2020 CVE Vulnerabilities
21,086 CVEs published in 2020.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2020-28053 | MEDIUM | 6.5 | 1.4% | Nov 23, 2020 | HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read th... |
| CVE-2020-5797 | MEDIUM | 6.1 | 0.6% | Nov 21, 2020 | UNIX Symbolic Link (Symlink) Following in TP-Link Archer C9(US)_V1_180125 firmware allows an unauthenticated actor, with... |
| CVE-2020-25725 | MEDIUM | 5.5 | 1.0% | Nov 21, 2020 | In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3Glyph... |
| CVE-2020-20739 | MEDIUM | 5.3 | 2.0% | Nov 20, 2020 | im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may c... |
| CVE-2020-28974 | MEDIUM | 5 | 0.5% | Nov 20, 2020 | A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged ... |
| CVE-2020-7842 | MEDIUM | 6.6 | 1.5% | Nov 20, 2020 | Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection an... |
| CVE-2020-19668 | MEDIUM | 6.5 | 0.9% | Nov 20, 2020 | Unverified indexs into the array lead to out of bound access in the gif_out_code function in fromgif.c in libsixel 1.8.6... |
| CVE-2020-4788 | MEDIUM | 4.7 | 0.4% | Nov 20, 2020 | IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the dat... |
| CVE-2020-7573 | MEDIUM | 6.5 | 1.4% | Nov 19, 2020 | A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that cou... |
| CVE-2020-7571 | MEDIUM | 5.4 | 0.8% | Nov 19, 2020 | A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerabi... |
| CVE-2020-7570 | MEDIUM | 5.4 | 0.8% | Nov 19, 2020 | A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists ... |
| CVE-2020-7568 | MEDIUM | 4.3 | 0.5% | Nov 19, 2020 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all referenc... |
| CVE-2020-7567 | MEDIUM | 5.7 | 0.2% | Nov 19, 2020 | A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that... |
| CVE-2020-28954 | MEDIUM | 5.3 | 1.2% | Nov 19, 2020 | web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrate... |
| CVE-2020-28953 | MEDIUM | 4.3 | 0.7% | Nov 19, 2020 | In BigBlueButton before 2.2.29, a user can vote more than once in a single poll. |
| CVE-2020-28350 | MEDIUM | 6.1 | 0.7% | Nov 19, 2020 | A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ... |
| CVE-2020-28210 | MEDIUM | 6.1 | 0.9% | Nov 19, 2020 | A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoS... |
| CVE-2020-28941 | MEDIUM | 5.5 | 0.3% | Nov 19, 2020 | An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers ... |
| CVE-2020-28947 | MEDIUM | 6.1 | 0.8% | Nov 19, 2020 | In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled. |
| CVE-2020-22394 | MEDIUM | 6.1 | 0.7% | Nov 19, 2020 | In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. |
| CVE-2020-12496 | MEDIUM | 6.5 | 0.8% | Nov 19, 2020 | Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45... |
| CVE-2020-28942 | MEDIUM | 4.3 | 0.4% | Nov 19, 2020 | An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protoc... |
| CVE-2020-25703 | MEDIUM | 5.3 | 1.5% | Nov 19, 2020 | The participants table download in Moodle always included user emails, but should have only done so when users' emails a... |
| CVE-2020-25702 | MEDIUM | 6.1 | 1.3% | Nov 19, 2020 | In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. Thi... |
| CVE-2020-25701 | MEDIUM | 5.3 | 1.4% | Nov 19, 2020 | If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabl... |
Check if your code is affected by 2020 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now