2020 CVEs¶
86 entries from 2020. 0 ship detection & prevention rules.
| CVE | Severity | Detection / prevention | PoC |
|---|---|---|---|
| CVE-2020-1350 — A remote code execution vulnerability exists in Windows Domain Name System servers when… | Critical (10.0) | — | ✅ |
| CVE-2020-14871 — Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable… | Critical (10.0) | — | ✅ |
| CVE-2020-25213 — The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote… | Critical (10.0) | — | ✅ |
| CVE-2020-6287 — SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does… | Critical (10.0) | — | ✅ |
| CVE-2020-0646 — A remote code execution vulnerability exists when the Microsoft .NET Framework fails to… | Critical (9.8) | — | ✅ |
| CVE-2020-10148 — The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a… | Critical (9.8) | — | ✅ |
| CVE-2020-10181 — goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation… | Critical (9.8) | — | ✅ |
| CVE-2020-10189 — Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of… | Critical (9.8) | — | ✅ |
| CVE-2020-10987 — The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote… | Critical (9.8) | — | ✅ |
| CVE-2020-11651 — An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. | Critical (9.8) | — | ✅ |
| CVE-2020-12271 — A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on… | Critical (9.8) | — | ✅ |
| CVE-2020-12641 — rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary… | Critical (9.8) | — | ✅ |
| CVE-2020-12812 — An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3,… | Critical (9.8) | — | ✅ |
| CVE-2020-13927 — The previous default setting for Airflow's Experimental API was to allow all API requests… | Critical (9.8) | — | ✅ |
| CVE-2020-14644 — Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2020-14750 — Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2020-14882 — Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2020-15069 — Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code… | Critical (9.8) | — | ✅ |
| CVE-2020-15415 — On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1,… | Critical (9.8) | — | ✅ |
| CVE-2020-15505 — A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3… | Critical (9.8) | — | ✅ |
| CVE-2020-16846 — An issue was discovered in SaltStack Salt through 3002. | Critical (9.8) | — | ✅ |
| CVE-2020-17463 — FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items,… | Critical (9.8) | — | ✅ |
| CVE-2020-17496 — vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data… | Critical (9.8) | — | ✅ |
| CVE-2020-17530 — Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to… | Critical (9.8) | — | ✅ |
| CVE-2020-1938 — When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming… | Critical (9.8) | — | ✅ |
| CVE-2020-2509 — A command injection vulnerability has been reported to affect QTS and QuTS hero. | Critical (9.8) | — | ✅ |
| CVE-2020-25223 — A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before… | Critical (9.8) | — | ✅ |
| CVE-2020-25506 — D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the… | Critical (9.8) | — | ✅ |
| CVE-2020-2551 — Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2020-2555 — Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component:… | Critical (9.8) | — | ✅ |
| CVE-2020-26919 — NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the… | Critical (9.8) | — | ✅ |
| CVE-2020-2883 — Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2020-29557 — An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. | Critical (9.8) | — | ✅ |
| CVE-2020-29574 — An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows… | Critical (9.8) | — | ✅ |
| CVE-2020-29583 — Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with… | Critical (9.8) | — | ✅ |
| CVE-2020-3161 — A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated,… | Critical (9.8) | — | ✅ |
| CVE-2020-3952 — Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an… | Critical (9.8) | — | ✅ |
| CVE-2020-3992 — OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before… | Critical (9.8) | — | ✅ |
| CVE-2020-4427 — IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote… | Critical (9.8) | — | ✅ |
| CVE-2020-5135 — A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of… | Critical (9.8) | — | ✅ |
| CVE-2020-5722 — The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated… | Critical (9.8) | — | ✅ |
| CVE-2020-5847 — CVE ID: CVE-2020-5847, Attack Vector: NETWORK, CVSS: 9.8 | Critical (9.8) | — | ✅ |
| CVE-2020-5902 — In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1,… | Critical (9.8) | — | ✅ |
