2020 CVE Vulnerabilities
21,086 CVEs published in 2020.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2020-25843 | CRITICAL | 9.8 | 1.9% | Dec 31, 2020 | NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole... |
| CVE-2020-25842 | HIGH | 7.5 | 0.5% | Dec 31, 2020 | The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access a... |
| CVE-2020-19664 | HIGH | 8.8 | 5.3% | Dec 31, 2020 | DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.... |
| CVE-2020-17363 | CRITICAL | 9.9 | 4.4% | Dec 31, 2020 | USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or n... |
| CVE-2020-16132 | — | — | — | Dec 31, 2020 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-24240. Reason: This candidate is a reservation d... |
| CVE-2020-13654 | HIGH | 7.5 | 1.9% | Dec 31, 2020 | XWiki Platform before 12.8 mishandles escaping in the property displayer. |
| CVE-2020-12658 | CRITICAL | 9.8 | 1.7% | Dec 31, 2020 | gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c... |
| CVE-2020-11947 | LOW | 3.8 | 0.5% | Dec 31, 2020 | iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated informat... |
| CVE-2020-26291 | MEDIUM | 6.5 | 1.7% | Dec 31, 2020 | URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be sp... |
| CVE-2020-27534 | MEDIUM | 5.3 | 1.7% | Dec 30, 2020 | util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-ch... |
| CVE-2020-26296 | HIGH | 8.7 | 1.4% | Dec 30, 2020 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization design... |
| CVE-2020-28413 | MEDIUM | 6.5 | 4.9% | Dec 30, 2020 | In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the A... |
| CVE-2020-28095 | HIGH | 7.5 | 1.2% | Dec 30, 2020 | On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will tr... |
| CVE-2020-11103 | CRITICAL | 9.8 | 2.7% | Dec 30, 2020 | JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution. |
| CVE-2020-35737 | HIGH | 7.5 | 10.3% | Dec 30, 2020 | In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information... |
| CVE-2020-35173 | CRITICAL | 9.8 | 1.7% | Dec 30, 2020 | The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP s... |
| CVE-2020-26288 | MEDIUM | 6.5 | 0.8% | Dec 30, 2020 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm pac... |
| CVE-2020-35849 | HIGH | 7.5 | 1.6% | Dec 30, 2020 | An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bug_revision_view_page.php allows an unp... |
| CVE-2020-29231 | MEDIUM | 5.4 | 0.6% | Dec 30, 2020 | EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the A... |
| CVE-2020-29230 | MEDIUM | 6.1 | 0.8% | Dec 30, 2020 | EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the A... |
| CVE-2020-29228 | HIGH | 7.5 | 1.2% | Dec 30, 2020 | EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Pag... |
| CVE-2020-28925 | MEDIUM | 5.3 | 1.1% | Dec 30, 2020 | Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with ... |
| CVE-2020-28736 | HIGH | 8.8 | 1.1% | Dec 30, 2020 | Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.M... |
| CVE-2020-28735 | HIGH | 8.8 | 1.1% | Dec 30, 2020 | Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). |
| CVE-2020-28734 | HIGH | 8.8 | 1.1% | Dec 30, 2020 | Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. |
Check if your code is affected by 2020 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now