2020 CVE Vulnerabilities
21,141 CVEs published in 2020.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2020-4209 | MEDIUM | 5.4 | 1.4% | May 4, 2020 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An ... |
| CVE-2020-12639 | MEDIUM | 6.1 | 0.7% | May 4, 2020 | phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php. |
| CVE-2020-12475 | MEDIUM | 5.5 | 0.6% | May 4, 2020 | TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via com.tp_link.eap.web.p... |
| CVE-2020-12110 | CRITICAL | 9.8 | 14.4% | May 4, 2020 | Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304,... |
| CVE-2020-11671 | HIGH | 8.1 | 1.1% | May 4, 2020 | Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid... |
| CVE-2020-11462 | HIGH | 7.5 | 1.3% | May 4, 2020 | An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interf... |
| CVE-2020-11443 | HIGH | 8.1 | 1.5% | May 4, 2020 | The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoo... |
| CVE-2020-10876 | HIGH | 7.5 | 1.1% | May 4, 2020 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its tim... |
| CVE-2020-10187 | HIGH | 7.5 | 2.0% | May 4, 2020 | Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve ... |
| CVE-2020-1961 | CRITICAL | 9.8 | 4.6% | May 4, 2020 | Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1... |
| CVE-2020-1959 | CRITICAL | 9.8 | 4.8% | May 4, 2020 | A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary ... |
| CVE-2020-12629 | MEDIUM | 5.4 | 1.5% | May 4, 2020 | include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name. |
| CVE-2020-11842 | HIGH | 7.5 | 1.1% | May 4, 2020 | Information disclosure vulnerability in Micro Focus Verastream Host Integrator (VHI) product, affecting versions earlier... |
| CVE-2020-8018 | HIGH | 7.8 | 0.3% | May 4, 2020 | A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST-BYOS and SLES15-SP1-CAP-Deployment-BYOS images of ... |
| CVE-2020-12114 | MEDIUM | 4.7 | 0.4% | May 4, 2020 | A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x bef... |
| CVE-2020-1631 | CRITICAL | 9.8 | 4.7% | May 4, 2020 | A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication... |
| CVE-2020-12627 | CRITICAL | 9.8 | 1.4% | May 4, 2020 | Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key. |
| CVE-2020-12626 | MEDIUM | 6.5 | 1.8% | May 4, 2020 | An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged ou... |
| CVE-2020-12625 | MEDIUM | 6.1 | 2.8% | May 4, 2020 | An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_... |
| CVE-2020-12624 | MEDIUM | 6.5 | 1.3% | May 3, 2020 | The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary... |
| CVE-2020-8157 | MEDIUM | 6.8 | 0.3% | May 2, 2020 | UniFi Cloud Key firmware <= v1.1.10 for Cloud Key gen2 and Cloud Key gen2 Plus contains a vulnerability that allows unre... |
| CVE-2020-7645 | CRITICAL | 9.8 | 1.0% | May 2, 2020 | All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in ... |
| CVE-2020-5727 | MEDIUM | 4.6 | 0.4% | May 2, 2020 | Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated ... |
| CVE-2020-10683 | CRITICAL | 9.8 | 7.3% | May 1, 2020 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE ... |
| CVE-2020-7351 | HIGH | 8.8 | 65.2% | May 1, 2020 | An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allo... |
Check if your code is affected by 2020 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now