2020 CVEs (page 96)
Page 96 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2279 | Critical | 9.9 | 2020-09-23 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide craft… |
CVE-2020-25739 | Medium | 6.1 | 2020-09-23 | An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mech… |
CVE-2020-16244 | High | 7.2 | 2020-09-23 | GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw… |
CVE-2020-16240 | Medium | 5.3 | 2020-09-23 | GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference (IDOR) vulnerability allows user account data to be downloaded in JavaScrip… |
CVE-2020-7122 | High | 7.5 | 2020-09-23 | Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F, 6300, 6400, 8320, 8325, and 8400 have been found. Successful exploitation of these… |
CVE-2020-7121 | High | 7.5 | 2020-09-23 | Two memory corruption vulnerabilities in the Aruba CX Switches Series 6200F, 6300, 6400, 8320, 8325, and 8400 have been found. Successful exploitation of these… |
CVE-2020-24626 | Critical | 9.8 | 2020-09-23 | Unathenticated directory traversal in the ReceiverServlet class doPost() method can lead to arbitrary remote code execution in HPE Pay Per Use (PPU) Utility Co… |
CVE-2020-24625 | High | 7.5 | 2020-09-23 | Unathenticated directory traversal in the ReceiverServlet class doGet() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) Utility Computing Serv… |
CVE-2020-24624 | High | 7.5 | 2020-09-23 | Unathenticated directory traversal in the DownloadServlet class execute() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) Utility Computing Se… |
CVE-2020-14370 | Medium | 5.3 | 2020-09-23 | An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible… |
CVE-2020-14365 | High | 7.1 | 2020-09-23 | A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf mo… |
CVE-2020-10714 | High | 7.5 | 2020-09-23 | A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker c… |
CVE-2020-10687 | Medium | 4.8 | 2020-09-23 | A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1… |
CVE-2020-25826 | High | 7.8 | 2020-09-23 | PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp.BrowserSubprocess.exe. |
CVE-2020-25821 | High | 7.5 | 2020-09-23 | peg-markdown 0.4.14 has a NULL pointer dereference in process_raw_blocks in markdown_lib.c. NOTE: This vulnerability only affects products that are no longer s… |
CVE-2020-3569 | High | 8.6 | 2020-09-23 | Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote atta… |
CVE-2020-3143 | High | 7.2 | 2020-09-23 | A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software, Cisco TelePresence Codec (TC) Software, and Cisco… |
CVE-2020-3137 | Medium | 6.1 | 2020-09-23 | A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2020-3135 | High | 8.8 | 2020-09-23 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (UCM) could allow an unauthenticated, remote attacker to conduct… |
CVE-2020-3133 | High | 7.5 | 2020-09-23 | A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacke… |
CVE-2020-3130 | Medium | 6.5 | 2020-09-23 | A vulnerability in the web management interface of Cisco Unity Connection could allow an authenticated remote attacker to overwrite files on the underlying fil… |
CVE-2020-3124 | Medium | 6.5 | 2020-09-23 | A vulnerability in the web-based interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) could allow an unauthenticated, remote attacker to condu… |
CVE-2020-3117 | Medium | 4.7 | 2020-09-23 | A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance (WSA) and Cisco Content Security Management Appliance (SMA) could allow… |
CVE-2020-3116 | Medium | 5.5 | 2020-09-23 | A vulnerability in the way Cisco Webex applications process Universal Communications Format (UCF) files could allow an attacker to cause a denial of service (D… |
CVE-2020-25515 | High | 7.8 | 2020-09-22 | Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book , http://<site>/lms/index.php?page=books. |
CVE-2020-25514 | High | 8.4 | 2020-09-22 | Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php. |
CVE-2020-15839 | Medium | 6.5 | 2020-09-22 | Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action… |
CVE-2020-14031 | High | 7.2 | 2020-09-22 | An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The outbox functionality of the TXT File module can be used to delete all/most files in a folde… |
CVE-2020-14028 | High | 7.2 | 2020-09-22 | An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. By leveraging a path traversal vulnerability in the Autoreply module's Script Name, an attacker… |
CVE-2020-14027 | Medium | 5.3 | 2020-09-22 | An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLE_LOCAL_INFILE, th… |
CVE-2020-14026 | High | 8.8 | 2020-09-22 | CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that… |
CVE-2020-14025 | High | 8.8 | 2020-09-22 | Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted… |
CVE-2020-14024 | Medium | 6.1 | 2020-09-22 | Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailb… |
CVE-2020-14023 | Medium | 4.9 | 2020-09-22 | Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS. |
CVE-2020-14022 | High | 8.8 | 2020-09-22 | Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) from a file. It is p… |
CVE-2020-25487 | High | 7.8 | 2020-09-22 | PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php. |
CVE-2020-24333 | Medium | 6.5 | 2020-09-22 | A vulnerability in Arista’s CloudVision Portal (CVP) prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet Management module… |
CVE-2020-16202 | High | 7.8 | 2020-09-22 | WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code execution with system… |
CVE-2020-11856 | Critical | 9.8 | 2020-09-22 | Arbitrary code execution vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow remote atta… |
CVE-2020-4622 | High | 7.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2020-4621 | High | 8.8 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient authorization checks. IB… |
CVE-2020-4620 | High | 8.8 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation of file extensions… |
CVE-2020-4619 | Medium | 6.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 184976. |
CVE-2020-4618 | Medium | 4.9 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow a privileged user to cause a denial of service due to improper input validation. IBM X-Force ID: 184937. |
CVE-2020-4617 | High | 8.1 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tran… |
