2020 CVEs (page 95)
Page 95 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3513 | Medium | 6.7 | 2020-09-24 | Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services… |
CVE-2020-3512 | High | 7.4 | 2020-09-24 | A vulnerability in the PROFINET handler for Link Layer Discovery Protocol (LLDP) messages of Cisco IOS Software and Cisco IOS XE Software could allow an unauth… |
CVE-2020-3511 | High | 7.4 | 2020-09-24 | A vulnerability in the ISDN subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of an… |
CVE-2020-3510 | High | 8.6 | 2020-09-24 | A vulnerability in the Umbrella Connector component of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote att… |
CVE-2020-3509 | High | 8.6 | 2020-09-24 | A vulnerability in the DHCP message handler of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacke… |
CVE-2020-3508 | High | 7.4 | 2020-09-24 | A vulnerability in the IP Address Resolution Protocol (ARP) feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers with a 20-G… |
CVE-2020-3503 | Medium | 6.0 | 2020-09-24 | A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critica… |
CVE-2020-3497 | High | 7.4 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3494 | High | 7.4 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3493 | High | 7.4 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3492 | High | 8.6 | 2020-09-24 | A vulnerability in the Flexible NetFlow Version 9 packet processor of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers and Cisco AireO… |
CVE-2020-3489 | High | 7.4 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3488 | High | 7.4 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3487 | Medium | 6.5 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3486 | Medium | 6.5 | 2020-09-24 | Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 980… |
CVE-2020-3480 | High | 8.6 | 2020-09-24 | Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to rel… |
CVE-2020-3479 | Medium | 6.1 | 2020-09-24 | A vulnerability in the implementation of Multiprotocol Border Gateway Protocol (MP-BGP) for the Layer 2 VPN (L2VPN) Ethernet VPN (EVPN) address family in Cisco… |
CVE-2020-3477 | Medium | 5.5 | 2020-09-24 | A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash… |
CVE-2020-3476 | Medium | 6.0 | 2020-09-24 | A vulnerability in the CLI implementation of a specific command of Cisco IOS XE Software could allow an authenticated, local attacker to overwrite arbitrary fi… |
CVE-2020-3475 | Medium | 4.3 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to ga… |
CVE-2020-3474 | Medium | 4.3 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to ga… |
CVE-2020-3465 | High | 7.4 | 2020-09-24 | A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a device to reload. The vulnerability is due to incorrect h… |
CVE-2020-3429 | Medium | 6.5 | 2020-09-24 | A vulnerability in the WPA2 and WPA3 security implementation of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an una… |
CVE-2020-3428 | Medium | 6.5 | 2020-09-24 | A vulnerability in the WLAN Local Profiling feature of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthentica… |
CVE-2020-3426 | High | 7.5 | 2020-09-24 | A vulnerability in the implementation of the Low Power, Wide Area (LPWA) subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Ro… |
CVE-2020-3425 | High | 8.8 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to el… |
CVE-2020-3423 | Medium | 5.1 | 2020-09-24 | A vulnerability in the implementation of the Lua interpreter that is integrated in Cisco IOS XE Software could allow an authenticated, local attacker to execut… |
CVE-2020-3422 | High | 7.5 | 2020-09-24 | A vulnerability in the IP Service Level Agreement (SLA) responder feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the… |
CVE-2020-3421 | High | 8.6 | 2020-09-24 | Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to rel… |
CVE-2020-3418 | Medium | 4.7 | 2020-09-24 | A vulnerability in Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9800 Series Routers could allow an unauthenticated, adjacent attacker to send I… |
CVE-2020-3417 | Medium | 6.8 | 2020-09-24 | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to execute persistent code at boot time and break the chain of trust. Thi… |
CVE-2020-3416 | Medium | 6.7 | 2020-09-24 | Multiple vulnerabilities in the initialization routines that are executed during bootup of Cisco IOS XE Software for Cisco ASR 900 Series Aggregation Services… |
