VIR Vulnerability Intelligence Relay

CVEs from 2020

4,634 normalized CVEs published or assigned in this year.

Total
4,634
critical
critical 193
high
high 470
medium
medium 675
low
low 56
% Critical
4.2%
% with KEV
3.2%
% with exploit
3.2%

Top vendors

Top products

  • banking_digital_experience 30
  • retail_xstore_point_of_service 28
  • primavera_unifier 27
  • retail_service_backbone 15
  • financial_services_institutional_performance_analytics 10
  • communications_network_charging_and_control 10
  • communications_contacts_server 9
  • agile_plm 8

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2020-15992 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6380 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-12390 critical — 9.5 — Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76. archdebian
CVE-2020-6527 critical — 9.5 — Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page. archdebian
CVE-2020-12397 critical — 9.5 — By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0. archdebian
CVE-2020-6381 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6389 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6529 critical — 9.5 — Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak cross-origin data via a crafted HTML page. archdebian
CVE-2020-15987 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6413 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6522 critical — 9.5 — Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. archdebian
CVE-2020-6809 critical — 9.5 — When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local files. This vulnerability affects Firef… archsusedebian
CVE-2020-25125 critical — 9.5 — GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD pre… archdebian
CVE-2020-6408 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6411 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6557 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-15988 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-16006 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-16007 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-11647 critical — 9.5 — In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by limiting the amount of recursion. archsusedebian
CVE-2020-6534 critical — 9.5 — Heap buffer overflow in WebRTC in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2020-15684 critical — 9.5 — Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… archdebian
CVE-2020-6531 critical — 9.5 — Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2020-6515 critical — 9.5 — Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2020-26950 critical — 9.5 — In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox … archsusedebian
CVE-2020-26951 critical — 9.5 — A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privilege… archsusedebian
CVE-2020-6795 critical — 9.5 — When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, leading to an unexploitable crash. This vulnerability affects … archdebian
CVE-2020-12391 critical — 9.5 — Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opa… archdebian
CVE-2020-6800 critical — 9.5 — Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enoug… archsusedebian
CVE-2020-6793 critical — 9.5 — When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. This vulnerability affects Thunderbird < 68.5. archdebian
CVE-2020-15974 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6796 critical — 9.5 — A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have caused memory corruption and a potentially … archsusedebian
CVE-2020-15681 critical — 9.5 — When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table, resulting in a potential… archdebian
CVE-2020-6807 critical — 9.5 — When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the stream was destroyed, causing a use-after-free and a potential… archsusedebian
CVE-2020-26956 critical — 9.5 — In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbir… archsusedebian
CVE-2020-12387 critical — 9.5 — A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Fire… archsusedebian
CVE-2020-15989 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6533 critical — 9.5 — Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2020-15991 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6535 critical — 9.5 — Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a … archdebian
CVE-2020-15682 critical — 9.5 — When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an o… archdebian
CVE-2020-15972 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6382 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-26965 critical — 9.5 — Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remember… archsusedebian
CVE-2020-6526 critical — 9.5 — Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. archdebian
CVE-2020-15985 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6513 critical — 9.5 — Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. archdebian
CVE-2020-6511 critical — 9.5 — Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. archdebian
CVE-2020-15978 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6390 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-26959 critical — 9.5 — During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerabil… archsusedebian
CVE-2020-15680 critical — 9.5 — If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed a… archdebian
CVE-2020-15982 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6525 critical — 9.5 — Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2020-15973 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-8955 critical — 9.5 — irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified othe… archdebian
CVE-2020-15970 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-28032 critical — 9.5 — WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. archdebian
CVE-2020-15969 critical — 9.5 — multiple issues in chromium archdebiansuse
CVE-2020-6518 critical — 9.5 — Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had convinced the user to use developer tools to potentially exploit heap corruption via a craft… archdebian
CVE-2020-15968 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6521 critical — 9.5 — Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. archdebian
CVE-2020-15967 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6519 critical — 9.5 — Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page. archdebian
CVE-2020-6402 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6388 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6414 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-12396 critical — 9.5 — Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of thes… archdebian
CVE-2020-6416 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6391 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6405 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-15990 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-16004 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6393 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6415 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-16005 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6409 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6385 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6412 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-28034 critical — 9.5 — WordPress before 5.5.2 allows XSS associated with global variables. archdebian
CVE-2020-6530 critical — 9.5 — Out of bounds memory access in developer tools in Google Chrome prior to 84.0.4147.89 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption … archdebian
CVE-2020-6406 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-6410 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-15979 critical — 9.5 — multiple issues in chromium archdebian
CVE-2020-35730 high — 9.5 3y ago An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference el… archdebian
CVE-2020-23256 critical — 9.5 3y ago electerm allows unauthorized users to execute arbitrary commands npm
CVE-2020-26269 critical — 9.5 4y ago In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the direc… archdebianpython
CVE-2020-6418 high — 9.5 5y ago multiple issues in chromium archdebian
CVE-2020-13672 critical — 9.5 5y ago Drupal core Cross-site Scripting (XSS) vulnerability archphp
CVE-2020-26271 critical — 9.5 6y ago In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge … archdebianpython
CVE-2020-26270 critical — 9.5 6y ago In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a q… archdebianpython
CVE-2020-26268 critical — 9.5 6y ago In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor i… archdebianpython
CVE-2020-26267 critical — 9.5 6y ago In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation o… archdebianpython
CVE-2020-26266 critical — 9.5 6y ago In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default … archdebianpython
CVE-2020-16017 high — 9.5 6y ago Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. archdebiannuget
CVE-2020-16013 high — 9.5 6y ago Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could… archdebiannuget
CVE-2020-15999 high — 9.5 6y ago Important: freetype security update archsusedebianrockylinux+1
CVE-2020-15254 critical — 9.5 6y ago Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as th… archdebianrust
CVE-2020-37227 high 8.8 8.8 12d ago HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploading arbitrary files. Attackers can…
CVE-2020-11113 high 8.8 8.8 6y ago FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa). debianjavaoracle