2020 CVEs (page 84)
Page 84 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14766 | High | 7.1 | 2020-10-21 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web Administration). Supported v… |
CVE-2020-14765 | Medium | 6.5 | 2020-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior… |
CVE-2020-14764 | Medium | 4.2 | 2020-10-21 | Vulnerability in the Hyperion Planning product of Oracle Hyperion (component: Application Development Framework). The supported version that is affected is 11… |
CVE-2020-14763 | Medium | 5.4 | 2020-10-21 | Vulnerability in the Oracle Application Express Quick Poll component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily… |
CVE-2020-14762 | Medium | 5.4 | 2020-10-21 | Vulnerability in the Oracle Application Express component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitabl… |
CVE-2020-14761 | Medium | 6.5 | 2020-10-21 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are aff… |
CVE-2020-14760 | Medium | 5.5 | 2020-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.31 and prior. Easily exp… |
CVE-2020-14759 | Low | 2.5 | 2020-10-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Difficult to exploit vulnerabi… |
CVE-2020-14758 | Medium | 5.6 | 2020-10-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabili… |
CVE-2020-14757 | Medium | 6.8 | 2020-10-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). The supported version that is affected is 12.2.1.3.0… |
CVE-2020-14754 | Medium | 5.5 | 2020-10-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Easily exploitable vulnera… |
CVE-2020-14753 | Medium | 5.9 | 2020-10-21 | Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Installation). The supported versi… |
CVE-2020-14752 | Medium | 4.2 | 2020-10-21 | Vulnerability in the Hyperion Lifecycle Management product of Oracle Hyperion (component: Shared Services). The supported version that is affected is 11.1.2.4… |
CVE-2020-14746 | Medium | 4.7 | 2020-10-21 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popup windows). Supported versions that are affected are 12.1… |
CVE-2020-14745 | Medium | 4.3 | 2020-10-21 | Vulnerability in the Oracle REST Data Services product of Oracle REST Data Services (component: General). Supported versions that are affected are 11.2.0.4, 12… |
CVE-2020-14744 | Medium | 6.5 | 2020-10-21 | Vulnerability in the Oracle REST Data Services product of Oracle REST Data Services (component: General). Supported versions that are affected are 11.2.0.4, 12… |
CVE-2020-14743 | Low | 3.1 | 2020-10-21 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult… |
CVE-2020-14742 | Low | 2.7 | 2020-10-21 | Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Easily… |
CVE-2020-14741 | Medium | 4.9 | 2020-10-21 | Vulnerability in the Database Filesystem component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily… |
CVE-2020-14740 | Low | 2.8 | 2020-10-21 | Vulnerability in the SQL Developer Install component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c… |
CVE-2020-14736 | Low | 3.8 | 2020-10-21 | Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily explo… |
CVE-2020-14735 | High | 8.8 | 2020-10-21 | Vulnerability in the Scheduler component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Easily… |
CVE-2020-14734 | High | 8.1 | 2020-10-21 | Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Diffi… |
CVE-2020-14732 | Low | 3.1 | 2020-10-21 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Promotions). The supported… |
CVE-2020-14731 | Low | 3.1 | 2020-10-21 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment). Supported versio… |
CVE-2020-14672 | Medium | 4.9 | 2020-10-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.6.49 and prior, 5.7… |
CVE-2020-6648 | Medium | 5.3 | 2020-10-21 | A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earl… |
CVE-2020-10140 | High | 7.8 | 2020-10-21 | Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed from the C:\ProgramD… |
CVE-2020-10139 | High | 7.8 | 2020-10-21 | Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis True Image cont… |
CVE-2020-10138 | High | 7.8 | 2020-10-21 | Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. A… |
CVE-2020-25820 | Medium | 6.5 | 2020-10-21 | BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted UR… |
CVE-2020-26896 | High | 8.2 | 2020-10-21 | Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't ver… |
