2020 CVEs (page 97)
Page 97 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15963 | Critical | 9.6 | 2020-09-21 | Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-15962 | High | 8.8 | 2020-09-21 | Insufficient policy validation in serial in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access v… |
CVE-2020-15961 | Critical | 9.6 | 2020-09-21 | Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2020-15960 | High | 8.8 | 2020-09-21 | Heap buffer overflow in storage in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access via a craf… |
CVE-2020-15959 | Medium | 4.3 | 2020-09-21 | Insufficient policy enforcement in networking in Google Chrome prior to 85.0.4183.102 allowed an attacker who convinced the user to enable logging to obtain po… |
CVE-2020-4643 | High | 7.5 | 2020-09-21 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2020-4731 | Medium | 6.1 | 2020-09-21 | IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t… |
CVE-2020-4590 | Medium | 6.5 | 2020-09-21 | IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable to a denial of se… |
CVE-2020-4581 | High | 7.5 | 2020-09-21 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a chunked transfer-encoding HTTP/2 r… |
CVE-2020-4580 | High | 7.5 | 2020-09-21 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request w… |
CVE-2020-4579 | High | 7.5 | 2020-09-21 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request w… |
CVE-2020-4315 | Medium | 4.3 | 2020-09-21 | IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to ge… |
CVE-2020-16171 | Medium | 6.5 | 2020-09-21 | An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard head… |
CVE-2020-14180 | Medium | 4.3 | 2020-09-21 | Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Reques… |
CVE-2020-14179 | Medium | 5.3 | 2020-09-21 | Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Infor… |
CVE-2020-14177 | Medium | 6.5 | 2020-09-21 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service… |
CVE-2020-25796 | High | 7.5 | 2020-09-19 | An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the InlineArray implementation, an unaligned reference may be generated for a type… |
CVE-2020-25795 | High | 7.5 | 2020-09-19 | An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, insert_from can have a memory-safety issue upon a panic. |
CVE-2020-25794 | High | 7.5 | 2020-09-19 | An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, clone can have a memory-safety issue upon a panic. |
CVE-2020-25793 | High | 7.5 | 2020-09-19 | An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with From… |
CVE-2020-25792 | High | 7.5 | 2020-09-19 | An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with pair… |
CVE-2020-25791 | High | 7.5 | 2020-09-19 | An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with unit… |
CVE-2020-25790 | High | 7.2 | 2020-09-19 | Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the signi… |
CVE-2020-25789 | Medium | 6.1 | 2020-09-19 | An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. The cached_url feature mishandles JavaScript inside an SVG document. |
CVE-2020-25788 | High | 8.1 | 2020-09-19 | An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error mes… |
CVE-2020-25787 | Critical | 9.8 | 2020-09-19 | An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them. |
CVE-2020-25786 | Medium | 6.1 | 2020-09-19 | webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects… |
CVE-2020-5421 | Medium | 6.5 | 2020-09-19 | In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks… |
CVE-2020-8253 | High | 7.5 | 2020-09-18 | Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Cit… |
CVE-2020-8252 | High | 7.8 | 2020-09-18 | The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buf… |
CVE-2020-8251 | High | 7.5 | 2020-09-18 | Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new con… |
CVE-2020-8247 | High | 8.8 | 2020-09-18 | Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix… |
CVE-2020-8246 | High | 7.5 | 2020-09-18 | Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix… |
CVE-2020-8245 | Medium | 6.1 | 2020-09-18 | Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIP… |
CVE-2020-8237 | High | 7.5 | 2020-09-18 | Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack. |
CVE-2020-8225 | High | 7.5 | 2020-09-18 | A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials. |
CVE-2020-8201 | High | 7.4 | 2020-09-18 | Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted… |
CVE-2020-8200 | Medium | 6.5 | 2020-09-18 | Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Ci… |
CVE-2020-8158 | Critical | 9.8 | 2020-09-18 | Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service o… |
CVE-2020-11861 | High | 7.8 | 2020-09-18 | Unauthorized escalation of local privileges vulnerability on Micro Focus Operation Agent, affecting all versions prior to versions 12.11. The vulnerability cou… |
CVE-2020-9084 | Medium | 6.5 | 2020-09-18 | Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a use-after-free (UAF) vulnerability. An authenticated, local attacker may perform specific ope… |
CVE-2020-25633 | Medium | 5.3 | 2020-09-18 | A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive infor… |
CVE-2020-16230 | Low | 2.3 | 2020-09-18 | All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high pr… |
CVE-2020-7945 | Medium | 5.5 | 2020-09-18 | Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who should not have access… |
CVE-2020-3979 | High | 7.8 | 2020-09-18 | InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at initialization time, writable by non-admin us… |
CVE-2020-25766 | High | 7.5 | 2020-09-18 | An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page. |
CVE-2020-16247 | Medium | 6.8 | 2020-09-18 | Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, exposes a resource to the wrong control sphere, providing unintended actors with inappro… |
CVE-2020-16200 | Medium | 6.5 | 2020-09-18 | Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not properly control the allocation and maintenance of a limited resource, thereby… |
CVE-2020-16198 | Medium | 5.0 | 2020-09-18 | When an attacker claims to have a given identity, Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not prove or insufficiently prove… |
CVE-2020-15189 | Medium | 6.8 | 2020-09-18 | SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in C… |
CVE-2020-15181 | Critical | 9.3 | 2020-09-18 | The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using… |
CVE-2020-14525 | Low | 3.5 | 2020-09-18 | Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not neutralize or incorrectly neutralizes user-controllable input before it is placed… |
