2020 CVE Vulnerabilities
21,086 CVEs published in 2020.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2020-29254 | HIGH | 8.8 | 1.5% | Dec 11, 2020 | TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacke... |
| CVE-2020-27508 | HIGH | 7.5 | 1.3% | Dec 11, 2020 | In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach th... |
| CVE-2020-15357 | CRITICAL | 9.8 | 4.2% | Dec 11, 2020 | Network Analysis functionality in Askey AP5100W_Dual_SIG_1.01.097 and all prior versions allows remote attackers to exec... |
| CVE-2020-15023 | MEDIUM | 5.9 | 1.6% | Dec 11, 2020 | Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking. This arise... |
| CVE-2020-12149 | MEDIUM | 6.8 | 1.3% | Dec 11, 2020 | The configuration backup/restore function in Silver Peak Unity ECOSTM (ECOS) appliance software was found to directly in... |
| CVE-2020-12148 | MEDIUM | 6.8 | 2.1% | Dec 11, 2020 | A command injection flaw identified in the nslookup API in Silver Peak Unity ECOSTM (ECOS) appliance software could allo... |
| CVE-2020-4633 | HIGH | 8.8 | 2.7% | Dec 11, 2020 | IBM Resilient SOAR V38.0 could allow a remote attacker to execute arbitrary code on the system, caused by formula inject... |
| CVE-2020-29591 | CRITICAL | 9.8 | 2.6% | Dec 11, 2020 | Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deploy... |
| CVE-2020-29590 | — | — | — | Dec 11, 2020 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-5021. Reason: This candidate is a reservation du... |
| CVE-2020-28838 | LOW | 3.5 | 0.4% | Dec 11, 2020 | Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items... |
| CVE-2020-7793 | HIGH | 7.5 | 3.9% | Dec 11, 2020 | The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexe... |
| CVE-2020-17515 | MEDIUM | 6.1 | 16.0% | Dec 11, 2020 | The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects... |
| CVE-2020-7792 | HIGH | 7.5 | 2.1% | Dec 11, 2020 | This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively',... |
| CVE-2020-7790 | MEDIUM | 5.3 | 1.0% | Dec 11, 2020 | This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able ... |
| CVE-2020-7788 | CRITICAL | 9.8 | 3.7% | Dec 11, 2020 | This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it ... |
| CVE-2020-7789 | MEDIUM | 5.6 | 1.6% | Dec 11, 2020 | This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines d... |
| CVE-2020-35135 | HIGH | 8.8 | 0.9% | Dec 11, 2020 | The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF. |
| CVE-2020-35132 | MEDIUM | 5.4 | 1.3% | Dec 11, 2020 | An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be ... |
| CVE-2020-35127 | MEDIUM | 5.4 | 0.6% | Dec 11, 2020 | Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS. |
| CVE-2020-27786 | HIGH | 7.8 | 1.7% | Dec 11, 2020 | A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permission... |
| CVE-2020-26411 | MEDIUM | 4.3 | 1.2% | Dec 11, 2020 | A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 t... |
| CVE-2020-35126 | MEDIUM | 4.8 | 0.7% | Dec 11, 2020 | Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI... |
| CVE-2020-27828 | HIGH | 7.8 | 1.4% | Dec 11, 2020 | There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker coul... |
| CVE-2020-26417 | MEDIUM | 5.3 | 1.2% | Dec 11, 2020 | Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This aff... |
| CVE-2020-26416 | MEDIUM | 4.4 | 0.3% | Dec 11, 2020 | Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms v... |
Check if your code is affected by 2020 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now