2020 CVE Vulnerabilities
21,086 CVEs published in 2020.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2020-29160 | HIGH | 7.5 | 0.9% | Dec 28, 2020 | An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a wa... |
| CVE-2020-29159 | MEDIUM | 4.9 | 0.9% | Dec 28, 2020 | An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a privileged Ro... |
| CVE-2020-29158 | MEDIUM | 4.3 | 0.7% | Dec 28, 2020 | An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access... |
| CVE-2020-26035 | MEDIUM | 5.4 | 0.5% | Dec 28, 2020 | An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket. |
| CVE-2020-26034 | MEDIUM | 4.3 | 0.7% | Dec 28, 2020 | An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a wa... |
| CVE-2020-26033 | MEDIUM | 5.4 | 0.4% | Dec 28, 2020 | An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and delete) lack a CSRF tok... |
| CVE-2020-26032 | HIGH | 7.5 | 1.1% | Dec 28, 2020 | An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in... |
| CVE-2020-26031 | MEDIUM | 4.3 | 0.6% | Dec 28, 2020 | An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base ... |
| CVE-2020-26030 | CRITICAL | 9.8 | 1.3% | Dec 28, 2020 | An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted head... |
| CVE-2020-26029 | MEDIUM | 6.5 | 0.8% | Dec 28, 2020 | An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On... |
| CVE-2020-26028 | MEDIUM | 4.9 | 0.9% | Dec 28, 2020 | An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets. |
| CVE-2020-29194 | HIGH | 7.5 | 1.2% | Dec 28, 2020 | Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel (which will require a phy... |
| CVE-2020-29193 | MEDIUM | 6.8 | 0.4% | Dec 28, 2020 | Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which is just the asdf keyboa... |
| CVE-2020-28096 | MEDIUM | 6.8 | 0.5% | Dec 28, 2020 | FOSCAM FHD X1 1.14.2.4 devices allow attackers (with physical UART access) to login via the ipc.fos~ password. |
| CVE-2020-28094 | HIGH | 7.5 | 1.2% | Dec 28, 2020 | On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, the default settings for the router speed test contain links to d... |
| CVE-2020-28093 | HIGH | 7.2 | 1.2% | Dec 28, 2020 | On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, admin, support, user, and nobody have a password of 1234. |
| CVE-2020-35738 | MEDIUM | 6.1 | 1.2% | Dec 28, 2020 | WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a mallo... |
| CVE-2020-35736 | HIGH | 7.5 | 15.4% | Dec 27, 2020 | GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.... |
| CVE-2020-29156 | MEDIUM | 5.3 | 4.0% | Dec 27, 2020 | The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the... |
| CVE-2020-29250 | MEDIUM | 6.1 | 0.7% | Dec 27, 2020 | CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php. |
| CVE-2020-29249 | MEDIUM | 6.1 | 0.7% | Dec 27, 2020 | CXUUCMS V3 allows class="layui-input" XSS. |
| CVE-2020-29299 | HIGH | 7.2 | 2.3% | Dec 27, 2020 | Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change a... |
| CVE-2020-29204 | MEDIUM | 6.1 | 0.9% | Dec 27, 2020 | XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/j... |
| CVE-2020-35729 | CRITICAL | 9.8 | 88.0% | Dec 27, 2020 | KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter. |
| CVE-2020-35728 | HIGH | 8.1 | 12.5% | Dec 27, 2020 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela... |
Check if your code is affected by 2020 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now