CVE-2020-3414 | High | 8.6 | 2020-09-24 | A vulnerability in the packet processing of Cisco IOS XE Software for Cisco 4461 Integrated Services Routers could allow an unauthenticated, remote attacker to… |
CVE-2020-3409 | High | 7.4 | 2020-09-24 | A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected… |
CVE-2020-3408 | High | 8.6 | 2020-09-24 | A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected d… |
CVE-2020-3407 | High | 8.6 | 2020-09-24 | A vulnerability in the RESTCONF and NETCONF-YANG access control list (ACL) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to… |
CVE-2020-3404 | High | 7.8 | 2020-09-24 | A vulnerability in the persistent Telnet/Secure Shell (SSH) CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on a… |
CVE-2020-3403 | High | 7.8 | 2020-09-24 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to inject a command to the underlying operating system that wi… |
CVE-2020-3400 | High | 8.8 | 2020-09-24 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to utilize parts of the web UI for which they are… |
CVE-2020-3399 | High | 8.6 | 2020-09-24 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series… |
CVE-2020-3396 | Medium | 6.8 | 2020-09-24 | A vulnerability in the file system on the pluggable USB 3.0 Solid State Drive (SSD) for Cisco IOS XE Software could allow an authenticated, physical attacker t… |
CVE-2020-3393 | Medium | 6.0 | 2020-09-24 | A vulnerability in the application-hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an… |
CVE-2020-3390 | High | 7.4 | 2020-09-24 | A vulnerability in Simple Network Management Protocol (SNMP) trap generation for wireless clients of the Cisco IOS XE Wireless Controller Software for the Cisc… |
CVE-2020-3359 | High | 8.6 | 2020-09-24 | A vulnerability in the multicast DNS (mDNS) feature of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated… |
CVE-2020-3141 | High | 8.8 | 2020-09-24 | Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to el… |
CVE-2020-12815 | Medium | 5.4 | 2020-09-24 | An improper neutralization of input vulnerability in FortiTester before 3.9.0 may allow a remote authenticated attacker to inject script related HTML tags via… |
CVE-2020-12811 | Medium | 6.1 | 2020-09-24 | An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and FortiAnalyzer 6.2.0, 6.2.1, 6.2.2, and 6… |
CVE-2020-15223 | High | 8.0 | 2020-09-24 | In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the… |
CVE-2020-15222 | High | 8.1 | 2020-09-24 | In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness o… |
CVE-2020-13119 | High | 8.1 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to clickjacking. |
CVE-2020-12843 | Critical | 9.8 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to garage doors. The magic bytes for WAV must be used. |
CVE-2020-12842 | Critical | 9.8 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php. |
CVE-2020-12841 | Medium | 6.5 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.php |
CVE-2020-12840 | Medium | 6.5 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload sound files via /index.php |
CVE-2020-12839 | Critical | 9.8 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.php. |
CVE-2020-12838 | Critical | 9.8 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php. |
CVE-2020-12837 | High | 7.5 | 2020-09-24 | ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading images to garage doors. The magic bytes of PNG must be used. |
CVE-2020-12282 | High | 8.8 | 2020-09-24 | iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. (This can be combined w… |
CVE-2020-12281 | Medium | 6.5 | 2020-09-24 | iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php. |
CVE-2020-26088 | Medium | 5.5 | 2020-09-24 | A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets… |
CVE-2020-24365 | High | 8.8 | 2020-09-24 | An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated att… |
CVE-2020-15840 | Medium | 5.3 | 2020-09-24 | In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be… |
CVE-2020-13505 | Critical | 9.8 | 2020-09-24 | Parameter psClass in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks. Specially crafted SOAP web requests can cause SQL injections re… |
CVE-2020-13504 | Critical | 9.8 | 2020-09-24 | Parameter AttFilterValue in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks. Specially crafted SOAP web requests can cause SQL inject… |
CVE-2020-13501 | Critical | 9.8 | 2020-09-24 | An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SO… |
