Vulnerabilities (CVE)

Filtered by CWE-20
Total 10441 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-2908 2 Opensuse, Oracle 2 Leap, Vm Virtualbox 2024-11-21 4.6 MEDIUM 8.2 HIGH
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior to 6.0.20 and prior to 6.1.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVE-2020-2907 2 Opensuse, Oracle 2 Leap, Vm Virtualbox 2024-11-21 4.6 MEDIUM 7.5 HIGH
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.40, prior to 6.0.20 and prior to 6.1.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVE-2020-2168 1 Jenkins 1 Azure Container Service 2024-11-21 6.5 MEDIUM 8.8 HIGH
Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVE-2020-2167 1 Jenkins 1 Openshift Pipeline 2024-11-21 6.5 MEDIUM 8.8 HIGH
Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVE-2020-2166 1 Jenkins 1 Pipeline\ 2024-11-21 6.5 MEDIUM 8.8 HIGH
Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVE-2020-2110 1 Jenkins 1 Script Security 2024-11-21 6.5 MEDIUM 8.8 HIGH
Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
CVE-2020-2109 1 Jenkins 1 Pipeline\ 2024-11-21 6.5 MEDIUM 8.8 HIGH
Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
CVE-2020-2011 1 Paloaltonetworks 1 Pan-os 2024-11-21 7.8 HIGH 7.5 HIGH
An improper input validation vulnerability in the configuration daemon of Palo Alto Networks PAN-OS Panorama allows for a remote unauthenticated user to send a specifically crafted registration request to the device that causes the configuration service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS Panorama services by restarting the device and putting it into maintenance mode. This issue affects: All versions of PAN-OS 7.1, PAN-OS 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7; PAN-OS 9.1 versions earlier than 9.1.0.
CVE-2020-29508 2 Dell, Oracle 6 Bsafe Crypto-c-micro-edition, Bsafe Micro-edition-suite, Database and 3 more 2024-11-21 7.5 HIGH 5.3 MEDIUM
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper Input Validation Vulnerability.
CVE-2020-29507 2 Dell, Oracle 6 Bsafe Crypto-c-micro-edition, Bsafe Micro-edition-suite, Database and 3 more 2024-11-21 7.5 HIGH 5.3 MEDIUM
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.4, and Dell BSAFE Micro Edition Suite, versions before 4.4, contain an Improper Input Validation Vulnerability.
CVE-2020-29013 1 Fortinet 1 Fortisandbox 2024-11-21 5.5 MEDIUM 5.4 MEDIUM
An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the sniffer via specifically crafted requests.
CVE-2020-28898 1 Resourcexpress 1 Resourcexpress 2024-11-21 5.0 MEDIUM 5.3 MEDIUM
In QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific URL parameters causes a server error in script execution due to insufficient input validation.
CVE-2020-28870 1 Inoideas 1 Inoerp 2024-11-21 7.5 HIGH 9.8 CRITICAL
In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in /modules/sys/form_personalization/json_fp.php.
CVE-2020-28648 1 Nagios 1 Nagios Xi 2024-11-21 9.0 HIGH 8.8 HIGH
Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.
CVE-2020-28645 1 Owncloud 1 Owncloud 2024-11-21 5.0 MEDIUM 9.1 CRITICAL
Deleting users with certain names caused system files to be deleted. Risk is higher for systems which allow users to register themselves and have the data directory in the web root. This affects ownCloud/core versions < 10.6.
CVE-2020-28349 1 Chirpstack 1 Network Server 2024-11-21 6.8 MEDIUM 6.5 MEDIUM
An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequency attributes in CollectAndCallOnceCollect in internal/uplink/collect.go. NOTE: the vendor's position is that there are no "guarantees that allowing untrusted LoRa gateways to the network should still result in a secure network.
CVE-2020-28221 1 Schneider-electric 42 Ecostruxure Operator Terminal Expert, Gp-4104g, Gp-4104w and 39 more 2024-11-21 9.3 HIGH 9.8 CRITICAL
A CWE-20: Improper Input Validation vulnerability exists in EcoStruxureâ„¢ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI.
CVE-2020-28031 1 Eramba 1 Eramba 2024-11-21 4.0 MEDIUM 4.3 MEDIUM
eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users.
CVE-2020-27844 3 Debian, Oracle, Uclouvain 3 Debian Linux, Outside In Technology, Openjpeg 2024-11-21 8.3 HIGH 7.8 HIGH
A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVE-2020-27833 1 Redhat 1 Openshift Container Platform 2024-11-21 4.6 MEDIUM 7.1 HIGH
A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image (.tar file) which contains symbolic links. The vulnerability is limited to the command `oc image extract`. If a symbolic link is first created pointing within the tarball, this allows further symbolic links to bypass the existing path check. This flaw allows the tarball to create links outside the tarball's parent directory, allowing for executables or configuration files to be overwritten, resulting in arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions up to and including openshift-clients-4.7.0-202104250659.p0.git.95881af are affected.