2020 CVEs (page 88)
Page 88 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7326 | Medium | 6.0 | 2020-10-15 | Improperly implemented security check in McAfee Active Response (MAR) prior to 2.4.4 may allow local administrators to execute malicious code via stopping a co… |
CVE-2020-7334 | High | 7.7 | 2020-10-15 | Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2 allows local administrators to change… |
CVE-2020-27157 | High | 8.1 | 2020-10-15 | Veritas APTARE versions prior to 10.5 included code that bypassed the normal login process when specific authentication credentials were provided to the server… |
CVE-2020-27156 | Critical | 9.8 | 2020-10-15 | Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. This vulnerability could allow for remote code execution by an unauthentic… |
CVE-2020-6365 | Medium | 6.1 | 2020-10-15 | SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicio… |
CVE-2020-5642 | High | 8.8 | 2020-10-15 | Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of a… |
CVE-2020-27153 | High | 8.6 | 2020-10-15 | In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of… |
CVE-2020-6376 | Medium | 5.5 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Hemisphere Binary (.rh) file received from untrusted sources which result… |
CVE-2020-6375 | Medium | 5.5 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Computer Graphics Metafile (.cgm) file received from untrusted sources wh… |
CVE-2020-6374 | High | 7.8 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Jupiter Tessallation(.jt) file received from untrusted sources which results in… |
CVE-2020-6373 | High | 7.8 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6372 | High | 7.8 | 2020-10-15 | SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the appli… |
CVE-2020-6371 | Medium | 4.3 | 2020-10-15 | User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver Application Server… |
CVE-2020-6368 | Medium | 5.4 | 2020-10-15 | SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displaye… |
CVE-2020-6364 | Critical | 10.0 | 2020-10-15 | SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that… |
CVE-2020-6363 | Medium | 4.6 | 2020-10-15 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established afte… |
CVE-2020-6323 | Medium | 6.1 | 2020-10-15 | SAP NetWeaver Enterprise Portal (Fiori Framework Page) versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and allows an attacker… |
CVE-2020-6319 | Medium | 6.1 | 2020-10-15 | SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks… |
CVE-2020-6272 | Medium | 5.4 | 2020-10-15 | SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to… |
CVE-2020-8350 | High | 8.8 | 2020-10-14 | An authentication bypass vulnerability was reported in Lenovo ThinkPad Stack Wireless Router firmware version 1.1.3.4 that could allow escalation of privilege. |
CVE-2020-8349 | Critical | 9.8 | 2020-10-14 | An internal security review has identified an unauthenticated remote code execution vulnerability in Cloud Networking Operating System (CNOS)’ optional REST AP… |
CVE-2020-8345 | High | 7.3 | 2020-10-14 | A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that cou… |
CVE-2020-8338 | High | 7.8 | 2020-10-14 | A DLL search path vulnerability was reported in Lenovo Diagnostics prior to version 4.35.4 that could allow a user with local access to execute code on the sys… |
CVE-2020-8332 | Medium | 6.4 | 2020-10-14 | A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitr… |
CVE-2020-7383 | Medium | 6.5 | 2020-10-14 | A SQL Injection issue in Rapid7 Nexpose version prior to 6.6.49 that may have allowed an authenticated user with a low permission level to access resources & m… |
CVE-2020-7318 | Medium | 4.6 | 2020-10-14 | Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML v… |
CVE-2020-7317 | Medium | 4.6 | 2020-10-14 | Cross-Site Scripting vulnerability in McAfee ePolicy Orchistrator (ePO) prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML v… |
CVE-2020-3483 | High | 7.1 | 2020-10-14 | Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and private keys were not exc… |
CVE-2020-3427 | Medium | 6.6 | 2020-10-14 | The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the… |
CVE-2020-15253 | High | 7.3 | 2020-10-14 | Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The i… |
CVE-2020-15229 | High | 8.2 | 2020-10-14 | Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack o… |
CVE-2020-15224 | Medium | 6.8 | 2020-10-14 | In Open Enclave before version 0.12.0, an information disclosure vulnerability exists when an enclave application using the syscalls provided by the sockets.ed… |
CVE-2020-4395 | Medium | 5.4 | 2020-10-14 | IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the… |
CVE-2020-27013 | Medium | 4.4 | 2020-10-14 | Trend Micro Antivirus for Mac 2020 (Consumer) contains a vulnerability in the product that occurs when a webserver is started that implements an API with sever… |
CVE-2020-25824 | Low | 2.4 | 2020-10-14 | Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim… |