CVE-2020-4616 | Medium | 5.3 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 184929. |
CVE-2020-4615 | Medium | 5.4 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2020-4614 | High | 7.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Forc… |
CVE-2020-4613 | High | 7.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM… |
CVE-2020-4612 | Medium | 6.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to obtain sensitive information using a specially crafted HTTP request. IBM X-Force ID: 18… |
CVE-2020-4611 | High | 8.8 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to bypass security and execute actions reserved for admins. IBM X-Force ID: 184922. |
CVE-2020-3977 | Medium | 6.5 | 2020-09-22 | VMware Horizon DaaS (7.x and 8.x before 8.0.1 Update 1) contains a broken authentication vulnerability due to a flaw in the way it handled the first factor aut… |
CVE-2020-23446 | Medium | 5.3 | 2020-09-22 | Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API |
CVE-2020-11857 | Critical | 9.8 | 2020-09-22 | An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow remote attac… |
CVE-2020-11855 | High | 7.8 | 2020-09-22 | An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow local attack… |
CVE-2020-8887 | High | 7.5 | 2020-09-22 | Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauthenticated attacker to dump database con… |
CVE-2020-24619 | Medium | 5.9 | 2020-09-22 | In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone). A man-in-the-middle attacker… |
CVE-2020-7734 | High | 8.2 | 2020-09-22 | All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column. |
CVE-2020-6576 | High | 8.8 | 2020-09-21 | Use after free in offscreen canvas in Google Chrome prior to 85.0.4183.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-6575 | High | 8.3 | 2020-09-21 | Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape… |
CVE-2020-6574 | High | 7.8 | 2020-09-21 | Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve privilege escalati… |
CVE-2020-6573 | Critical | 9.6 | 2020-09-21 | Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2020-6571 | Medium | 4.3 | 2020-09-21 | Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a cr… |
CVE-2020-6570 | Medium | 4.3 | 2020-09-21 | Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information via a crafted WebRTC… |
CVE-2020-6569 | Medium | 6.3 | 2020-09-21 | Integer overflow in WebUSB in Google Chrome prior to 85.0.4183.83 allowed a remote attacker who had compromised the renderer process to potentially exploit hea… |
CVE-2020-6568 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restriction… |
CVE-2020-6567 | Medium | 6.5 | 2020-09-21 | Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navig… |
CVE-2020-6566 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6565 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar)… |
CVE-2020-6564 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a… |
CVE-2020-6563 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive… |
CVE-2020-6562 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in Blink in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6561 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in Content Security Policy in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafte… |
CVE-2020-6560 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in autofill in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2020-6559 | High | 8.8 | 2020-09-21 | Use after free in presentation API in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-6558 | Medium | 6.5 | 2020-09-21 | Insufficient policy enforcement in iOSWeb in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a craft… |
CVE-2020-6556 | High | 8.8 | 2020-09-21 | Heap buffer overflow in SwiftShader in Google Chrome prior to 84.0.4147.135 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-6555 | High | 7.6 | 2020-09-21 | Out of bounds read in WebGL in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2020-6554 | High | 8.6 | 2020-09-21 | Use after free in extensions in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Ext… |
CVE-2020-6553 | High | 8.8 | 2020-09-21 | Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2020-6552 | High | 8.8 | 2020-09-21 | Use after free in Blink in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6551 | High | 8.8 | 2020-09-21 | Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6550 | High | 8.8 | 2020-09-21 | Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6549 | High | 8.8 | 2020-09-21 | Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6548 | High | 8.8 | 2020-09-21 | Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.125 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2020-6547 | Medium | 6.5 | 2020-09-21 | Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML… |
CVE-2020-6546 | High | 7.8 | 2020-09-21 | Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege via a crafted files… |
CVE-2020-6545 | High | 8.8 | 2020-09-21 | Use after free in audio in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6544 | High | 8.8 | 2020-09-21 | Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6543 | High | 8.8 | 2020-09-21 | Use after free in task scheduling in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-6542 | High | 8.8 | 2020-09-21 | Use after free in ANGLE in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6541 | High | 8.8 | 2020-09-21 | Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6540 | High | 8.8 | 2020-09-21 | Buffer overflow in Skia in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6539 | High | 8.8 | 2020-09-21 | Use after free in CSS in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-6538 | Medium | 6.5 | 2020-09-21 | Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2020-6537 | High | 8.8 | 2020-09-21 | Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
CVE-2020-6532 | High | 8.8 | 2020-09-21 | Use after free in SCTP in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15966 | Medium | 4.3 | 2020-09-21 | Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-15965 | High | 8.8 | 2020-09-21 | Type confusion in V8 in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML pa… |
CVE-2020-15964 | High | 8.8 | 2020-09-21 | Insufficient data validation in media in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |