2020 CVEs (page 87)
Page 87 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-9992 | High | 7.8 | 2020-10-16 | This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS… |
CVE-2020-9983 | High | 8.8 | 2020-10-16 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may le… |
CVE-2020-9976 | Medium | 5.5 | 2020-10-16 | A logic issue was addressed with improved state management. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0. A malicious application ma… |
CVE-2020-9968 | Medium | 5.5 | 2020-10-16 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.0 and iPadOS 14.0, macOS Catalina 10.15.7, tvOS 14.0, watchOS 7.0. A mali… |
CVE-2020-9964 | Medium | 5.5 | 2020-10-16 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 14.0 and iPadOS 14.0. A local user may be able to read ke… |
CVE-2020-9959 | Low | 2.4 | 2020-10-16 | A lock screen issue allowed access to messages on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 14.0 and… |
CVE-2020-9958 | High | 7.8 | 2020-10-16 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.0 and iPadOS 14.0. An application may be able to cause… |
CVE-2020-9952 | High | 7.1 | 2020-10-16 | An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, i… |
CVE-2020-9951 | High | 8.8 | 2020-10-16 | A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead t… |
CVE-2020-9948 | High | 8.8 | 2020-10-16 | A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to… |
CVE-2020-9946 | Medium | 6.8 | 2020-10-16 | This issue was addressed with improved checks. This issue is fixed in iOS 14.0 and iPadOS 14.0, watchOS 7.0. The screen lock may not engage after the specified… |
CVE-2020-9936 | High | 7.8 | 2020-10-16 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8… |
CVE-2020-9934 | Medium | 5.5 | 2020-10-16 | An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6… |
CVE-2020-9933 | Low | 3.3 | 2020-10-16 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8. A malicious a… |
CVE-2020-9931 | High | 7.5 | 2020-10-16 | A denial of service issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6. A remote attacker may cause an unexpec… |
CVE-2020-9925 | Medium | 6.1 | 2020-10-16 | A logic issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes… |
CVE-2020-9923 | High | 7.8 | 2020-10-16 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, watchOS 6.2.8. A malicious application… |
CVE-2020-9918 | Critical | 9.8 | 2020-10-16 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A remote attacke… |
CVE-2020-9917 | High | 7.5 | 2020-10-16 | This issue was addressed with improved checks. This issue is fixed in iOS 13.6 and iPadOS 13.6. A remote attacker may be able to cause a denial of service. |
CVE-2020-9916 | Medium | 5.3 | 2020-10-16 | A URL Unicode encoding issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari… |
CVE-2020-9915 | Medium | 6.5 | 2020-10-16 | An access issue existed in Content Security Policy. This issue was addressed with improved access restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6… |
CVE-2020-9914 | High | 7.5 | 2020-10-16 | An input validation issue existed in Bluetooth. This issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS… |
CVE-2020-9913 | Medium | 5.5 | 2020-10-16 | This issue was addressed with improved data protection. This issue is fixed in macOS Catalina 10.15.6. A local user may be able to leak sensitive user informat… |
CVE-2020-9912 | Low | 3.3 | 2020-10-16 | A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1.2. A malicious attacker may be able to change the origin of a frame… |
CVE-2020-9911 | High | 7.5 | 2020-10-16 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, Safari 13.1.2. An issue in Safari Reader mode may allo… |
CVE-2020-9910 | High | 8.8 | 2020-10-16 | Multiple issues were addressed with improved logic. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8… |
CVE-2020-9909 | Medium | 5.9 | 2020-10-16 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8. An attacker tha… |
CVE-2020-9907 | High | 7.8 | 2020-10-16 | A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be ab… |
CVE-2020-9903 | High | 7.5 | 2020-10-16 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, Safari 13.1.2. A malicious attacker may cause Safari t… |
CVE-2020-9895 | Critical | 9.8 | 2020-10-16 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1… |
CVE-2020-9894 | Medium | 4.3 | 2020-10-16 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2… |
CVE-2020-9893 | High | 8.8 | 2020-10-16 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1… |
CVE-2020-9891 | High | 7.8 | 2020-10-16 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchO… |
