VIR Vulnerability Intelligence Relay

CVEs from 2020

4,160 normalized CVEs published or assigned in this year.

Total
4,160
critical
critical 193
high
high 470
medium
medium 675
low
low 56
% Critical
4.6%
% with KEV
3.5%
% with exploit
3.6%

Top vendors

Top products

  • banking_digital_experience 30
  • retail_xstore_point_of_service 28
  • primavera_unifier 27
  • retail_service_backbone 15
  • financial_services_institutional_performance_analytics 10
  • communications_network_charging_and_control 10
  • communications_contacts_server 9
  • agile_plm 8

Top packages

Severitycriticalhighmediumlowunknown
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2020-1712 high — 8.0 — A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse… archsusedebian
CVE-2020-25686 high — 8.0 — A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of … archdebiansuse
CVE-2020-4031 high — 8.0 — In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2. archsusedebian
CVE-2020-15995 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16032 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16043 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16028 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16026 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16035 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16042 high — 8.0 — multiple issues in chromium archdebiansuse
CVE-2020-16027 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16038 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16036 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16031 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16014 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16037 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16019 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16030 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16025 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16024 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6456 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6439 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6442 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6438 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6436 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6425 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6435 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6433 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6432 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6431 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6430 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6452 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2020-6428 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6407 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6450 high — 8.0 — arbitrary code execution in chromium archdebian
CVE-2020-6429 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6422 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6449 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6427 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6424 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-35176 high — 8.0 — In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf fo… debianarch
CVE-2020-28011 high — 8.0 — Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root. archdebian
CVE-2020-28010 high — 8.0 — Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on some common platforms). archdebian
CVE-2020-35733 high — 8.0 — certificate verification bypass in erlang archdebian
CVE-2020-27187 high — 8.0 — An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker … archdebian
CVE-2020-8835 high — 8.0 — In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel … archsusedebian
CVE-2020-9383 high — 8.0 — An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before a… archsusedebian
CVE-2020-25683 high — 8.0 — A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who… archsusedebian
CVE-2020-15166 high — 8.0 — In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and con… archdebian
CVE-2020-14387 high — 8.0 — A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing… archdebian
CVE-2020-12398 high — 8.0 — If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent … archdebian
CVE-2020-12767 high — 8.0 — exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. archsusedebian
CVE-2020-13114 high — 8.0 — An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data. archsusedebian
CVE-2020-26262 high — 8.0 — Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.… archdebian
CVE-2020-25829 high — 8.0 — An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSS… archdebian
CVE-2020-13398 high — 8.0 — An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. archdebian
CVE-2020-6441 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6443 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-16039 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-15953 high — 8.0 — LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the clien… archdebian
CVE-2020-6576 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6472 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6474 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6478 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-6467 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-23171 high — 8.0 — multiple issues in nim arch
CVE-2020-6420 high — 8.0 — access restriction bypass in chromium archdebian
CVE-2020-15655 high — 8.0 — A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information. This vulnerability affe… archsusedebian
CVE-2020-16023 high — 8.0 — multiple issues in chromium archdebian
CVE-2020-35111 high — 8.0 — When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a us… archsusedebian
CVE-2020-28926 high — 8.0 — ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to the miniDLNA service using HTTP chunked encoding can lead to a signedness bug re… archdebian
CVE-2020-0093 high — 8.0 — In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privile… archsusedebian
CVE-2020-26555 high — 8.0 2y ago Important: kernel security, bug fix, and enhancement update archredhatrockylinuxsuse
CVE-2020-22219 high — 8.0 3y ago Important: flac security update redhatsusedebian
CVE-2020-28367 high — 8.0 4y ago Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive. archsusedebiangolang
CVE-2020-28366 high — 8.0 4y ago Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file. archsusedebiangolang
CVE-2020-28915 high — 8.0 4y ago A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def. suserockylinuxdebian
CVE-2020-27838 high — 8.0 4y ago Keycloak discloses information without authentication archjava
CVE-2020-7613 high — 8.0 4y ago Clamscan vulnerable to command injection archnpm
CVE-2020-0404 high — 8.0 4y ago In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. This could lead to local escalation of privilege in the kernel with no additional e… suserockylinuxdebian
CVE-2020-27820 high — 8.0 4y ago A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-o… suserockylinuxdebian
CVE-2020-13974 high — 8.0 4y ago An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in th… suserockylinuxdebian
CVE-2020-4788 high — 8.0 4y ago IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296. suserockylinuxdebian
CVE-2020-10734 high — 8.0 4y ago OIDC Logout redirect in keycloak archjava
CVE-2020-13692 high — 8.0 4y ago Improper Restriction of XML External Entity Reference susedebianrockylinuxjava
CVE-2020-1717 high — 8.0 4y ago Generation of Error Message Containing Sensitive Information in Keycloak archjava
CVE-2020-1725 high — 8.0 4y ago Incorrect Authorization in keycloak archjava
CVE-2020-1714 high — 8.0 4y ago Improper Input Validation in Keycloak archjava
CVE-2020-14359 high — 8.0 4y ago Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers archgolang
CVE-2020-13935 high — 8.0 4y ago Infinite Loop in Apache Tomcat archsusedebianjava
CVE-2020-13934 high — 8.0 4y ago Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat archsusedebianjava
CVE-2020-8927 high — 8.0 5y ago Important: .NET 5.0 security and bugfix update debianarchsuserockylinux+4
CVE-2020-25717 high — 8.0 5y ago Important: samba security update archsuserockylinuxdebian
CVE-2020-36385 high — 8.0 5y ago An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_… suserockylinuxdebian
CVE-2020-14765 high — 8.0 5y ago Important: mariadb:10.3 security, bug fix, and enhancement update suserockylinuxdebian
CVE-2020-13675 high — 8.0 5y ago Unrestricted Upload of File with Dangerous Type in Drupal core archphp
CVE-2020-13673 high — 8.0 5y ago The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it i… archphp
CVE-2020-13677 high — 8.0 5y ago Drupal core access bypass vulnerability archphp
CVE-2020-13676 high — 8.0 5y ago Incorrect Authorization in Drupal core archphp
CVE-2020-13674 high — 8.0 5y ago Cross-Site Request Forgery in Drupal core archphp