VIR Vulnerability Intelligence Relay

CVEs from 2020

4,156 normalized CVEs published or assigned in this year.

Total
4,156
critical
critical 193
high
high 470
medium
medium 674
low
low 57
% Critical
4.6%
% with KEV
3.5%
% with exploit
3.6%

Top vendors

Top products

  • banking_digital_experience 30
  • retail_xstore_point_of_service 28
  • primavera_unifier 27
  • retail_service_backbone 15
  • financial_services_institutional_performance_analytics 10
  • communications_network_charging_and_control 10
  • communications_contacts_server 9
  • agile_plm 8

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2020-16040 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-24654 high — 8.0 — arbitrary filesystem access in ark debianarch
CVE-2020-15953 high — 8.0 — LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the clien… archdebian
CVE-2020-12767 high — 8.0 — exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. archsusedebian
CVE-2020-16020 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-2732 high — 8.0 — A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 gu… archsusedebian
CVE-2020-36328 high — 8.0 — A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vuln… suserockylinuxdebian
CVE-2020-6443 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16024 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16012 high — 8.0 — multiple issues in chromium archdebiansuse
CVE-2020-16021 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16018 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-0549 high — 8.0 — Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. archsuserockylinuxdebian
CVE-2020-12663 high — 8.0 — Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. archsusedebian
CVE-2020-1716 high — 8.0 — Important: Rocky Enterprise Software Foundation Ceph Storage 4.1 security, bug fix, and enhancement update rockylinux
CVE-2020-15962 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-15676 high — 8.0 — Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditabl… archdebian
CVE-2020-10957 high — 8.0 — In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp. archsusedebian
CVE-2020-15653 high — 8.0 — An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed po… archsusedebian
CVE-2020-28018 high — 8.0 — Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL. archdebian
CVE-2020-16041 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6514 high — 8.0 — Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream. archdebiansuse
CVE-2020-25681 high — 8.0 — A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge… archsusedebian
CVE-2020-8169 high — 8.0 — curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s). archdebiansuse
CVE-2020-6426 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-4032 high — 8.0 — In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks are affected. This is fixed in version 2.1… archsusedebian
CVE-2020-6451 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2020-6454 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6466 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6473 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6494 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-35111 high — 8.0 — When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a us… archsusedebian
CVE-2020-6505 high — 8.0 — Use after free in speech in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. archdebian
CVE-2020-6495 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6507 high — 8.0 — Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. archdebian
CVE-2020-6458 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-35114 high — 8.0 — Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… archdebian
CVE-2020-26978 high — 8.0 — Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerabi… archsusedebian
CVE-2020-6455 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6434 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6423 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16029 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-10730 high — 8.0 — A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped wit… archsusedebian
CVE-2020-16015 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-35680 high — 8.0 — smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of cl… archdebian
CVE-2020-16034 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-15965 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6474 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6472 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-35176 high — 8.0 — In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf fo… debianarch
CVE-2020-6574 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-15964 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-15963 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-4031 high — 8.0 — In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2. archsusedebian
CVE-2020-15966 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-27780 high — 8.0 — A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of … archsusedebian
CVE-2020-16016 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2020-15889 high — 8.0 — Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members. archdebian
CVE-2020-16033 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-15960 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6575 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6482 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6477 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-15995 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16032 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16043 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16028 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16026 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16035 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16042 high — 8.0 — multiple issues in chromium archdebiansuse
CVE-2020-16027 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16038 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16036 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16031 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16014 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16037 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16019 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16030 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16025 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-26555 high — 8.0 2y ago Important: kernel security, bug fix, and enhancement update archredhatrockylinuxsuse+1
CVE-2020-22219 high — 8.0 3y ago Important: flac security update redhatsusedebian
CVE-2020-28367 high — 8.0 4y ago Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive. archsusedebiangolang
CVE-2020-28366 high — 8.0 4y ago Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file. archsusedebiangolang
CVE-2020-28915 high — 8.0 4y ago A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def. suserockylinuxdebianalmalinux
CVE-2020-27838 high — 8.0 4y ago Keycloak discloses information without authentication archjava
CVE-2020-7613 high — 8.0 4y ago Clamscan vulnerable to command injection archnpm
CVE-2020-0404 high — 8.0 4y ago In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. This could lead to local escalation of privilege in the kernel with no additional e… suserockylinuxdebian
CVE-2020-27820 high — 8.0 4y ago A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-o… suserockylinuxdebian
CVE-2020-4788 high — 8.0 4y ago IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296. suserockylinuxdebian
CVE-2020-13974 high — 8.0 4y ago An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in th… suserockylinuxdebian
CVE-2020-10734 high — 8.0 4y ago OIDC Logout redirect in keycloak archjava
CVE-2020-13692 high — 8.0 4y ago Improper Restriction of XML External Entity Reference susedebianrockylinuxjava
CVE-2020-1717 high — 8.0 4y ago Generation of Error Message Containing Sensitive Information in Keycloak archjava
CVE-2020-1725 high — 8.0 4y ago Incorrect Authorization in keycloak archjava
CVE-2020-1714 high — 8.0 4y ago Improper Input Validation in Keycloak archjava
CVE-2020-14359 high — 8.0 4y ago Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers archgolang
CVE-2020-13935 high — 8.0 4y ago Infinite Loop in Apache Tomcat archsusedebianjava
CVE-2020-13934 high — 8.0 4y ago Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat archsusedebianjava
CVE-2020-8927 high — 8.0 5y ago Important: .NET 5.0 security and bugfix update debianarchsuserockylinux+4
CVE-2020-25717 high — 8.0 5y ago Important: samba security update archsuserockylinuxdebian