2020 CVE Vulnerabilities
21,141 CVEs published in 2020.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2020-2077 | HIGH | 7.5 | 1.0% | Jul 29, 2020 | SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions ... |
| CVE-2020-2076 | CRITICAL | 9.8 | 1.3% | Jul 29, 2020 | SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by direct... |
| CVE-2020-14488 | HIGH | 8.8 | 1.7% | Jul 29, 2020 | OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to uplo... |
| CVE-2020-14487 | CRITICAL | 9.8 | 2.2% | Jul 29, 2020 | OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly ... |
| CVE-2020-14486 | HIGH | 8.8 | 1.3% | Jul 29, 2020 | An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of... |
| CVE-2020-9692 | MEDIUM | 6.5 | 3.8% | Jul 29, 2020 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Success... |
| CVE-2020-9691 | CRITICAL | 9.6 | 6.0% | Jul 29, 2020 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Suc... |
| CVE-2020-9690 | MEDIUM | 4.2 | 1.6% | Jul 29, 2020 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Suc... |
| CVE-2020-9689 | MEDIUM | 6.5 | 4.1% | Jul 29, 2020 | Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploita... |
| CVE-2020-7698 | CRITICAL | 9.8 | 1.7% | Jul 29, 2020 | This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endp... |
| CVE-2020-7697 | CRITICAL | 9.8 | 2.0% | Jul 29, 2020 | This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affec... |
| CVE-2020-14493 | HIGH | 8.8 | 1.7% | Jul 29, 2020 | A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which... |
| CVE-2020-14492 | MEDIUM | 6.1 | 1.2% | Jul 29, 2020 | OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution o... |
| CVE-2020-14490 | HIGH | 8.8 | 2.5% | Jul 29, 2020 | OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files... |
| CVE-2020-14489 | HIGH | 7.5 | 1.0% | Jul 29, 2020 | OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to ... |
| CVE-2020-5614 | MEDIUM | 5.3 | 2.2% | Jul 29, 2020 | Directory traversal vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to read arbitrary files via unsp... |
| CVE-2020-5613 | MEDIUM | 6.1 | 1.1% | Jul 29, 2020 | Cross-site scripting vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to execute an arbitrary script ... |
| CVE-2020-5612 | MEDIUM | 6.1 | 1.1% | Jul 29, 2020 | Cross-site scripting vulnerability in KonaWiki 2.2.0 and earlier allows remote attackers to execute an arbitrary script ... |
| CVE-2020-6098 | HIGH | 7.5 | 1.8% | Jul 28, 2020 | An exploitable denial of service vulnerability exists in the freeDiameter functionality of freeDiameter 1.3.2. A special... |
| CVE-2020-13997 | HIGH | 7.5 | 1.5% | Jul 28, 2020 | In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and v... |
| CVE-2020-13971 | MEDIUM | 5.4 | 0.6% | Jul 28, 2020 | In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG image... |
| CVE-2020-13970 | HIGH | 8.8 | 1.3% | Jul 28, 2020 | Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature.... |
| CVE-2020-11476 | HIGH | 7.2 | 2.9% | Jul 28, 2020 | Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file. |
| CVE-2020-11474 | HIGH | 7.8 | 0.5% | Jul 28, 2020 | NCP Secure Enterprise Client before 10.15 r47589 allows a symbolic link attack on enumusb.reg via Support Assistant. |
| CVE-2020-10985 | MEDIUM | 4.8 | 0.6% | Jul 28, 2020 | Gambio GX before 4.0.1.0 allows XSS in admin/coupon_admin.php. |
Check if your code is affected by 2020 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now