2020 CVE Vulnerabilities
21,086 CVEs published in 2020.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2020-12135 | MEDIUM | 5.5 | 1.2% | Apr 24, 2020 | bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular... |
| CVE-2020-12132 | MEDIUM | 6.1 | 0.7% | Apr 24, 2020 | Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request. |
| CVE-2020-12131 | MEDIUM | 6.1 | 0.7% | Apr 24, 2020 | The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo). |
| CVE-2020-12130 | MEDIUM | 6.1 | 0.7% | Apr 24, 2020 | The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function. |
| CVE-2020-12129 | MEDIUM | 6.1 | 0.7% | Apr 24, 2020 | The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function. |
| CVE-2020-8798 | MEDIUM | 5.5 | 0.4% | Apr 23, 2020 | httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the... |
| CVE-2020-5866 | MEDIUM | 5.5 | 0.3% | Apr 23, 2020 | In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to ch... |
| CVE-2020-5865 | MEDIUM | 4.8 | 0.4% | Apr 23, 2020 | In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over une... |
| CVE-2020-8797 | MEDIUM | 6.7 | 0.9% | Apr 23, 2020 | Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux subsystem via an unsanitized exec call ... |
| CVE-2020-7132 | MEDIUM | 5.4 | 0.7% | Apr 23, 2020 | A potential security vulnerability has been identified in HPE Onboard Administrator. The vulnerability could be remotely... |
| CVE-2020-12113 | MEDIUM | 6.1 | 0.9% | Apr 23, 2020 | BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used. |
| CVE-2020-12105 | MEDIUM | 5.9 | 1.7% | Apr 23, 2020 | OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers... |
| CVE-2020-7643 | MEDIUM | 5.3 | 1.0% | Apr 23, 2020 | paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function c... |
| CVE-2020-4353 | MEDIUM | 4.6 | 0.3% | Apr 23, 2020 | IBM MaaS360 6.82 could allow a user with pysical access to the device to crash the application which may enable the user... |
| CVE-2020-1760 | MEDIUM | 6.1 | 1.5% | Apr 23, 2020 | A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw... |
| CVE-2020-12054 | MEDIUM | 6.1 | 3.6% | Apr 23, 2020 | The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also a... |
| CVE-2020-11806 | MEDIUM | 5.9 | 0.5% | Apr 23, 2020 | In MailStore Outlook Add-in (and Email Archive Outlook Add-in) through 12.1.2, the login process does not validate the v... |
| CVE-2020-12071 | MEDIUM | 4.8 | 0.6% | Apr 23, 2020 | Anchor 0.12.7 allows admins to cause XSS via crafted post content. |
| CVE-2020-8833 | MEDIUM | 4.7 | 0.3% | Apr 22, 2020 | Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible ... |
| CVE-2020-8831 | MEDIUM | 5.5 | 0.7% | Apr 22, 2020 | Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the a... |
| CVE-2020-1983 | MEDIUM | 6.5 | 2.3% | Apr 22, 2020 | A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets t... |
| CVE-2020-11649 | MEDIUM | 6.5 | 0.8% | Apr 22, 2020 | An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the gr... |
| CVE-2020-7642 | MEDIUM | 5.4 | 0.9% | Apr 22, 2020 | lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the vide... |
| CVE-2020-4085 | MEDIUM | 6.5 | 0.8% | Apr 22, 2020 | "HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace ... |
| CVE-2020-11938 | MEDIUM | 4.9 | 0.9% | Apr 22, 2020 | In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters use... |
Check if your code is affected by 2020 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now