CVE-2020-26895 | Medium | 5.3 | 2020-10-21 | Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC t… |
CVE-2020-5792 | High | 7.2 | 2020-10-20 | Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultima… |
CVE-2020-5791 | High | 7.2 | 2020-10-20 | Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system comm… |
CVE-2020-5790 | Medium | 6.5 | 2020-10-20 | Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a cr… |
CVE-2020-25648 | High | 7.5 | 2020-10-20 | A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a… |
CVE-2020-25157 | High | 7.5 | 2020-10-20 | The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database and retrieve sensitive… |
CVE-2020-24416 | Medium | 6.1 | 2020-10-20 | Marketo Sales Insight plugin version 1.4355 (and earlier) is affected by a blind stored Cross-Site Scripting (XSS) vulnerability that could be abused by an att… |
CVE-2020-24415 | High | 7.8 | 2020-10-20 | Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This co… |
CVE-2020-24414 | High | 7.8 | 2020-10-20 | Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This co… |
CVE-2020-24413 | High | 7.8 | 2020-10-20 | Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This co… |
CVE-2020-24412 | High | 7.8 | 2020-10-20 | Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This co… |
CVE-2020-24411 | High | 7.8 | 2020-10-20 | Adobe Illustrator version 24.2 (and earlier) is affected by an out-of-bounds write vulnerability when handling crafted PDF files. This could result in a write… |
CVE-2020-24410 | High | 7.8 | 2020-10-20 | Adobe Illustrator version 24.2 (and earlier) is affected by an out-of-bounds read vulnerability when parsing crafted PDF files. This could result in a read pas… |
CVE-2020-24409 | High | 7.8 | 2020-10-20 | Adobe Illustrator version 24.2 (and earlier) is affected by an out-of-bounds read vulnerability when parsing crafted PDF files. This could result in a read pas… |
CVE-2020-9417 | High | 7.6 | 2020-10-20 | The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System… |
CVE-2020-15269 | High | 7.4 | 2020-10-20 | In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3… |
CVE-2020-15264 | High | 8.0 | 2020-10-20 | The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory… |
CVE-2020-24765 | High | 7.5 | 2020-10-20 | InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system… |
CVE-2020-15931 | High | 7.5 | 2020-10-20 | Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (tha… |
CVE-2020-7371 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true s… |
CVE-2020-7370 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfusca… |
CVE-2020-7369 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true s… |
CVE-2020-7364 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true s… |
CVE-2020-7363 | Medium | 4.3 | 2020-10-20 | User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true s… |
CVE-2020-3995 | Medium | 5.3 | 2020-10-20 | In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11.1.0), the VMCI host… |
CVE-2020-3994 | High | 7.4 | 2020-10-20 | VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update… |
CVE-2020-3993 | Medium | 5.9 | 2020-10-20 | VMware NSX-T (3.x before 3.0.2, 2.5.x before 2.5.2.2.0) contains a security vulnerability that exists in the way it allows a KVM host to download and install p… |
CVE-2020-3992 | Critical | 9.8 | 2020-10-20 | OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issu… |
CVE-2020-3982 | High | 7.7 | 2020-10-20 | VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11… |
CVE-2020-3981 | Medium | 5.8 | 2020-10-20 | VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11… |
CVE-2020-4756 | Medium | 5.5 | 2020-10-20 | IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local att… |
CVE-2020-4755 | Medium | 5.4 | 2020-10-20 | IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2020-4749 | Medium | 4.3 | 2020-10-20 | IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie… |
CVE-2020-4748 | Medium | 6.1 | 2020-10-20 | IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2020-4564 | Medium | 5.4 | 2020-10-20 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 are vulnerable to cross-site scripti… |
CVE-2020-4491 | Medium | 5.5 | 2020-10-20 | IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial of service by sending a large number o… |