| CVE-2020-6207 — SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing… | Critical (9.8) | — | ✅ |
| CVE-2020-7247 — smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… | Critical (9.8) | — | ✅ |
| CVE-2020-7961 — Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote… | Critical (9.8) | — | ✅ |
| CVE-2020-8515 — DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta,… | Critical (9.8) | — | ✅ |
| CVE-2020-8599 — Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that… | Critical (9.8) | — | ✅ |
| CVE-2020-8644 — CVE ID: CVE-2020-8644, CWE: CWE-94, Type: RCE, Attack Vector: NETWORK, CVSS: 9.8 | Critical (9.8) | — | ✅ |
| CVE-2020-8657 — An issue was discovered in EyesOfNetwork 5.3. | Critical (9.8) | — | ✅ |
| CVE-2020-9054 — Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21… | Critical (9.8) | — | ✅ |
| CVE-2020-15999 — Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote… | Critical (9.6) | — | ✅ |
| CVE-2020-16010 — Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a… | Critical (9.6) | — | ✅ |
| CVE-2020-16017 — Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote… | Critical (9.6) | — | ✅ |
| CVE-2020-4006 — VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager… | Critical (9.1) | — | ✅ |
| CVE-2020-4428 — IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated… | Critical (9.1) | — | ✅ |
| CVE-2020-1040 — A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server… | Critical (9.0) | — | ✅ |
| CVE-2020-0618 — A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services… | High (8.8) | — | ✅ |
| CVE-2020-0688 — A remote code execution vulnerability exists in Microsoft Exchange software when the… | High (8.8) | — | ✅ |
| CVE-2020-10199 — Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). | High (8.8) | — | ✅ |
| CVE-2020-1020 — A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe… | High (8.8) | — | ✅ |
| CVE-2020-10221 — lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to… | High (8.8) | — | ✅ |
| CVE-2020-11978 — An issue was found in Apache Airflow versions 1.10.10 and below. | High (8.8) | — | ✅ |
| CVE-2020-13671 — Drupal core does not properly sanitize certain filenames on uploaded files, which can… | High (8.8) | — | ✅ |
| CVE-2020-16009 — Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a… | High (8.8) | — | ✅ |
| CVE-2020-16013 — Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a… | High (8.8) | — | ✅ |
| CVE-2020-1631 — A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN… | High (8.8) | — | ✅ |
| CVE-2020-1956 — Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will… | High (8.8) | — | ✅ |
| CVE-2020-24363 — TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the… | High (8.8) | — | ✅ |
| CVE-2020-25079 — An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through… | High (8.8) | — | ✅ |
| CVE-2020-3118 — A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software… | High (8.8) | — | ✅ |
| CVE-2020-5735 — Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. | High (8.8) | — | ✅ |
| CVE-2020-6418 — Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to… | High (8.8) | — | ✅ |
| CVE-2020-6572 — Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker… | High (8.8) | — | ✅ |
| CVE-2020-8467 — A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a… | High (8.8) | — | ✅ |
| CVE-2020-8468 — Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5,… | High (8.8) | — | ✅ |
| CVE-2020-9377 — D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to… | High (8.8) | — | ✅ |
| CVE-2020-9818 — An out-of-bounds write issue was addressed with improved bounds checking. | High (8.8) | — | ✅ |
| CVE-2020-3566 — A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of… | High (8.6) | — | ✅ |
| CVE-2020-3569 — Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP)… | High (8.6) | — | ✅ |
| CVE-2020-17144 — CVE ID: CVE-2020-17144, CWE: CWE-502, Type: RCE, Attack Vector: NETWORK, CVSS: 8.4 | High (8.4) | — | ✅ |
| CVE-2020-0601 — A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates… | High (8.1) | — | ✅ |
| CVE-2020-6819 — Under certain conditions, when running the nsDocShell destructor, a race condition can… | High (8.1) | — | ✅ |
| CVE-2020-6820 — Under certain conditions, when handling a ReadableStream, a race condition can cause a… | High (8.1) | — | ✅ |
| CVE-2020-0796 — CVE ID: CVE-2020-0796, CWE: CWE-119, Type: RCE, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2020-2021 — CVE ID: CVE-2020-2021, CWE: CWE-347, Type: RCE, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |