CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Security Vulnerabilities Published In January 2020

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2020-8505 352 CSRF 2020-01-31 2020-02-05
4.3
 None Remote Medium Not required None Partial None
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.
2 CVE-2020-8504 352 CSRF 2020-01-31 2020-02-05
4.3
 None Remote Medium Not required None Partial None
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.
3 CVE-2020-8503 639 2020-01-31 2020-02-05
3.5
 None Remote Medium ??? Partial None None
Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR) by an authenticated sender because of an error in a file-upload feature. This is fixed in 5.1.1068 and 6.0.1004.
4 CVE-2020-8498 79 Exec Code XSS 2020-01-30 2020-02-03
3.5
 None Remote Medium ??? None Partial None
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).
5 CVE-2020-8496 79 XSS 2020-01-30 2020-02-05
3.5
 None Remote Medium ??? None Partial None
In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator.
6 CVE-2020-8495 863 +Priv 2020-01-30 2021-07-21
6.0
 None Remote Medium ??? Partial Partial Partial
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and delegatorUserId parameters.
7 CVE-2020-8494 269 +Priv 2020-01-30 2021-07-21
6.5
 None Remote Low ??? Partial Partial Partial
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the emp_id, userid, pw1, pw2, supervisor, and timekeeper parameters.
8 CVE-2020-8493 79 XSS 2020-01-30 2020-02-05
3.5
 None Remote Medium ??? None Partial None
A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis.webta.H261configMenu servlet via an authenticated administrator.
9 CVE-2020-8492 400 DoS 2020-01-30 2023-05-24
7.1
 None Remote Medium Not required None None Complete
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
10 CVE-2020-8448 476 DoS 2020-01-30 2022-09-12
2.1
 None Local Low Not required None None Partial
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a denial of service (NULL pointer dereference) via crafted messages written directly to the analysisd UNIX domain socket by a local user.
11 CVE-2020-8447 416 2020-01-30 2022-09-12
7.5
 None Remote Low Not required Partial Partial Partial
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free during processing of syscheck formatted msgs (received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted).
12 CVE-2020-8446 22 Dir. Trav. 2020-01-30 2022-09-12
2.1
 None Local Low Not required None Partial None
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to path traversal (with write access) via crafted syscheck messages written directly to the analysisd UNIX domain socket by a local user.
13 CVE-2020-8445 20 2020-01-30 2022-09-12
10.0
 None Remote Low Not required Complete Complete Complete
In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characters are later logged. Because newlines (\n) are permitted in messages processed by ossec-analysisd, it may be possible to inject nested events into the ossec log. Use of terminal control characters may allow obfuscating events or executing commands when viewed through vulnerable terminal emulators. This may be an unauthenticated remote attack for certain types and origins of logged data.
14 CVE-2020-8444 416 2020-01-30 2022-09-12
7.5
 None Remote Low Not required Partial Partial Partial
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free during processing of ossec-alert formatted msgs (received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted).
15 CVE-2020-8443 787 Overflow 2020-01-30 2022-04-26
7.5
 None Remote Low Not required Partial Partial Partial
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-based buffer overflow during the cleaning of crafted syslog msgs (received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted).
16 CVE-2020-8442 787 Overflow 2020-01-30 2022-09-12
6.5
 None Remote Low ??? Partial Partial Partial
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a heap-based buffer overflow in the rootcheck decoder component via an authenticated client.
17 CVE-2020-8440 434 Exec Code 2020-01-31 2020-02-05
7.5
 None Remote Low Not required Partial Partial Partial
controllers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by uploading a PHP script as a resume.
18 CVE-2020-8438 78 Exec Code 2020-01-29 2020-01-31
9.0
 None Remote Low ??? Complete Complete Complete
Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as demonstrated by the nslookuptarget=|cat${IFS} substring.
19 CVE-2020-8432 415 Exec Code 2020-01-29 2021-07-21
10.0
 None Remote Low Not required Complete Complete Complete
In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identified by static analysis.
20 CVE-2020-8428 416 DoS +Info 2020-01-29 2020-06-10
3.6
 None Local Low Not required Partial None Partial
fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory, aka CID-d0cb50185ae9. One attack vector may be an open system call for a UNIX domain socket, if the socket is being moved to a new parent directory and its old parent directory is being removed.
21 CVE-2020-8426 79 XSS 2020-01-28 2023-05-26
3.5
 None Remote Medium ??? None Partial None
The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user.
22 CVE-2020-8425 352 CSRF 2020-01-28 2020-02-07
4.3
 None Remote Medium Not required None Partial None
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.
23 CVE-2020-8424 352 CSRF 2020-01-28 2020-12-15
6.8
 None Remote Medium Not required Partial Partial Partial
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php.
24 CVE-2020-8422 522 2020-01-31 2021-07-21
4.0
 None Remote Low ??? Partial None None
An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. A user with the Guest role can extract the collection of all defined credentials of remote machines: the credential name, credential type, user name, domain/workgroup name, and description (but not the password).
25 CVE-2020-8421 79 XSS 2020-01-28 2020-02-06
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.
26 CVE-2020-8420 352 CSRF 2020-01-28 2020-02-07
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in Joomla! before 3.9.15. A missing CSRF token check in the LESS compiler of com_templates causes a CSRF vulnerability.
27 CVE-2020-8419 352 CSRF 2020-01-28 2020-02-06
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in Joomla! before 3.9.15. Missing token checks in the batch actions of various components cause CSRF vulnerabilities.
28 CVE-2020-8417 352 CSRF 2020-01-28 2020-02-06
6.8
 None Remote Medium Not required Partial Partial Partial
The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.
29 CVE-2020-8416 400 DoS 2020-01-29 2021-07-21
5.0
 None Remote Low Not required None None Partial
IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port.
30 CVE-2020-8315 20 2020-01-28 2021-07-21
4.3
 None Remote Medium Not required None Partial None
In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.
31 CVE-2020-8112 787 Overflow 2020-01-28 2021-04-02
6.8
 None Remote Medium Not required Partial Partial Partial
opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851.
32 CVE-2020-8095 20 DoS 2020-01-30 2022-05-24
4.9
 None Local Low Not required None None Complete
A vulnerability in the improper handling of junctions before deletion in Bitdefender Total Security 2020 can allow an attacker to to trigger a denial of service on the affected device.
33 CVE-2020-8093 74 Exec Code 2020-01-30 2020-02-05
4.6
 None Local Low Not required Partial Partial Partial
A vulnerability in the AntivirusforMac binary as used in Bitdefender Antivirus for Mac allows an attacker to inject a library using DYLD environment variable to cause third-party code execution
34 CVE-2020-8092 269 2020-01-30 2020-02-05
2.1
 None Local Low Not required Partial None None
A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests submitted to the Bitdefender Cloud. This issue affects: Bitdefender Bitdefender Antivirus for Mac versions prior to 8.0.0.
35 CVE-2020-8091 79 XSS 2020-01-27 2020-01-29
4.3
 None Remote Medium Not required None Partial None
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.
36 CVE-2020-8090 79 XSS 2020-01-27 2020-01-29
3.5
 None Remote Medium ??? None Partial None
The Username field in the Storage Service settings of A1 WLAN Box ADB VV2220v2 devices allows stored XSS (after a successful Administrator login).
37 CVE-2020-8088 843 Bypass 2020-01-27 2021-07-21
7.5
 None Remote Low Not required Partial Partial Partial
panel_login.php in UseBB 1.0.12 allows type juggling for login bypass because != is used instead of !== for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
38 CVE-2020-8087 Exec Code 2020-01-27 2021-07-21
10.0
 None Remote Low Not required Complete Complete Complete
SMC Networks D3G0804W D3GNV5M-3.5.1.6.10_GA devices allow remote command execution by leveraging access to the Network Diagnostic Tools screen, as demonstrated by an admin login. The attacker must use a Parameter Pollution approach against goform/formSetDiagnosticToolsFmPing by providing the vlu_diagnostic_tools__ping_address parameter twice: once with a shell metacharacter and a command name, and once with a command argument.
39 CVE-2020-8086 863 2020-01-28 2020-02-04
6.8
 None Remote Medium Not required Partial Partial Partial
The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. This grants remote entities admin-only functionality if their username matches the username of a local admin.
40 CVE-2020-8009 22 Dir. Trav. 2020-01-27 2020-02-06
5.0
 None Remote Low Not required Partial None None
AVB MOTU devices through 2020-01-22 allow /.. Directory Traversal, as demonstrated by reading the /etc/passwd file.
41 CVE-2020-8003 415 DoS 2020-01-27 2023-02-03
2.1
 None Local Low Not required None None Partial
A double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service by triggering texture allocation failure, because vrend_renderer_resource_allocated_texture is not an appropriate place for a free.
42 CVE-2020-8002 476 DoS 2020-01-27 2023-02-03
2.1
 None Local Low Not required None None Partial
A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service via commands that attempt to launch a grid without previously providing a Compute Shader (CS).
43 CVE-2020-8001 798 2020-01-27 2020-01-30
10.0
 None Remote Low Not required Complete Complete Complete
The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account.
44 CVE-2020-8000 798 2020-01-27 2020-01-31
10.0
 None Remote Low Not required Complete Complete Complete
Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account.
45 CVE-2020-7999 798 2020-01-27 2020-01-30
7.5
 None Remote Low Not required Partial Partial Partial
The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD_API_KEY and FILE_DOWNLOAD_API_KEY.
46 CVE-2020-7998 434 2020-01-28 2020-02-04
9.0
 None Remote Low ??? Complete Complete Complete
An arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1 for iOS. The vulnerability is located in the developer path that is accessible and hidden next to the root path. By default, there is no password set for the FTP or Web UI service.
47 CVE-2020-7997 79 XSS 2020-01-28 2020-01-29
4.3
 None Remote Medium Not required None Partial None
ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature.
48 CVE-2020-7996 79 XSS 2020-01-26 2022-11-17
4.3
 None Remote Medium Not required None Partial None
htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.
49 CVE-2020-7995 307 2020-01-26 2022-11-17
10.0
 None Remote Low Not required Complete Complete Complete
The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.
50 CVE-2020-7994 79 XSS 2020-01-26 2022-11-17
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs/admin/const.php?mainmenu=home page; the (3) note[note] parameter to the /htdocs/admin/dict.php?id=10 page; the (4) zip[MAIN_INFO_SOCIETE_ZIP] or email[mail] parameter to the /htdocs/admin/company.php page; the (5) url[defaulturl], field[defaultkey], or value[defaultvalue] parameter to the /htdocs/admin/defaultvalues.php page; the (6) key[transkey] or key[transvalue] parameter to the /htdocs/admin/translation.php page; or the (7) [main_motd] or [main_home] parameter to the /htdocs/admin/ihm.php page.
Total number of vulnerabilities : 1656   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.