CVE-2020-16246 | Medium | 6.1 | 2020-10-20 | The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow attackers to trick users into following a link or navigati… |
CVE-2020-6370 | Medium | 4.8 | 2020-10-20 | SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Si… |
CVE-2020-6369 | Medium | 5.9 | 2020-10-20 | SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the au… |
CVE-2020-6367 | Medium | 6.1 | 2020-10-20 | There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthent… |
CVE-2020-6366 | Medium | 6.5 | 2020-10-20 | SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privi… |
CVE-2020-6362 | Medium | 6.5 | 2020-10-20 | SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthoriza… |
CVE-2020-6315 | Medium | 5.5 | 2020-10-20 | SAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which can lead to leakage of sensitive informati… |
CVE-2020-6308 | Medium | 5.3 | 2020-10-20 | SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CM… |
CVE-2020-7749 | High | 7.6 | 2020-10-20 | This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such… |
CVE-2020-7748 | Medium | 5.6 | 2020-10-20 | This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Dependin… |
CVE-2020-7747 | Medium | 6.3 | 2020-10-20 | This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller. |
CVE-2020-5640 | Critical | 9.8 | 2020-10-20 | Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execute arbitrary code or obtain sensitive in… |
CVE-2020-15261 | High | 8.0 | 2020-10-19 | On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative pri… |
CVE-2020-15256 | High | 7.7 | 2020-10-19 | A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInherit… |
CVE-2020-6085 | High | 7.5 | 2020-10-19 | An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A spec… |
CVE-2020-6084 | High | 7.5 | 2020-10-19 | An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A spec… |
CVE-2020-15263 | High | 8.0 | 2020-10-19 | In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is po… |
CVE-2020-15245 | Medium | 4.3 | 2020-10-19 | In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.co… |
CVE-2020-13937 | Medium | 5.3 | 2020-10-19 | Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-a… |
CVE-2020-10746 | Medium | 6.1 | 2020-10-19 | A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both REST and HotRod APIs… |
CVE-2020-9263 | High | 7.8 | 2020-10-19 | HUAWEI Mate 30 versions earlier than 10.1.0.150(C00E136R5P3) and HUAWEI P30 version earlier than 10.1.0.160(C00E160R2P11) have a use after free vulnerability… |
CVE-2020-9113 | High | 8.0 | 2020-10-19 | HUAWEI Mate 20 versions earlier than 10.0.0.188(C00E74R3P8) have a buffer overflow vulnerability in the Bluetooth module. Due to insufficient input validation… |
CVE-2020-9112 | High | 7.8 | 2020-10-19 | Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a privilege elevation vulnerability. Due to lack of privilege restrictions on some of the busin… |
CVE-2020-9111 | Medium | 4.5 | 2020-10-19 | E6878-370 versions 10.0.3.1(H557SP27C233),10.0.3.1(H563SP21C233) and E6878-870 versions 10.0.3.1(H557SP27C233),10.0.3.1(H563SP11C233) have a denial of service… |
CVE-2020-9092 | Medium | 4.6 | 2020-10-19 | HUAWEI Mate 20 versions earlier than 10.1.0.163(C00E160R3P8) have a JavaScript injection vulnerability. A module does not verify a specific input. This could a… |
CVE-2020-24388 | High | 7.5 | 2020-10-19 | An issue was discovered in the _send_secure_msg() function of yubihsm-shell through 2.0.2. The function does not validate the embedded length field of a messag… |
CVE-2020-24387 | High | 7.5 | 2020-10-19 | An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not explicitly check the returned session id from… |
CVE-2020-15262 | Low | 3.7 | 2020-10-19 | In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and ther… |
CVE-2020-24375 | Medium | 6.5 | 2020-10-19 | A DNS rebinding vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3. |
CVE-2020-15822 | High | 7.3 | 2020-10-19 | In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped. |
CVE-2020-11496 | Medium | 6.7 | 2020-10-19 | Sprecher SPRECON-E firmware prior to 8.64b might allow local attackers with access to engineering data to insert arbitrary code. This firmware lacks the valida… |
CVE-2020-7195 | High | 8.8 | 2020-10-19 | A iccselectrules expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior… |