Vulnerabilities (CVE)

1,704 pages, showing 601–700, ordered by identifier.

CVE-2020-11651 — SaltStack Salt Authentication Bypass Vulnerability SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to...
CVE-2020-11652 — SaltStack Salt Path Traversal Vulnerability SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory...
CVE-2020-11738 — WordPress Snap Creek Duplicator Plugin File Download Vulnerability WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new...
CVE-2020-11899 — Treck TCP/IP stack Out-of-Bounds Read Vulnerability The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability.
CVE-2020-11978 — Apache Airflow Command Injection A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
CVE-2020-12271 — Sophos SFOS SQL Injection Vulnerability Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either...
CVE-2020-12641 — Roundcube Webmail Remote Code Execution Vulnerability Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell...
CVE-2020-12812 — Fortinet FortiOS SSL VPN Improper Authentication Vulnerability Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login...
CVE-2020-1350 — Microsoft Windows DNS Server Remote Code Execution Vulnerability Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code...
CVE-2020-13671 — Drupal core Un-restricted Upload of File Improper sanitization in the extension file names is present in Drupal core.
CVE-2020-1380 — Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in...
CVE-2020-13927 — Apache Airflow's Experimental API Authentication Bypass The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
CVE-2020-13965 — Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate...
CVE-2020-1464 — Microsoft Windows Spoofing Vulnerability Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an...
CVE-2020-14644 — Oracle WebLogic Server Remote Code Execution Vulnerability Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability....
CVE-2020-1472 — Microsoft Netlogon Privilege Escalation Vulnerability Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker...
CVE-2020-14750 — Oracle WebLogic Server Remote Code Execution Vulnerability Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote...
CVE-2020-14864 — Oracle Business Intelligence Enterprise Edition Path Transversal Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage...
CVE-2020-14871 — Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to...
CVE-2020-14882 — Oracle WebLogic Server Remote Code Execution Vulnerability Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution,...
CVE-2020-14883 — Oracle WebLogic Server Unspecified Vulnerability Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to...
CVE-2020-15069 — Sophos XG Firewall Buffer Overflow Vulnerability Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S...
CVE-2020-15415 — DrayTek Multiple Vigor Routers OS Command Injection Vulnerability DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in...
CVE-2020-15505 — Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an...
CVE-2020-15999 — Google Chrome FreeType Heap Buffer Overflow Vulnerability Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow...
CVE-2020-16009 — Google Chromium V8 Type Confusion Vulnerability Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially...
CVE-2020-16010 — Google Chrome for Android UI Heap Buffer Overflow Vulnerability Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has...
CVE-2020-16013 — Google Chromium V8 Incorrect Implementation Vulnerabililty Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to...
CVE-2020-16017 — Google Chrome Use-After-Free Vulnerability Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the...
CVE-2020-1631 — Juniper Junos OS Path Traversal Vulnerability A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN),...
CVE-2020-16846 — SaltStack Salt Shell Injection Vulnerability SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run...
CVE-2020-17087 — Microsoft Windows Kernel Privilege Escalation Vulnerability Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.
CVE-2020-17144 — Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.
CVE-2020-17463 — Fuel CMS SQL Injection Vulnerability FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
CVE-2020-17496 — vBulletin PHP Module Remote Code Execution Vulnerability The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via...
CVE-2020-17519 — Apache Flink Improper Access Control Vulnerability Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local...
CVE-2020-17530 — Apache Struts Remote Code Execution Vulnerability Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag...
CVE-2020-1938 — Apache Tomcat Improper Privilege Management Vulnerability Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar...
CVE-2020-1956 — Apache Kylin OS Command Injection Vulnerability Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
CVE-2020-2021 — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
CVE-2020-24363 — TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could...
CVE-2020-24557 — Trend Micro Multiple Products Improper Access Control Vulnerability Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access...
CVE-2020-2506 — QNAP Helpdesk Improper Access Control Vulnerability QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or...
CVE-2020-25078 — D-Link DCS-2530L and DCS-2670L Devices Unspecified Vulnerability D-Link DCS-2530L and DCS-2670L devices contains an unspecified vulnerability that could allow for remote...
CVE-2020-25079 — D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability D-Link DCS-2530L and DCS-2670L devices contains a command injection vulnerability in the cgi-bin/ddns_enc.cgi. The...
CVE-2020-2509 — QNAP Network-Attached Storage (NAS) Command Injection Vulnerability QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
CVE-2020-25213 — WordPress File Manager Plugin Remote Code Execution Vulnerability WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to...
CVE-2020-25223 — Sophos SG UTM Remote Code Execution Vulnerability A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
