Vulnerabilities published in 2020
21,460 vulnerabilities were published in 2020: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 34 of 215.
- CVE-2020-8171 Command injection in AirMax AirOS for TI, XW and XM boards
- CVE-2020-8170 Cross-site scripting in AirMax AirOS for TI, XW and XM boards
- CVE-2020-8169 Information disclosure in https://github.com/curl/curl
- CVE-2020-8168 Cross-site request forgery in AirMax AirOS for TI, XW and XM boards
- CVE-2020-8167 CSRF Vulnerability in rails-ujs
- CVE-2020-8166 Ability to forge per-form CSRF tokens in Rails
- CVE-2020-8165 ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
- CVE-2020-8164 Possible Strong Parameters Bypass in ActionPack
- CVE-2020-8163 Remote code execution via user-provided local names in ActionView
- CVE-2020-8162 Circumvention of file size limits in ActiveStorage
- CVE-2020-8161 Directory traversal in Rack::Directory app bundled with Rack
- CVE-2020-8160 Cross-site scripting in MendixSSO
- CVE-2020-8159 Arbitrary file write in actionpack-page_caching gem
- CVE-2020-8158 TypeORM vulnerable to MAID and Prototype Pollution
- CVE-2020-8157 Auth bypass in UniFi Cloud Key Gen2, Cloud Key Gen2 plus
- CVE-2020-8156 Security feature bypass in Nextcloud Mail
- CVE-2020-8155 Cross-site scripting in Nextcloud Server
- CVE-2020-8154 Missing authorization in Nextcloud Server
- CVE-2020-8153 Missing authorization in Nextcloud Groupfolders
- CVE-2020-8152 Weak cryptography in Nextcloud Server
- CVE-2020-8151 Information disclosure issue in Active Resource
- CVE-2020-8150 Weak cryptography in Nextcloud Server
- CVE-2020-8149 Arbitrary shell command execution in logkitty
- CVE-2020-8148 Auth bypass in UniFi Cloud Key Gen2
- CVE-2020-8147 Prototype Pollution
- CVE-2020-8146 Privilege escalation in UniFi Video Controller (for Windows 7/8/10 x64)
- CVE-2020-8145 Missing authorization in UniFi Video Controller (for Windows 7/8/10 x64)
- CVE-2020-8144 Path traversal in UniFi Video Controller (for Windows 7/8/10 x64)
- CVE-2020-8143 Open redirect in https://github.com/revive-adserver/revive-adserver
- CVE-2020-8142 Security feature bypass in https://github.com/revive-adserver/revive-adserver
- CVE-2020-8141 Improper Control of Generation of Code in doT
- CVE-2020-8140 Code injection in Desktop Client
- CVE-2020-8139 Missing authorization in Nextcloud Server
- CVE-2020-8138 Server-side request forgery in Nextcloud Server
- CVE-2020-8137 Code injection in blamer
- CVE-2020-8136 Uncontrolled Resource Consumption in fastify-multipart
- CVE-2020-8135 Server-Side Request Forgery in @uppy/companion
- CVE-2020-8134 Server-side request forgery in Ghost CMS
- CVE-2020-8133 Weak cryptography in Nextcloud Server
- CVE-2020-8132 Improper Input Validation and Code Injection in pdf-image
- CVE-2020-8131 Path Traversal in Yarn
- CVE-2020-8130 OS Command Injection in Rake
- CVE-2020-8129 Code Injection in script-manager
- CVE-2020-8128 Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport
- CVE-2020-8127 Cross-site Scripting in reveal.js
- CVE-2020-8126 Command injection in EdgeSwitch
- CVE-2020-8125 Improper Input Validation in klona
- CVE-2020-8124 Improper Validation and Sanitization in url-parse
- CVE-2020-8123 Uncontrolled Resource Consumption in strapi
- CVE-2020-8122 Business logic in Nextcloud server
- CVE-2020-8121 Information disclosure in Nextcloud Server
- CVE-2020-8120 Cross-site scripting in Nextcloud Server
- CVE-2020-8119 Missing authorization in Nextcloud Server
- CVE-2020-8118 Server-side request forgery in Nextcloud Server
- CVE-2020-8117 Information disclosure in Nextcloud Server
- CVE-2020-8116 dot-prop Prototype Pollution vulnerability
- CVE-2020-8115 Cross-site scripting in https://github.com/revive-adserver/revive-adserver
- CVE-2020-8114 Missing authorization in n/a
- CVE-2020-8113 Missing authorization in n/a
- CVE-2020-8112 Memory corruption in n/a
- CVE-2020-8110 Bitdefender ceva_emu.cvd module denial-of-service (VA-8766)
- CVE-2020-8109 Bitdefender ace.xmd parser out-of-bounds write (VA-8772)
- CVE-2020-8108 Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759)
- CVE-2020-8107 Process Control vulnerability in Bitdefender Antivirus Plus
- CVE-2020-8105 Command Execution due to unsanitized input
- CVE-2020-8103 Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8604)
- CVE-2020-8102 Insufficient URL sanitization and validation in Safepay Browser (VA-8631)
- CVE-2020-8101 Command execution due to unsanitized input in LifeShield DIY HD Video Doorbell
- CVE-2020-8100 Incomplete validation in detection code in Bitdefender Engines (VA-8589)
- CVE-2020-8099 Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8387)
- CVE-2020-8097 Improper authentication vulnerability in Bitdefender Endpoint Security Tools and Endpoint Security SDK (VA-8646)
- CVE-2020-8096 Untrusted Search Path Vulnerability in High-Level Antimalware SDK
- CVE-2020-8095 Bitdefender Total Security Link Resolution Denial-of-Service Vulnerability
- CVE-2020-8094 Untrusted Search Path Vulnerability in Bitdefender Antivirus Free 2020 (VA-8422)
- CVE-2020-8093 Code Injection into Bitdefender AV for Mac
- CVE-2020-8092 Privilege escalation in Bitdefender AV for Mac
- CVE-2020-8091 Typo3 Cross-Site Scripting in Flash component (ELTS)
- CVE-2020-8090 Cross-site scripting in n/a
- CVE-2020-8089 Cross-site scripting in n/a
- CVE-2020-8088 Auth bypass in n/a
- CVE-2020-8087 Command injection in n/a
- CVE-2020-8086 Auth bypass in n/a
- CVE-2020-8037 ppp decapsulator can be convinced to allocate a large amount of memory
- CVE-2020-8036 str2tokbuf used incorrectly by print-someip.c
- CVE-2020-8035 Cross-site scripting in n/a
- CVE-2020-8034 Cross-site scripting in n/a
- CVE-2020-8033 Cross-site scripting in n/a
- CVE-2020-8032 Local privilege escalation to root due to insecure tmp file usage
- CVE-2020-8031 obs: Stored XSS
- CVE-2020-8030 skuba: Insecure /tmp usage when joining node to cluster
- CVE-2020-8029 skuba: Insecure handling of private key
- CVE-2020-8028 salt-api is accessible to every user on SUSE Manager Server
- CVE-2020-8027 openldap uses fixed paths in /tmp
- CVE-2020-8026 inn: non-root owned files
- CVE-2020-8025 outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues
- CVE-2020-8024 Problematic permissions in hylafax+ packaging allow escalation from uucp to other users
- CVE-2020-8023 Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2
- CVE-2020-8022 User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges
- CVE-2020-8021 unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service
- CVE-2020-8020 Persistent XSS in markdown parser used by obs-server