2020 CVEs (page 89)
Page 89 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-9238 | Medium | 6.5 | 2020-10-12 | Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a buffer overflow vulnerability. A function in a module does not verify inputs sufficiently. At… |
CVE-2020-9230 | Medium | 6.5 | 2020-10-12 | WS5800-10 version 10.0.3.25 has a denial of service vulnerability. Due to improper verification of specific message, an attacker may exploit this vulnerability… |
CVE-2020-9123 | High | 7.8 | 2020-10-12 | HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) and versions earlier than 10.1.0.160(C01E160R2P8) have a buffer overflow vulnerability. An attacke… |
CVE-2020-9122 | Medium | 6.5 | 2020-10-12 | Some Huawei products have an insufficient input verification vulnerability. Attackers can exploit this vulnerability in the LAN to cause service abnormal on af… |
CVE-2020-9109 | Medium | 4.6 | 2020-10-12 | There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in cer… |
CVE-2020-9108 | Medium | 5.5 | 2020-10-12 | HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have an out-of-bounds read and write vulnerability. An unauthenticated attacker crafts malformed m… |
CVE-2020-9107 | Medium | 5.5 | 2020-10-12 | HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have an out-of-bounds read and write vulnerability. An unauthenticated attacker crafts malformed m… |
CVE-2020-9106 | Medium | 4.6 | 2020-10-12 | HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have a path traversal vulnerability. The system does not sufficiently validate certain pathname, s… |
CVE-2020-9091 | Medium | 5.5 | 2020-10-12 | Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an out-of-bounds read and write vulnerability. Some functions do not verify inputs sufficiently… |
CVE-2020-9090 | High | 7.8 | 2020-10-12 | FusionAccess version 6.5.1 has an improper authorization vulnerability. A command is authorized with incorrect privilege. Attackers with other privilege can ex… |
CVE-2020-9087 | Medium | 5.5 | 2020-10-12 | Taurus-AL00A version 10.0.0.1(C00E1R1P1) has an out-of-bounds read vulnerability in XFRM module. An authenticated, local attacker may perform a specific operat… |
CVE-2020-7811 | Medium | 6.2 | 2020-10-12 | Samsung Update 3.0.2.0 ~ 3.0.32.0 has a vulnerability that allows privilege escalation as commands crafted by attacker are executed while the engine deserializ… |
CVE-2020-4741 | Medium | 5.4 | 2020-10-12 | IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod… |
CVE-2020-4740 | Medium | 5.2 | 2020-10-12 | IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would b… |
CVE-2020-4689 | Medium | 6.8 | 2020-10-12 | IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper vali… |
CVE-2020-4681 | Medium | 5.4 | 2020-10-12 | IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2020-4680 | Medium | 5.4 | 2020-10-12 | IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2020-4679 | Medium | 4.8 | 2020-10-12 | IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2020-4678 | Medium | 4.9 | 2020-10-12 | IBM Security Guardium 11.2 could allow an attacker with admin access to obtain and read files that they normally would not have access to. IBM X-Force ID: 1864… |
CVE-2020-4388 | High | 8.2 | 2020-10-12 | IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in a servlet also exposing debug informatio… |
CVE-2020-4302 | High | 7.8 | 2020-10-12 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to… |
CVE-2020-26869 | High | 7.5 | 2020-10-12 | ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users… |
CVE-2020-26868 | High | 7.5 | 2020-10-12 | ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information us… |
CVE-2020-26867 | Critical | 9.8 | 2020-10-12 | ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arb… |
CVE-2020-13943 | Medium | 4.3 | 2020-10-12 | If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent… |
CVE-2020-13341 | Medium | 4.9 | 2020-10-12 | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permission check allows attacker with developer… |
CVE-2020-4781 | Medium | 6.5 | 2020-10-12 | An improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could result in a den… |
CVE-2020-4780 | Medium | 5.3 | 2020-10-12 | OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of th… |
CVE-2020-4779 | High | 8.1 | 2020-10-12 | A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a specially-crafted request, an attacker could… |