CVE-2020-9890 | High | 7.8 | 2020-10-16 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchO… |
CVE-2020-9889 | High | 7.8 | 2020-10-16 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8… |
CVE-2020-9888 | High | 7.8 | 2020-10-16 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchO… |
CVE-2020-9885 | Medium | 5.5 | 2020-10-16 | An issue existed in the handling of iMessage tapbacks. The issue was resolved with additional verification. This issue is fixed in iOS 13.6 and iPadOS 13.6, ma… |
CVE-2020-9884 | High | 7.8 | 2020-10-16 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8… |
CVE-2020-9878 | High | 7.8 | 2020-10-16 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watc… |
CVE-2020-9870 | High | 8.8 | 2020-10-16 | A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. An attacker with me… |
CVE-2020-9865 | High | 8.6 | 2020-10-16 | A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8… |
CVE-2020-9864 | Critical | 9.8 | 2020-10-16 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.6. An application may be able to execute arbitrary code wit… |
CVE-2020-9862 | High | 7.8 | 2020-10-16 | A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4… |
CVE-2020-9799 | High | 7.8 | 2020-10-16 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.6. A malicious application may be able to execut… |
CVE-2020-4636 | High | 7.2 | 2020-10-16 | IBM Resilient OnPrem 38.2 could allow a privileged user to inject malicious commands through Python3 scripting. IBM X-Force ID: 185503. |
CVE-2020-4254 | High | 7.5 | 2020-10-16 | IBM Security Guardium Big Data Intelligence 1.0 (SonarG) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2020-15258 | High | 8.0 | 2020-10-16 | In Wire before 3.20.x, `shell.openExternal` was used without checking the URL. This vulnerability allows an attacker to execute code on the victims machine by… |
CVE-2020-15255 | High | 8.7 | 2020-10-16 | In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as form… |
CVE-2020-15254 | High | 8.1 | 2020-10-16 | Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter… |
CVE-2020-15252 | High | 8.5 | 2020-10-16 | In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context wh… |
CVE-2020-15157 | Medium | 6.1 | 2020-10-16 | In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the… |
CVE-2020-27178 | High | 7.5 | 2020-10-16 | Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifa… |
CVE-2020-26672 | Medium | 5.4 | 2020-10-16 | Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payloa… |
CVE-2020-24408 | Medium | 6.1 | 2020-10-16 | Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file u… |
CVE-2020-3991 | High | 7.1 | 2020-10-16 | VMware Horizon Client for Windows (5.x before 5.5.0) contains a denial-of-service vulnerability due to a file system access control issue during install time… |
CVE-2020-26944 | Critical | 9.8 | 2020-10-16 | An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the main login page (a… |
CVE-2020-26682 | High | 8.8 | 2020-10-16 | In libass 0.14.0, the `ass_outline_construct`'s call to `outline_stroke` causes a signed integer overflow. |
CVE-2020-16270 | Medium | 6.1 | 2020-10-16 | OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s b… |
CVE-2020-15867 | High | 7.2 | 2020-10-16 | The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook fe… |
CVE-2020-14299 | Medium | 6.5 | 2020-10-16 | A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain… |
CVE-2020-14144 | High | 7.2 | 2020-10-16 | The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not… |
CVE-2020-26893 | High | 7.8 | 2020-10-16 | An issue was discovered in ClamXAV 3 before 3.1.1. A malicious actor could use a properly signed copy of ClamXAV 2 (running with an injected malicious dylib) t… |
CVE-2020-26943 | Critical | 9.9 | 2020-10-16 | An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code… |
CVE-2020-26584 | Medium | 6.1 | 2020-10-16 | An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. The search field "Kurs suchen" on the page Kurskatalog is vulnerable to Reflected XSS. If the… |
CVE-2020-26583 | Medium | 6.1 | 2020-10-16 | An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. It allows unauthenticated users to upload JavaScript (in a file) via the expenses claiming fu… |
CVE-2020-25829 | High | 7.5 | 2020-10-16 | An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a gi… |
CVE-2020-24352 | Medium | 5.5 | 2020-10-16 | An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_bl… |
CVE-2020-27176 | High | 8.3 | 2020-10-16 | Mutation XSS exists in Mark Text through 0.16.2 that leads to Remote Code Execution. NOTE: this might be considered a duplicate of CVE-2020-26870; however, it… |