CVE-2020-14506 | Low | 3.4 | 2020-09-18 | Philips Clinical Collaboration Platform, Versions 12.2.1 and prior. The product receives input or data, but it does not validate or incorrectly validates that… |
CVE-2020-14390 | Medium | 5.6 | 2020-09-18 | A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruptio… |
CVE-2020-14029 | High | 7.5 | 2020-09-18 | An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an… |
CVE-2020-14021 | Medium | 4.9 | 2020-09-18 | An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The ASP.net SMS module can be used to read and validate the source code of ASP files. By alteri… |
CVE-2020-24623 | Medium | 6.5 | 2020-09-18 | A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be remotely exploited to… |
CVE-2020-15188 | Critical | 10.0 | 2020-09-18 | SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute any arbitrary code when the in… |
CVE-2020-0405 | High | 7.8 | 2020-09-18 | In NetworkStackNotifier, there is a possible permissions bypass due to an unsafe implicit PendingIntent. This could lead to local escalation of privilege with… |
CVE-2020-0365 | Medium | 5.5 | 2020-09-18 | In netd, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privile… |
CVE-2020-0350 | Medium | 6.7 | 2020-09-18 | In NFC, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2020-0349 | Medium | 4.4 | 2020-09-18 | In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2020-0348 | Medium | 4.9 | 2020-09-18 | In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over NFC with System execution p… |
CVE-2020-0347 | Medium | 6.7 | 2020-09-18 | In iptables, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2020-0335 | Medium | 6.7 | 2020-09-18 | In NFC, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2020-0334 | Medium | 6.7 | 2020-09-18 | In NFC, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2020-0331 | Medium | 5.5 | 2020-09-18 | In Settings, there is a possible permissions bypass. This could lead to local information disclosure of the device's IMEI with User execution privileges needed… |
CVE-2020-0327 | Medium | 5.5 | 2020-09-18 | In core networking, there is a missing permission check. This could lead to local information disclosure of app network usage with User execution privileges ne… |
CVE-2020-0326 | Medium | 6.7 | 2020-09-18 | In NFC, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2020-0325 | Medium | 4.4 | 2020-09-18 | In NFC, there is a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not neede… |
CVE-2020-0319 | High | 7.8 | 2020-09-18 | In NFC, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2020-0316 | Medium | 5.5 | 2020-09-18 | In Telephony, there is a missing permission check. This could lead to local information disclosure of radio data with no additional execution privileges needed… |
CVE-2020-0315 | Medium | 5.5 | 2020-09-18 | In Zen Mode, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileg… |
CVE-2020-0313 | Medium | 5.5 | 2020-09-18 | In NotificationManagerService, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User… |
CVE-2020-0311 | Medium | 5.5 | 2020-09-18 | In InputManagerService, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User executi… |
CVE-2020-0310 | Medium | 5.5 | 2020-09-18 | In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileg… |
CVE-2020-0309 | Medium | 6.7 | 2020-09-18 | In the Bluetooth server, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System privi… |
CVE-2020-0307 | Medium | 5.5 | 2020-09-18 | In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileg… |
CVE-2020-0304 | Medium | 5.5 | 2020-09-18 | In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileg… |
CVE-2020-0302 | Medium | 5.5 | 2020-09-18 | In Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileg… |
CVE-2020-0300 | High | 7.5 | 2020-09-18 | In NFC, there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure with no additional execution privile… |
CVE-2020-0299 | High | 7.8 | 2020-09-18 | In Bluetooth, there is a possible spoofing of bluetooth device metadata due to a missing permission check. This could lead to local escalation of privilege wit… |
CVE-2020-0298 | High | 7.8 | 2020-09-18 | In Bluetooth, there is a possible control over Bluetooth enabled state due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2020-0295 | Medium | 5.5 | 2020-09-18 | In Telecom, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privilege… |
CVE-2020-0294 | Medium | 5.5 | 2020-09-18 | In bindWallpaperComponentLocked of WallpaperManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local… |
CVE-2020-0292 | Medium | 4.4 | 2020-09-18 | In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2020-0291 | Medium | 4.4 | 2020-09-18 | In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privi… |
CVE-2020-0286 | High | 7.5 | 2020-09-18 | In Bluetooth AVRCP, there is a possible leak of audio metadata due to residual data. This could lead to remote information disclosure with no additional execut… |
CVE-2020-0285 | Medium | 5.5 | 2020-09-18 | In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execu… |
CVE-2020-0284 | Medium | 5.5 | 2020-09-18 | In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execu… |
CVE-2020-0282 | Medium | 4.5 | 2020-09-18 | In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure. System execution privileges, a… |
CVE-2020-0281 | Medium | 4.5 | 2020-09-18 | In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure. System execution privileges, a… |
CVE-2020-0276 | Medium | 5.5 | 2020-09-18 | In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execu… |
CVE-2020-0273 | High | 7.8 | 2020-09-18 | In hwservicemanager, there is a possible out of bounds write due to freeing a wild pointer. This could lead to local escalation of privilege with no additional… |
CVE-2020-0272 | Medium | 4.4 | 2020-09-18 | In libhwbinder, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution pri… |
CVE-2020-0271 | High | 7.3 | 2020-09-18 | In the Settings app, there is an insecure default value. This could lead to local escalation of privilege and tapjacking with User execution privileges needed… |
CVE-2020-0269 | Medium | 5.5 | 2020-09-18 | In Android Auto Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execu… |
CVE-2020-0268 | Medium | 6.4 | 2020-09-18 | In NFC, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2020-0265 | Medium | 5.5 | 2020-09-18 | In Telephony, there are possible leaks of sensitive data due to missing permission checks. This could lead to local information disclosure with no additional e… |
CVE-2020-0263 | Medium | 5.5 | 2020-09-18 | In the Accessibility service, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User e… |