CVE-2020-4778 | High | 7.5 | 2020-10-12 | IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptograph… |
CVE-2020-4776 | High | 7.5 | 2020-10-12 | A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a remote attacker to traverse directories on… |
CVE-2020-4775 | Medium | 5.4 | 2020-10-12 | A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malic… |
CVE-2020-4774 | Medium | 5.4 | 2020-10-12 | An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a sp… |
CVE-2020-4773 | Medium | 6.5 | 2020-10-12 | A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to exe… |
CVE-2020-4772 | High | 8.1 | 2020-10-12 | An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vuln… |
CVE-2020-4699 | Medium | 5.3 | 2020-10-12 | IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which cou… |
CVE-2020-4661 | Medium | 5.3 | 2020-10-12 | IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which cou… |
CVE-2020-4660 | Medium | 5.3 | 2020-10-12 | IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which cou… |
CVE-2020-5143 | Medium | 5.3 | 2020-10-12 | SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based on the server respon… |
CVE-2020-5142 | Medium | 6.1 | 2020-10-12 | A stored cross-site scripting (XSS) vulnerability exists in the SonicOS SSLVPN web interface. A remote unauthenticated attacker is able to store and potentiall… |
CVE-2020-5141 | Medium | 6.5 | 2020-10-12 | A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. This vulnerability… |
CVE-2020-5140 | High | 7.5 | 2020-10-12 | A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service by sending a malicious HTTP… |
CVE-2020-5139 | High | 7.5 | 2020-10-12 | A vulnerability in SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS) due to the release of Invalid pointer and l… |
CVE-2020-5138 | High | 7.5 | 2020-10-12 | A Heap Overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service and leads… |
CVE-2020-5137 | High | 7.5 | 2020-10-12 | A buffer overflow vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service and leads t… |
CVE-2020-5136 | Medium | 6.5 | 2020-10-12 | A buffer overflow vulnerability in SonicOS allows an authenticated attacker to cause Denial of Service (DoS) in the SSL-VPN and virtual assist portal, which le… |
CVE-2020-5135 | Critical | 9.8 | 2020-10-12 | A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malici… |
CVE-2020-5134 | Medium | 6.5 | 2020-10-12 | A vulnerability in SonicOS allows an authenticated attacker to cause out-of-bound invalid file reference leads to a firewall crash. This vulnerability affected… |
CVE-2020-5133 | High | 7.5 | 2020-10-12 | A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service due to buffer overflow, which leads to a firewall crash. This vu… |
CVE-2020-14184 | Medium | 5.4 | 2020-10-12 | Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in Jira… |
CVE-2020-26948 | Critical | 9.8 | 2020-10-10 | Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter. |
CVE-2020-26947 | High | 7.8 | 2020-10-10 | monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which allows local users t… |
CVE-2020-26945 | High | 8.1 | 2020-10-10 | MyBatis before 3.5.6 mishandles deserialization of object streams. |
CVE-2020-26935 | Critical | 9.8 | 2020-10-10 | An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin pro… |
CVE-2020-26934 | Medium | 6.1 | 2020-10-10 | phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link. |
CVE-2020-26932 | Medium | 4.3 | 2020-10-10 | debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended permissions are mode… |
CVE-2020-9105 | Medium | 6.7 | 2020-10-09 | Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an insufficient input validation vulnerability. Due to the input validation logic is incorrect… |
CVE-2020-13955 | Medium | 5.9 | 2020-10-09 | HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calci… |
CVE-2020-26931 | Medium | 5.9 | 2020-10-09 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 before 6.5.5… |
CVE-2020-26930 | Low | 3.3 | 2020-10-09 | NETGEAR EX7700 devices before 1.0.0.210 are affected by incorrect configuration of security settings. |
CVE-2020-26929 | High | 7.3 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6220 before 1.1.0.100 and R6230 before 1.1.0.100. |
CVE-2020-26928 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 bef… |
CVE-2020-26927 | Critical | 9.4 | 2020-10-09 | Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.42, R6080 before… |
CVE-2020-26926 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 bef… |
