Matthias-Wandel jhead version 3.04, allows local attackers to execute arbitrary code and cause a denial of servic… |
CVE-2020-28717 | Medium | 6.1 | 2023-08-11 | Cross Site Scripting (XSS) vulnerability in content1 parameter in demo.jsp in kindsoft kindeditor version 4.1.12, allows attackers to execute arbitrary code. |
CVE-2020-27544 | Critical | 9.8 | 2023-08-11 | An issue was discovered in FoldingAtHome Client Advanced Control GUI before commit 9b619ae64443997948a36dda01b420578de1af77, allows remote attackers to execute… |
CVE-2020-27514 | Critical | 9.1 | 2023-08-11 | Directory Traversal vulnerability in delete function in admin.api.TemplateController in ZrLog version 2.1.15, allows remote attackers to delete arbitrary files… |
CVE-2020-27449 | Medium | 6.1 | 2023-08-11 | Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute ar… |
CVE-2020-25915 | Medium | 5.4 | 2023-08-11 | Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login. |
CVE-2020-24950 | High | 8.8 | 2023-08-11 | SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the… |
CVE-2020-24922 | High | 8.8 | 2023-08-11 | Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execute arbitrary code a… |
CVE-2020-24904 | Medium | 6.5 | 2023-08-11 | An issue was discovered in attach parameter in GNOME Gmail version 2.5.4, allows remote attackers to gain sensitive information via crafted "mailto" link. |
CVE-2020-24872 | Medium | 6.1 | 2023-08-11 | Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitrary code. |
CVE-2020-24804 | Medium | 6.5 | 2023-08-11 | Plaintext Password vulnerability in AddAdmin.py in cms-dev/cms v1.4.rc1, allows attackers to gain sensitive information via audit logs. |
CVE-2020-24222 | High | 7.8 | 2023-08-11 | Buffer Overflow vulnerability in jfif_decode() function in rockcarry ffjpeg through version 1.0.0, allows local attackers to execute arbitrary code due to an i… |
CVE-2020-24221 | Medium | 5.5 | 2023-08-11 | An issue was discovered in GetByte function in miniupnp ngiflib version 0.4, allows local attackers to cause a denial of service (DoS) via crafted .gif file (i… |
CVE-2020-24187 | Medium | 5.5 | 2023-08-11 | An issue was discovered in ecma-helpers.c in jerryscript version 2.3.0, allows local attackers to cause a denial of service (DoS) (Null Pointer Dereference). |
CVE-2020-24075 | Medium | 6.1 | 2023-08-11 | Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary… |
CVE-2020-23595 | High | 8.8 | 2023-08-11 | Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/… |
CVE-2020-20523 | Medium | 6.1 | 2023-08-11 | Cross Site Scripting (XSS) vulnerability in adm_user parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary code during the Gila CM… |
CVE-2020-19952 | Medium | 6.1 | 2023-08-11 | Cross Site Scripting (XSS) vulnerability in Rendering Engine in jbt Markdown Editor thru commit 2252418c27dffbb35147acd8ed324822b8919477, allows remote attacke… |
CVE-2020-23564 | High | 7.2 | 2023-08-05 | File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php. |
CVE-2020-26082 | Medium | 5.8 | 2023-08-04 | A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attac… |
CVE-2020-26065 | Medium | 6.5 | 2023-08-04 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal… |
CVE-2020-26064 | High | 8.1 | 2023-08-04 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that… |
CVE-2020-20808 | Medium | 6.1 | 2023-08-03 | Cross Site Scripting vulnerability in Qibosoft qibosoft v.7 and before allows a remote attacker to execute arbitrary code via the eindtijd and starttijd parame… |
CVE-2020-10962 | High | 7.8 | 2023-08-01 | In PowerShell App Deployment Toolkit (aka PSAppDeployToolkit) through 3.8.0, an incorrect access control vulnerability in the default configuration may allow a… |
CVE-2020-36763 | Medium | 5.4 | 2023-07-31 | Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom parameters when adding or… |
CVE-2020-21881 | Medium | 6.5 | 2023-07-31 | Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify application data via article/admin/content/add. |
CVE-2020-21662 | Critical | 9.8 | 2023-07-31 | SQL injection vulnerability in yunyecms 2.0.2 allows remote attackers to run arbitrary SQL commands via XFF. |
CVE-2020-4868 | Medium | 4.3 | 2023-07-31 | IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2020-22623 | High | 7.5 | 2023-07-27 | Directory traversal vulnerability in Jinfornet Jreport 15.6 allows unauthenticated attackers to gain sensitive information. |