CVE-2020-13500 | Critical | 9.8 | 2020-09-24 | SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP… |
CVE-2020-13499 | Critical | 9.8 | 2020-09-24 | An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SO… |
CVE-2020-12818 | Medium | 5.3 | 2020-09-24 | An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unn… |
CVE-2020-12817 | High | 8.8 | 2020-09-24 | An improper neutralization of input vulnerability in FortiAnalyzer before 6.4.1 and 6.2.5 may allow a remote authenticated attacker to inject script related HT… |
CVE-2020-12816 | Medium | 6.1 | 2020-09-24 | An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting a… |
CVE-2020-12280 | Medium | 6.5 | 2020-09-24 | iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to open/close a specified garage door/gate via /isg/opendoor.php. |
CVE-2020-6020 | Medium | 6.4 | 2020-09-24 | Check Point Security Management's Internal CA web management before Jumbo HFAs R80.10 Take 278, R80.20 Take 160, R80.30 Take 210, and R80.40 Take 38, can be ma… |
CVE-2020-22453 | Medium | 6.1 | 2020-09-24 | Untis WebUntis before 2020.9.6 allows XSS in multiple functions that store information. |
CVE-2020-16148 | High | 7.2 | 2020-09-24 | The ping page of the administration panel in Telmat AccessLog <= 6.0 (TAL_20180415) allows an attacker to get root shell access via authenticated code injectio… |
CVE-2020-16147 | Critical | 9.8 | 2020-09-24 | The login page in Telmat AccessLog <= 6.0 (TAL_20180415) allows an attacker to get root shell access via Unauthenticated code injection over the network. |
CVE-2020-24560 | High | 7.5 | 2020-09-24 | An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to c… |
CVE-2020-15604 | High | 7.5 | 2020-09-24 | An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to c… |
CVE-2020-25604 | Medium | 4.7 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests b… |
CVE-2020-25603 | High | 7.8 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures… |
CVE-2020-25602 | Medium | 6.0 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE. When a guest accesses… |
CVE-2020-25601 | Medium | 5.5 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular, the FIFO event channel model… |
CVE-2020-25600 | Medium | 5.5 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model impo… |
CVE-2020-25599 | High | 7.0 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCT… |
CVE-2020-25598 | Medium | 5.5 | 2020-09-23 | An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchro… |
CVE-2020-25597 | Medium | 6.5 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handlin… |
CVE-2020-25596 | Medium | 5.5 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various stat… |
CVE-2020-25595 | High | 7.8 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified th… |
CVE-2020-5783 | Medium | 5.4 | 2020-09-23 | In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms. |
CVE-2020-5782 | Medium | 6.5 | 2020-09-23 | In IgniteNet HeliOS GLinq v2.2.1 r2961, if a user logs in and sets the ‘wan_type’ parameter, the wan interface for the device will become unreachable, which re… |
CVE-2020-5781 | Medium | 4.3 | 2020-09-23 | In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file (/etc/config/luci) by the authenticator.htmlauth f… |
CVE-2020-11031 | High | 7.8 | 2020-09-23 | In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/… |
CVE-2020-24213 | High | 7.5 | 2020-09-23 | An integer overflow was discovered in YGOPro ygocore v13.51. Attackers can use it to leak the game server thread's memory. |
CVE-2020-4340 | Medium | 4.3 | 2020-09-23 | IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180. |
CVE-2020-4324 | Medium | 4.3 | 2020-09-23 | IBM Security Secret Server proir to 10.9 could allow a remote attacker to bypass security restrictions, caused by improper input validation. IBM X-Force ID: 17… |
CVE-2020-2285 | Medium | 4.3 | 2020-09-23 | A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of c… |
CVE-2020-2284 | High | 7.1 | 2020-09-23 | Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2020-2283 | Medium | 5.4 | 2020-09-23 | Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitabl… |
CVE-2020-2282 | Medium | 4.3 | 2020-09-23 | Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to confi… |
CVE-2020-2281 | Medium | 5.4 | 2020-09-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserve, unlock, and rese… |
CVE-2020-2280 | High | 8.8 | 2020-09-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code. |