CVE-2020-25506 — D-Link DNS-320 Device Command Injection Vulnerability D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for...
CVE-2020-2551 — Oracle Fusion Middleware Unspecified Vulnerability Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an...
CVE-2020-2555 — Oracle Multiple Products Remote Code Execution Vulnerability Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with...
CVE-2020-26919 — Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability Netgear JGS516PE devices contain a missing function level access control vulnerability.
CVE-2020-27930 — Apple Multiple Products Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code...
CVE-2020-27932 — Apple Multiple Products Type Confusion Vulnerability Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application...
CVE-2020-27950 — Apple Multiple Products Memory Initialization Vulnerability Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious...
CVE-2020-2883 — Oracle WebLogic Server Unspecified Vulnerability Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability...
CVE-2020-28949 — PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for...
CVE-2020-29557 — D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote...
CVE-2020-29574 — CyberoamOS (CROS) SQL Injection Vulnerability CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to...
CVE-2020-29583 — Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials...
CVE-2020-3118 — Cisco IOS XR Software Discovery Protocol Format String Vulnerability Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages....
CVE-2020-3153 — Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker...
CVE-2020-3161 — Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an...
CVE-2020-3259 — Cisco ASA and FTD Information Disclosure Vulnerability Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure...
CVE-2020-3433 — Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient...
CVE-2020-3452 — Cisco ASA and FTD Read-Only Path Traversal Vulnerability Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an improper input validation...
CVE-2020-3566 — Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management...
CVE-2020-3569 — Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management...
CVE-2020-35730 — Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text...
CVE-2020-3580 — Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation...
CVE-2020-36193 — PEAR Archive_Tar Improper Link Resolution Vulnerability PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic...
CVE-2020-3837 — Apple Multiple Products Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an...
CVE-2020-3950 — VMware Multiple Products Privilege Escalation Vulnerability VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation...
CVE-2020-3952 — VMware vCenter Server Information Disclosure Vulnerability VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when...
CVE-2020-3992 — VMware ESXi OpenSLP Use-After-Free Vulnerability VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management...
CVE-2020-4006 — Multiple VMware Products Command Injection Vulnerability VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command...
CVE-2020-4427 — IBM Data Risk Manager Security Bypass Vulnerability IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security...
CVE-2020-4428 — IBM Data Risk Manager Remote Code Execution Vulnerability IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to...
CVE-2020-4430 — IBM Data Risk Manager Directory Traversal Vulnerability IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker...
CVE-2020-5135 — SonicWall SonicOS Buffer Overflow Vulnerability A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially...
CVE-2020-5410 — VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve...
CVE-2020-5722 — Grandstream Networks UCM6200 Series SQL Injection Vulnerability Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request....
CVE-2020-5735 — Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability Amcrest cameras and NVR contain a stack-based buffer overflow vulnerability through port 37777 that allows an...
CVE-2020-5741 — Plex Media Server Remote Code Execution Vulnerability Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server...
CVE-2020-5847 — Unraid Remote Code Execution Vulnerability Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute...
CVE-2020-5849 — Unraid Authentication Bypass Vulnerability Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative...
CVE-2020-5902 — F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.
CVE-2020-6207 — SAP Solution Manager Missing Authentication for Critical Function Vulnerability SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function...
CVE-2020-6287 — SAP NetWeaver Missing Authentication for Critical Function Vulnerability SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function...
CVE-2020-6418 — Google Chromium V8 Type Confusion Vulnerability Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit...
CVE-2020-6572 — Google Chrome Media Use-After-Free Vulnerability Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a...
CVE-2020-6819 — Mozilla Firefox And Thunderbird Use-After-Free Vulnerability Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under...
CVE-2020-6820 — Mozilla Firefox And Thunderbird Use-After-Free Vulnerability Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain...
CVE-2020-7247 — OpenSMTPD Remote Code Execution Vulnerability smtpmailaddr in smtpsession.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to...
CVE-2020-7796 — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet...
CVE-2020-7961 — Liferay Portal Deserialization of Untrusted Data Vulnerability Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute...
CVE-2020-8193 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass...
CVE-2020-8195 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure...
CVE-2020-8196 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure...
CVE-2020-8218 — Pulse Connect Secure Code Injection Vulnerability A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an...

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.