CVE-2020-35698 | Medium | 6.1 | 2023-07-25 | Thinkific Thinkific Online Course Creation Platform 1.0 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The compone… |
CVE-2020-24275 | Medium | 6.5 | 2023-07-20 | A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying a crafted URL. |
CVE-2020-22159 | High | 8.8 | 2023-07-18 | EVERTZ devices 3080IPX exe-guest-v1.2-r26125, 7801FC 1.3 Build 27, and 7890IXG V494 are vulnerable to Arbitrary File Upload, allowing an authenticated attacker… |
CVE-2020-36762 | Medium | 5.5 | 2023-07-18 | A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the… |
CVE-2020-23911 | Medium | 5.5 | 2023-07-18 | An issue was discovered in asn1c through v0.9.28. A NULL pointer dereference exists in the function _default_error_logger() located in asn1fix.c. It allows an… |
CVE-2020-23910 | Medium | 5.5 | 2023-07-18 | Stack-based buffer overflow vulnerability in asn1c through v0.9.28 via function genhash_get in genhash.c. |
CVE-2020-23909 | High | 7.1 | 2023-07-18 | Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1. |
CVE-2020-36695 | Medium | 6.6 | 2023-07-18 | Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hita… |
CVE-2020-20021 | High | 7.5 | 2023-07-12 | An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon. |
CVE-2020-36761 | Medium | 4.3 | 2023-07-12 | The Top 10 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.4. This is due to missing or incorrect nonce… |
CVE-2020-36760 | Medium | 4.3 | 2023-07-12 | The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to missing or incorrect… |
CVE-2020-36757 | Medium | 4.3 | 2023-07-12 | The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due to missing or incor… |
CVE-2020-36756 | Medium | 4.3 | 2023-07-12 | The 10WebAnalytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.8. This is due to missing or incorrec… |
CVE-2020-36752 | Medium | 4.3 | 2023-07-12 | The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.57. This is due to… |
CVE-2020-36750 | Medium | 4.3 | 2023-07-12 | The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or in… |
CVE-2020-20118 | Medium | 5.5 | 2023-07-11 | Buffer Overflow vulnerability in Avast AntiVirus before v.19.7 allows a local attacker to cause a denial of service via a crafted request to the aswSnx.sys dri… |
CVE-2020-8934 | Medium | 4.3 | 2023-07-07 | The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack o… |
CVE-2020-22336 | Critical | 9.8 | 2023-07-06 | An issue was discovered in pdfcrack 0.17 thru 0.18, allows attackers to execute arbitrary code via a stack overflow in the MD5 function. |
CVE-2020-21862 | High | 8.1 | 2023-07-06 | Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBackup/del. |
CVE-2020-21861 | High | 8.8 | 2023-07-06 | File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/upload. |
CVE-2020-23452 | Medium | 6.1 | 2023-07-05 | A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2020-25969 | Critical | 9.8 | 2023-07-05 | gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest(). |
CVE-2020-22597 | Critical | 9.8 | 2023-07-03 | An issue in Jerrscript- project Jerryscrip v. 2.3.0 allows a remote attacker to execute arbitrary code via the ecma_builtin_array_prototype_object_slice parame… |
CVE-2020-22153 | Critical | 9.8 | 2023-07-03 | File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigat… |
CVE-2020-22152 | Medium | 5.4 | 2023-07-03 | Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description… |
CVE-2020-22151 | Critical | 9.8 | 2023-07-03 | Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload… |
CVE-2020-36749 | Medium | 4.3 | 2023-07-01 | The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1. This is due to missing or incor… |
CVE-2020-36748 | Medium | 4.3 | 2023-07-01 | The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing or incorrect nonce v… |
CVE-2020-36747 | Medium | 4.3 | 2023-07-01 | The Lightweight Sidebar Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. This is due to missin… |
CVE-2020-36746 | Medium | 4.3 | 2023-07-01 | The Menu Swapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0.2. This is due to missing or incorrec… |
CVE-2020-36745 | Medium | 4.3 | 2023-07-01 | The WP Project Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.0. This is due to missing or inco… |