CVE-2020-27174 | High | 7.5 | 2020-10-16 | In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the s… |
CVE-2020-27173 | High | 7.5 | 2020-10-16 | In vm-superio before 0.1.1, the serial console FIFO can grow to unlimited memory usage when data is sent to the input source (i.e., standard input). This behav… |
CVE-2020-27163 | Medium | 6.1 | 2020-10-16 | phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter. |
CVE-2020-14185 | Medium | 5.3 | 2020-10-15 | Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOperations res… |
CVE-2020-7591 | High | 8.8 | 2020-10-15 | A vulnerability has been identified in SIPORT MP (All versions < 3.2.1). Vulnerable versions of the device could allow an authenticated attacker to impersonate… |
CVE-2020-1777 | Medium | 4.3 | 2020-10-15 | Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the ticke… |
CVE-2020-15794 | Medium | 4.3 | 2020-10-15 | A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resour… |
CVE-2020-15793 | Medium | 5.4 | 2020-10-15 | A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header which makes it vulnerabl… |
CVE-2020-15792 | Medium | 4.3 | 2020-10-15 | A vulnerability has been identified in Desigo Insight (All versions). The web service does not properly apply input validation for some query parameters in a r… |
CVE-2020-12504 | Critical | 9.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12503 | High | 7.2 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12502 | High | 8.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12501 | Critical | 9.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12500 | Critical | 9.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-25859 | Medium | 6.7 | 2020-10-15 | The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validating the input, while… |
CVE-2020-25858 | High | 7.5 | 2020-10-15 | The QCMAP_Web_CLIENT binary in the Qualcomm QCMAP software suite prior to versions released in October 2020 does not validate the return value of a strstr() or… |
CVE-2020-11637 | Medium | 5.8 | 2020-10-15 | A memory leak in the TFTP service in B&R Automation Runtime versions <N4.26, <N4.34, <F4.45, <E4.53, <D4.63, <A4.73 and prior could allow an unauthenticated at… |
CVE-2020-6108 | High | 7.8 | 2020-10-15 | An exploitable code execution vulnerability exists in the fsck_chk_orphan_node functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem… |
CVE-2020-6107 | Medium | 5.5 | 2020-10-15 | An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can… |
CVE-2020-6106 | Medium | 5.5 | 2020-10-15 | An exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A specially crafted fi… |
CVE-2020-6105 | High | 7.8 | 2020-10-15 | An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can… |
CVE-2020-6104 | Medium | 5.5 | 2020-10-15 | An exploitable information disclosure vulnerability exists in the get_dnode_of_data functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesy… |
CVE-2020-21674 | Medium | 6.5 | 2020-10-15 | Heap-based buffer overflow in archive_string_append_from_wcs() (archive_string.c) in libarchive-3.4.1dev allows remote attackers to cause a denial of service (… |
CVE-2020-11646 | Medium | 4.3 | 2020-10-15 | A log information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticat… |
CVE-2020-11645 | Medium | 6.5 | 2020-10-15 | A denial of service vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users… |
CVE-2020-11644 | Medium | 6.5 | 2020-10-15 | The information disclosure vulnerability present in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authe… |
CVE-2020-11643 | Medium | 6.5 | 2020-10-15 | An information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated… |
CVE-2020-11642 | High | 7.7 | 2020-10-15 | The local file inclusion vulnerability present in B&R SiteManager versions <9.2.620236042 allows authenticated users to impact availability of SiteManager inst… |
CVE-2020-11641 | High | 7.7 | 2020-10-15 | A local file inclusion vulnerability in B&R SiteManager versions <9.2.620236042 allows authenticated users to read sensitive files from SiteManager instances. |
CVE-2020-7744 | Medium | 4.7 | 2020-10-15 | This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that… |
CVE-2020-4499 | Critical | 9.8 | 2020-10-15 | IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentica… |
CVE-2020-7327 | Medium | 6.0 | 2020-10-15 | Improperly implemented security check in McAfee MVISION Endpoint Detection and Response Client (MVEDR) prior to 3.2.0 may allow local administrators to execute… |