2020 CVE Vulnerabilities
21,085 CVEs published in 2020.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2020-10710 | MEDIUM | 4.4 | 0.2% | Aug 16, 2022 | A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satell... |
| CVE-2020-23622 | HIGH | 7.5 | 1.0% | Aug 15, 2022 | An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service ... |
| CVE-2020-21642 | CRITICAL | 9.8 | 7.7% | Aug 15, 2022 | Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus befo... |
| CVE-2020-21641 | HIGH | 7.5 | 4.3% | Aug 15, 2022 | Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote a... |
| CVE-2020-21365 | HIGH | 7.5 | 1.8% | Aug 15, 2022 | Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose... |
| CVE-2020-1754 | MEDIUM | 4.3 | 0.5% | Aug 5, 2022 | In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' ... |
| CVE-2020-1691 | MEDIUM | 5.4 | 0.5% | Aug 5, 2022 | In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stor... |
| CVE-2020-7795 | CRITICAL | 9.8 | 3.7% | Aug 2, 2022 | The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js. |
| CVE-2020-28453 | CRITICAL | 9.8 | 1.1% | Aug 2, 2022 | This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js. |
| CVE-2020-28451 | CRITICAL | 9.8 | 1.2% | Aug 2, 2022 | This affects the package image-tiler before 2.0.2. |
| CVE-2020-28437 | CRITICAL | 9.8 | 1.1% | Aug 2, 2022 | This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index... |
| CVE-2020-28434 | CRITICAL | 9.8 | 1.1% | Aug 2, 2022 | This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js. |
| CVE-2020-28433 | CRITICAL | 9.8 | 0.8% | Aug 2, 2022 | This affects all versions of package node-latex-pdf. |
| CVE-2020-28425 | CRITICAL | 9.8 | 0.8% | Aug 2, 2022 | This affects all versions of package curljs. |
| CVE-2020-28424 | CRITICAL | 9.8 | 0.7% | Aug 2, 2022 | This affects all versions of package s3-kilatstorage. |
| CVE-2020-28423 | CRITICAL | 9.8 | 1.1% | Aug 2, 2022 | This affects all versions of package monorepo-build. |
| CVE-2020-6998 | HIGH | 8.6 | 1.7% | Jul 27, 2022 | The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 ... |
| CVE-2020-36290 | MEDIUM | 5.4 | 0.6% | Jul 26, 2022 | The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and fro... |
| CVE-2020-7678 | CRITICAL | 9.8 | 0.9% | Jul 25, 2022 | This affects all versions of package node-import. The "params" argument of module function can be controlled by users wi... |
| CVE-2020-7677 | CRITICAL | 9.8 | 1.6% | Jul 25, 2022 | This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users with... |
| CVE-2020-7649 | MEDIUM | 4.9 | 1.4% | Jul 25, 2022 | This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's inter... |
| CVE-2020-28471 | CRITICAL | 9.8 | 1.1% | Jul 25, 2022 | This affects the package properties-reader before 2.2.0. |
| CVE-2020-28462 | CRITICAL | 9.8 | 0.8% | Jul 25, 2022 | This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that pars... |
| CVE-2020-28461 | CRITICAL | 9.8 | 1.0% | Jul 25, 2022 | This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses ... |
| CVE-2020-28459 | MEDIUM | 6.1 | 0.5% | Jul 25, 2022 | This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx fo... |
Check if your code is affected by 2020 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now