CVE-2020-36744 | Medium | 4.3 | 2023-07-01 | The NotificationX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.2. This is due to missing or incorrect… |
CVE-2020-36743 | Medium | 4.3 | 2023-07-01 | The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. This is due to missing or… |
CVE-2020-36742 | Medium | 4.3 | 2023-07-01 | The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or i… |
CVE-2020-36741 | Medium | 4.3 | 2023-07-01 | The MultiVendorX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.7. This is due to missing or incorrect… |
CVE-2020-36740 | Medium | 4.3 | 2023-07-01 | The Radio Buttons for Taxonomies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. This is due to missi… |
CVE-2020-36739 | Medium | 4.3 | 2023-07-01 | The Feed Them Social – Page, Post, Video, and Photo Galleries plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including… |
CVE-2020-36738 | Medium | 4.3 | 2023-07-01 | The Cool Timeline (Horizontal & Vertical Timeline) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. Th… |
CVE-2020-36737 | Medium | 4.3 | 2023-07-01 | The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due t… |
CVE-2020-36736 | Medium | 4.3 | 2023-07-01 | The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.1… |
CVE-2020-36735 | Medium | 4.3 | 2023-07-01 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forge… |
CVE-2020-18432 | Critical | 9.8 | 2023-06-30 | File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges. |
CVE-2020-26710 | High | 7.5 | 2023-06-29 | easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted… |
CVE-2020-26709 | High | 7.5 | 2023-06-29 | py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML f… |
CVE-2020-26708 | High | 7.5 | 2023-06-29 | requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a craft… |
CVE-2020-18414 | Medium | 4.8 | 2023-06-27 | Stored cross site scripting (XSS) vulnerability in Chaoji CMS v2.18 that allows attackers to execute arbitrary code via /index.php?admin-master-webset. |
CVE-2020-18409 | Medium | 6.8 | 2023-06-27 | Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permissions via /index.p… |
CVE-2020-18404 | Medium | 4.8 | 2023-06-27 | An issue was discovered in espcms version P8.18101601. There is a cross site scripting (XSS) vulnerability that allows arbitrary code to be executed via the ti… |
CVE-2020-19902 | Critical | 9.8 | 2023-06-27 | Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code via the wex/cssjs.php parameter. |
CVE-2020-18416 | Medium | 6.8 | 2023-06-27 | An cross site request forgery (CSRF) vulnerability discovered in Jymusic v2.0.0.,that allows attackers to execute arbitrary code via /admin.php?s=/addons/confi… |
CVE-2020-18413 | Medium | 4.8 | 2023-06-27 | Stored cross site scripting (XSS) vulnerability in /index.php?admin-master-navmenu-add of Chaoji CMS v2.18 that allows attackers to execute arbitrary code. |
CVE-2020-18410 | Medium | 4.8 | 2023-06-27 | A stored cross site scripting (XSS) vulnerability in /index.php?admin-master-article-edit of Chaoji CMS v2.18 that allows attackers to obtain administrator pri… |
CVE-2020-18406 | High | 7.5 | 2023-06-27 | An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data. |
CVE-2020-18418 | High | 8.8 | 2023-06-27 | A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.p… |
CVE-2020-23065 | Medium | 5.4 | 2023-06-26 | Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote authenticated attacker to execute arbi… |
CVE-2020-20210 | High | 8.8 | 2023-06-26 | Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. |
CVE-2020-21489 | Critical | 9.8 | 2023-06-20 | File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component. |
CVE-2020-21486 | High | 7.5 | 2023-06-20 | SQL injection vulnerability in PHPOK v.5.4. allows a remote attacker to obtain sensitive information via the _userlist function in framerwork/phpok_call.php fi… |
CVE-2020-21485 | Medium | 6.1 | 2023-06-20 | Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component. |
CVE-2020-21474 | Critical | 9.8 | 2023-06-20 | File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter. |
CVE-2020-21400 | High | 7.2 | 2023-06-20 | SQL injection vulnerability in gaozhifeng PHPMyWind v.5.6 allows a remote attacker to execute arbitrary code via the id variable in the modify function. |
CVE-2020-21366 | High | 8.0 | 2023-06-20 | Cross Site Request Forgery vulnerability in GreenCMS v.2.3 allows an attacker to gain privileges via the adduser function of index.php. |