CVE-2020-25778 | Medium | 6.0 | 2020-10-14 | Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak sever… |
CVE-2020-25777 | Medium | 5.4 | 2020-10-14 | Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a specific kernel extension request attack where an attacker could bypass the Web Threat Protect… |
CVE-2020-24188 | Medium | 6.1 | 2020-10-14 | Cross-site scripting (XSS) vulnerability in the search functionality in Intrexx before 9.4.0 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2020-9746 | High | 7.0 | 2020-10-14 | Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vulnerability that could result in a crash and arbi… |
CVE-2020-6933 | Medium | 5.5 | 2020-10-14 | An improper input validation vulnerability in the UEM Core of BlackBerry UEM version(s) 12.13.0, 12.12.1a QF2 (and earlier), and 12.11.1 QF3 (and earlier) coul… |
CVE-2020-0423 | High | 7.8 | 2020-10-14 | In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel… |
CVE-2020-0422 | Low | 3.3 | 2020-10-14 | In constructImportFailureNotification of NotificationImportExportListener.java, there is a possible permissions bypass due to an unsafe PendingIntent. This cou… |
CVE-2020-0421 | High | 7.8 | 2020-10-14 | In appendFormatV of String8.cpp, there is a possible out of bounds write due to incorrect error handling. This could lead to local escalation of privilege with… |
CVE-2020-0420 | High | 7.8 | 2020-10-14 | In setUpdatableDriverPath of GpuService.cpp, there is a possible memory corruption due to a missing permission check. This could lead to local escalation of pr… |
CVE-2020-0419 | Medium | 5.5 | 2020-10-14 | In generateInfo of PackageInstallerSession.java, there is a possible leak of cross-profile URI data during app installation due to a missing permission check… |
CVE-2020-0416 | High | 8.8 | 2020-10-14 | In multiple settings screens, there are possible tapjacking attacks due to an insecure default value. This could lead to local escalation of privilege and perm… |
CVE-2020-0415 | Medium | 5.5 | 2020-10-14 | In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of cont… |
CVE-2020-0414 | Medium | 6.5 | 2020-10-14 | In AudioFlinger::RecordThread::threadLoop of audioflinger/Threads.cpp, there is a possible non-silenced audio buffer due to a permissions bypass. This could le… |
CVE-2020-0413 | High | 7.5 | 2020-10-14 | In gatt_process_read_by_type_rsp of gatt_cl.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information dis… |
CVE-2020-0412 | Low | 3.3 | 2020-10-14 | In setProcessMemoryTrimLevel of ActivityManagerService.java, there is a missing permission check. This could lead to local information disclosure of foreground… |
CVE-2020-0411 | Medium | 6.5 | 2020-10-14 | In ~AACExtractor() of AACExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This could lead to remote information disclosure wit… |
CVE-2020-0410 | Medium | 5.5 | 2020-10-14 | In setNotification of SapServer.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with… |
CVE-2020-0408 | High | 7.8 | 2020-10-14 | In remove of String16.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additio… |
CVE-2020-0400 | Medium | 5.5 | 2020-10-14 | In showDataRoamingNotification of NotificationMgr.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local informat… |
CVE-2020-0398 | Medium | 5.5 | 2020-10-14 | In updateMwi of NotificationMgr.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with… |
CVE-2020-0378 | Medium | 5.5 | 2020-10-14 | In onWnmFrameReceived of PasspointManager.java, there is a missing permission check. This could lead to local information disclosure of location data with User… |
CVE-2020-0377 | High | 7.5 | 2020-10-14 | In gatt_process_read_by_type_rsp of gatt_cl.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information dis… |
CVE-2020-0376 | Critical | 9.1 | 2020-10-14 | There is a possible out of bounds read due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-163003156 |
CVE-2020-0371 | Critical | 9.1 | 2020-10-14 | There is a possible out of bounds read due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-163008256 |
CVE-2020-0367 | Critical | 9.1 | 2020-10-14 | There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-162980455 |
CVE-2020-0339 | Critical | 9.1 | 2020-10-14 | There is a possible out of bounds read due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-162980705 |
CVE-2020-0283 | Critical | 9.1 | 2020-10-14 | There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-163008257 |
CVE-2020-0246 | Medium | 5.5 | 2020-10-14 | In getCarrierPrivilegeStatus of UiccAccessRule.java, there is a missing permission check. This could lead to local information disclosure of EID data with no a… |
CVE-2020-6087 | High | 7.5 | 2020-10-14 | An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially cra… |
CVE-2020-6086 | High | 7.5 | 2020-10-14 | An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially cra… |