CVE-2020-26925 | Low | 3.2 | 2020-10-09 | NETGEAR GS808E devices before 1.7.1.0 are affected by denial of service. |
CVE-2020-26924 | Low | 3.1 | 2020-10-09 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects WAC720 before 3.9.1.13 and WAC730 before 3.9.1.13. |
CVE-2020-26923 | Medium | 4.3 | 2020-10-09 | Certain NETGEAR devices are affected by stored XSS. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 before 6.5.5.24, and WC9500 before 6… |
CVE-2020-26922 | Medium | 6.4 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 befor… |
CVE-2020-26921 | High | 8.3 | 2020-10-09 | Certain NETGEAR devices are affected by authentication bypass. This affects GS110EMX before 1.0.1.7, GS810EMX before 1.7.1.3, XS512EM before 1.0.1.3, and XS724… |
CVE-2020-26920 | High | 8.8 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5.3.110, SRR60 before 2.5.3.110, and SRS6… |
CVE-2020-26919 | Critical | 9.8 | 2020-10-09 | NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. |
CVE-2020-26918 | Medium | 4.1 | 2020-10-09 | Certain NETGEAR devices are affected by stored XSS. This affects EX7000 before 1.0.1.78, R6250 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.66… |
CVE-2020-26917 | Medium | 4.1 | 2020-10-09 | Certain NETGEAR devices are affected by stored XSS. This affects EX7000 before 1.0.1.78, R6250 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.66… |
CVE-2020-26916 | Medium | 5.4 | 2020-10-09 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before… |
CVE-2020-26915 | Medium | 6.0 | 2020-10-09 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-26914 | Medium | 6.7 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1… |
CVE-2020-26913 | Medium | 6.8 | 2020-10-09 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.63, R7800 before 1.0.2.60, R890… |
CVE-2020-26912 | High | 7.5 | 2020-10-09 | Certain NETGEAR devices are affected by CSRF. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1.0.1.24, R6020 before 1.0.0.42, R6050… |
CVE-2020-26911 | High | 8.3 | 2020-10-09 | Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before… |
CVE-2020-26910 | High | 8.4 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before… |
CVE-2020-26909 | High | 8.8 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0.1.58 and R7500v2 before 1.0.3.48. |
CVE-2020-26908 | Critical | 9.4 | 2020-10-09 | Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.36, D7000 before 1.0.1.74, PR2000 before 1.0.0.30, R6020 before… |
CVE-2020-26907 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS8… |
CVE-2020-26906 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3… |
CVE-2020-26905 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3… |
CVE-2020-26904 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3… |
CVE-2020-26903 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3… |
CVE-2020-26902 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750… |
CVE-2020-26901 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.1… |
CVE-2020-26900 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3… |
CVE-2020-26899 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15… |
CVE-2020-26898 | Critical | 9.6 | 2020-10-09 | NETGEAR RAX40 devices before 1.0.3.80 are affected by incorrect configuration of security settings. |
CVE-2020-26897 | Critical | 9.6 | 2020-10-09 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3… |
CVE-2020-26522 | High | 8.8 | 2020-10-09 | A cross-site request forgery (CSRF) vulnerability in mod/user/act_user.php in Garfield Petshop through 2020-10-01 allows remote attackers to hijack the authent… |
CVE-2020-26162 | Medium | 6.1 | 2020-10-09 | Xerox WorkCentre EC7836 before 073.050.059.25300 and EC7856 before 073.020.059.25300 devices allow XSS via Description pages. |
CVE-2020-15838 | High | 8.8 | 2020-10-09 | The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions. |
CVE-2020-13626 | Medium | 4.6 | 2020-10-09 | OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS me… |
CVE-2020-15243 | Critical | 9.1 | 2020-10-08 | Affected versions of Smartstore have a missing WebApi Authentication attribute. This vulnerability affects Smartstore shops in version 4.0.0 & 4.0.1 which have… |
CVE-2020-26894 | High | 7.8 | 2020-10-08 | LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in the folder of the vulnerable LiveCode app… |
CVE-2020-15241 | Medium | 4.7 | 2020-10-08 | TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when ma… |