2020 CVEs (page 94)
Page 94 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15193 | High | 7.1 | 2020-09-25 | In Tensorflow before versions 2.2.1 and 2.3.1, the implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory cor… |
CVE-2020-15192 | Medium | 4.3 | 2020-09-25 | In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation… |
CVE-2020-15191 | Medium | 5.3 | 2020-09-25 | In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will cause variables to bind… |
CVE-2020-15190 | Medium | 5.3 | 2020-09-25 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two te… |
CVE-2020-25149 | High | 8.8 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to t… |
CVE-2020-25148 | Medium | 6.1 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is… |
CVE-2020-25147 | Critical | 9.8 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to… |
CVE-2020-25146 | Medium | 6.1 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is… |
CVE-2020-25145 | High | 8.8 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to t… |
CVE-2020-25144 | High | 8.8 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to t… |
CVE-2020-25143 | High | 8.8 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to… |
CVE-2020-25142 | Medium | 6.5 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable if any links and forms lack an unpredictable CSRF token… |
CVE-2020-25141 | Medium | 6.1 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is… |
CVE-2020-16242 | Medium | 6.1 | 2020-09-25 | The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow an attacker to trick application users into performing cri… |
CVE-2020-4727 | Medium | 6.1 | 2020-09-25 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious W… |
CVE-2020-4531 | Medium | 5.3 | 2020-09-25 | IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive info… |
CVE-2020-25140 | Medium | 6.1 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is… |
CVE-2020-25139 | Medium | 6.1 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is… |
CVE-2020-25138 | Medium | 6.1 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is… |
CVE-2020-25137 | Medium | 6.1 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is… |
CVE-2020-19455 | High | 7.5 | 2020-09-25 | SQL injection exists in the jdownloads 3.2.63 component for Joomla! via components/com_jdownloads/helpers/categories.php, order function via the filter_order p… |
CVE-2020-25136 | High | 8.8 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to t… |
CVE-2020-25135 | Medium | 6.1 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is… |
CVE-2020-25134 | High | 8.8 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to t… |
CVE-2020-25133 | High | 8.8 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to t… |
CVE-2020-25132 | Critical | 9.8 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to… |
CVE-2020-19451 | High | 7.5 | 2020-09-25 | SQL injection exists in the jdownloads 3.2.63 component for Joomla! via com_jdownloads/helpers/jdownloadshelper.php, updateLog function via the X-forwarded-for… |
CVE-2020-19450 | High | 7.5 | 2020-09-25 | SQL injection exists in the jdownloads 3.2.63 component for Joomla! via com_jdownloads/helpers/jdownloadshelper.php, getUserLimits function in the list paramet… |
CVE-2020-5930 | High | 7.5 | 2020-09-25 | In BIG-IP 15.0.0-15.1.0.4, 14.1.0-14.1.2.7, 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 and BIG-IQ 5.2.0-7.1.0, unauthenticated attackers can cause d… |
CVE-2020-5929 | Medium | 5.9 | 2020-09-25 | In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server conf… |
CVE-2020-25131 | Medium | 6.1 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is… |
CVE-2020-25130 | Medium | 6.5 | 2020-09-25 | An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to… |
CVE-2020-15374 | Critical | 9.8 | 2020-09-25 | Rest API in Brocade Fabric OS v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c is vulnerable to multiple instances of reflected input. |
CVE-2020-15373 | Critical | 9.8 | 2020-09-25 | Multiple buffer overflow vulnerabilities in REST API in Brocade Fabric OS versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c could allow remote… |
CVE-2020-15372 | Medium | 5.5 | 2020-09-25 | A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0_CBN3, v8.2.1e, v8.1.2k, v9.0.0, c… |
CVE-2020-15371 | Critical | 9.8 | 2020-09-25 | Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, contains code injection and privilege escalation vulnerabil… |
CVE-2020-15370 | Medium | 6.5 | 2020-09-25 | Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in cleartext. The vulnerabili… |
CVE-2020-15369 | High | 8.8 | 2020-09-25 | Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expo… |
CVE-2020-13995 | Critical | 9.8 | 2020-09-25 | U.S. Air Force Sensor Data Management System extract75 has a buffer overflow that leads to code execution. An overflow in a global variable (sBuffer) leads to… |
CVE-2020-7735 | Medium | 6.6 | 2020-09-25 | The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option. |
CVE-2020-15521 | Medium | 6.1 | 2020-09-25 | Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) . |
CVE-2020-15394 | Critical | 9.8 | 2020-09-25 | The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code… |
CVE-2020-26115 | Medium | 6.1 | 2020-09-25 | cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574). |
CVE-2020-26114 | Medium | 6.1 | 2020-09-25 | cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573). |
CVE-2020-26113 | Medium | 6.1 | 2020-09-25 | cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569). |
CVE-2020-26112 | High | 7.5 | 2020-09-25 | The email quota cache in cPanel before 90.0.10 allows overwriting of files. |
CVE-2020-26111 | Medium | 6.1 | 2020-09-25 | cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566). |
CVE-2020-26110 | Medium | 6.1 | 2020-09-25 | cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564). |
CVE-2020-26109 | High | 7.5 | 2020-09-25 | cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557). |
CVE-2020-26108 | Critical | 9.8 | 2020-09-25 | cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). |
CVE-2020-26107 | High | 7.5 | 2020-09-25 | cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561). |
CVE-2020-26106 | High | 7.5 | 2020-09-25 | cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558). |
CVE-2020-26105 | Critical | 9.8 | 2020-09-25 | In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). |
CVE-2020-26104 | High | 7.5 | 2020-09-25 | In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552). |