CVE-2020-6083 | High | 7.5 | 2020-10-14 | An exploitable denial of service vulnerability exists in the ENIP Request Path Port Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially cra… |
CVE-2020-25188 | High | 7.8 | 2020-10-14 | An attacker who convinces a valid user to open a specially crafted project file to exploit could execute code under the privileges of the application due to an… |
CVE-2020-24551 | Medium | 6.1 | 2020-10-14 | IProom MMC+ Server login page does not validate specific parameters properly. Attackers can use the vulnerability to redirect to any malicious site and steal t… |
CVE-2020-7330 | High | 7.5 | 2020-10-14 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial prior to 4.0.176.1 allows local users to schedule tasks which call malicious software… |
CVE-2020-12933 | Medium | 5.5 | 2020-10-13 | A denial of service vulnerability exists in the D3DKMTEscape handler functionality of AMD ATIKMDAG.SYS (e.g. version 26.20.15029.27017). A specially crafted D3… |
CVE-2020-12928 | High | 7.8 | 2020-10-13 | A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any authenticated user to escalate privileges to NT authority system. |
CVE-2020-12911 | Medium | 5.5 | 2020-10-13 | A denial of service vulnerability exists in the D3DKMTCreateAllocation handler functionality of AMD ATIKMDAG.SYS (e.g. version 26.20.15029.27017). A specially… |
CVE-2020-25645 | High | 7.5 | 2020-10-13 | A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt tr… |
CVE-2020-13957 | Critical | 9.8 | 2020-10-13 | Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code executi… |
CVE-2020-15251 | High | 7.7 | 2020-10-13 | In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypa… |
CVE-2020-17417 | High | 7.8 | 2020-10-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.35811. User interaction is required to ex… |
CVE-2020-17416 | High | 7.8 | 2020-10-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.0.35798. User interaction is required to ex… |
CVE-2020-17415 | High | 7.8 | 2020-10-13 | This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PhantomPDF 10.0.0.35798. An attacker must first obtain the… |
CVE-2020-17414 | High | 7.8 | 2020-10-13 | This vulnerability allows local attackers to escalate privileges on affected installations of Foxit Reader 10.0.0.35798. An attacker must first obtain the abil… |
CVE-2020-17413 | High | 7.8 | 2020-10-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required t… |
CVE-2020-17412 | High | 7.8 | 2020-10-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required t… |
CVE-2020-17411 | Low | 3.3 | 2020-10-13 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is re… |
CVE-2020-17410 | High | 7.8 | 2020-10-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required t… |
CVE-2020-17409 | Medium | 6.5 | 2020-10-13 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6120, R6080, R6260, R6220, R6020… |
CVE-2020-17407 | Critical | 9.8 | 2020-10-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112. Authentication is… |
CVE-2020-17406 | High | 8.8 | 2020-10-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112. Authentication is… |
CVE-2020-7590 | Medium | 6.8 | 2020-10-13 | A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers < 40000 running sof… |
CVE-2020-25779 | Low | 3.3 | 2020-10-13 | Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in which a Internationalized Domain Name homograph attack (Puny-code) could be used to add a… |
CVE-2020-15797 | Medium | 6.8 | 2020-10-13 | A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers < 40000 running sof… |
CVE-2020-16124 | High | 7.3 | 2020-10-13 | Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated network traffic to… |
CVE-2020-7743 | High | 7.3 | 2020-10-13 | The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates. |
CVE-2020-15012 | High | 8.6 | 2020-10-12 | A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the fil… |
CVE-2020-26546 | High | 7.5 | 2020-10-12 | An issue was discovered in HelpDeskZ 1.0.2. The feature to auto-login a user, via the RememberMe functionality, is prone to SQL injection. NOTE: This vulnerabi… |
CVE-2020-15250 | Medium | 4.4 | 2020-10-12 | In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the sy… |
CVE-2020-25825 | High | 7.5 | 2020-10-12 | In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs. |
CVE-2020-8821 | Medium | 5.4 | 2020-10-12 | An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML code into the Command… |
CVE-2020-8820 | Medium | 5.4 | 2020-10-12 | An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field… |
CVE-2020-12670 | Medium | 6.1 | 2020-10-12 | XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This… |
CVE-2020-9240 | Medium | 5.5 | 2020-10-12 | Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a buffer overflow vulnerability. A function in a module does not verify inputs sufficiently. At… |
CVE-2020-9110 | Medium | 4.6 | 2020-10-12 | Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an information disclosure vulnerability. The device does not sufficiently validate the output o… |