CVE-2020-26103 | High | 7.5 | 2020-09-25 | In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551). |
CVE-2020-26102 | High | 7.5 | 2020-09-25 | In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550). |
CVE-2020-26101 | Critical | 9.8 | 2020-09-25 | In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). |
CVE-2020-26100 | Critical | 9.8 | 2020-09-25 | chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). |
CVE-2020-26099 | High | 7.5 | 2020-09-25 | cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491). |
CVE-2020-26098 | Critical | 9.8 | 2020-09-25 | cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). |
CVE-2020-25625 | Medium | 5.3 | 2020-09-25 | hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. |
CVE-2020-25085 | Medium | 5.0 | 2020-09-25 | QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case. |
CVE-2020-25084 | Low | 3.2 | 2020-09-25 | QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. |
CVE-2020-25749 | Critical | 9.8 | 2020-09-25 | The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) could allow an remote attacker to take full control… |
CVE-2020-25748 | High | 8.1 | 2020-09-25 | A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339). Someone in the middle can interc… |
CVE-2020-25747 | Critical | 9.4 | 2020-09-25 | The Telnet service of Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) can allow a remote attacker to gain access to RTSP and ONFIV… |
CVE-2020-25223 | Critical | 9.8 | 2020-09-25 | A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11 |
CVE-2020-25203 | Medium | 5.5 | 2020-09-25 | The Framer Preview application 12 for Android exposes com.framer.viewer.FramerViewActivity to other applications. By calling the intent with the action set to… |
CVE-2020-24718 | High | 8.2 | 2020-09-25 | bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS a… |
CVE-2020-24692 | High | 7.1 | 2020-09-25 | The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient input validation… |
CVE-2020-24621 | High | 8.8 | 2020-09-25 | A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS. By leveraging path trav… |
CVE-2020-24615 | Medium | 5.3 | 2020-09-25 | Pexip Infinity before 24.1 has Improper Input Validation, leading to temporary denial of service via SIP. |
CVE-2020-24595 | Medium | 5.3 | 2020-09-25 | Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to retrieve sensitive information due to insufficient acc… |
CVE-2020-24594 | Critical | 9.6 | 2020-09-25 | Mitel MiCloud Management Portal before 6.1 SP5 could allow an unauthenticated attacker to execute arbitrary scripts due to insufficient input validation, aka X… |
CVE-2020-24593 | High | 7.2 | 2020-09-25 | Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials due to improper inpu… |
CVE-2020-24592 | Medium | 5.3 | 2020-09-25 | Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system information due to insufficient output san… |
CVE-2020-23837 | High | 8.8 | 2020-09-25 | A Cross-Site Request Forgery (CSRF) vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin (or other) users after… |
CVE-2020-13387 | High | 7.5 | 2020-09-25 | Pexip Infinity before 23.4 has a lack of input validation, leading to temporary denial of service via H.323. |
CVE-2020-12824 | High | 7.5 | 2020-09-25 | Pexip Infinity 23.x before 23.3 has improper input validation, leading to a temporary software abort via RTP. |
CVE-2020-11805 | Critical | 9.8 | 2020-09-25 | Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN. |
CVE-2020-17365 | High | 7.8 | 2020-09-24 | Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to potentially enable esca… |
CVE-2020-15843 | High | 7.3 | 2020-09-24 | ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PROGRAMFILES%\ActiveF… |
CVE-2020-15162 | Medium | 5.4 | 2020-09-24 | In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious… |
CVE-2020-15160 | Critical | 9.8 | 2020-09-24 | PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location para… |
CVE-2020-13991 | High | 7.5 | 2020-09-24 | vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register. |
CVE-2020-15161 | Medium | 5.4 | 2020-09-24 | In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1… |
CVE-2020-8348 | Medium | 6.1 | 2020-09-24 | A DOM-based cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow exec… |
CVE-2020-8347 | Medium | 6.1 | 2020-09-24 | A reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow exe… |
CVE-2020-8333 | Medium | 6.4 | 2020-09-24 | A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow arbitrary code execu… |
CVE-2020-15851 | Critical | 9.8 | 2020-09-24 | Lack of access control in Nakivo Backup & Replication Transporter version 9.4.0.r43656 allows remote users to access unencrypted backup repositories and the Na… |
CVE-2020-15850 | High | 7.8 | 2020-09-24 | Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access the Nakivo Director web interface and ga… |
CVE-2020-19447 | High | 7.5 | 2020-09-24 | SQL injection exists in the jdownloads 3.2.63 component for Joomla! com_jdownloads/models/send.php via the f_marked_files_id parameter. |
CVE-2020-15930 | Medium | 6.1 | 2020-09-24 | An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag. |
CVE-2020-3560 | High | 8.6 | 2020-09-24 | A vulnerability in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on an affected device… |
CVE-2020-3559 | High | 8.6 | 2020-09-24 | A vulnerability in Cisco Aironet Access Point (AP) Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerab… |
CVE-2020-3552 | High | 7.4 | 2020-09-24 | A vulnerability in the Ethernet packet handling of Cisco Aironet Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a deni… |
CVE-2020-3527 | High | 8.6 | 2020-09-24 | A vulnerability in the Polaris kernel of Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to crash the device. The vulnerabi… |
CVE-2020-3526 | High | 8.6 | 2020-09-24 | A vulnerability in the Common Open Policy Service (COPS) engine of Cisco IOS XE Software on Cisco cBR-8 Converged Broadband Routers could allow an unauthentica… |
CVE-2020-3524 | Medium | 6.8 | 2020-09-24 | A vulnerability in the Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco 4000 Series Integrated Services Routers, Cisco ASR 920 Series Aggregation Services… |
CVE-2020-3516 | Medium | 4.3 | 2020-09-24 | A vulnerability in the web server authentication of Cisco IOS XE Software could allow an authenticated, remote attacker to crash the web server on the device… |