CVEs from 2020
Total
4,160
critical
critical 193
high
high 470
medium
medium 675
low
low 56
% Critical
4.6%
% with KEV
3.5%
% with exploit
3.6%
Top products
- banking_digital_experience 30
- retail_xstore_point_of_service 28
- primavera_unifier 27
- retail_service_backbone 15
- financial_services_institutional_performance_analytics 10
- communications_network_charging_and_control 10
- communications_contacts_server 9
- agile_plm 8
| CVE | Severity | CVSS | Risk | Published | Description | Impact |
|---|---|---|---|---|---|---|
| CVE-2020-7247 | critical | — | 10.0 | 4y ago | smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session. | |
| CVE-2020-6819 | critical | — | 10.0 | 5y ago | Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, caus… | |
| CVE-2020-6820 | critical | — | 10.0 | 5y ago | Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unsp… | |
| CVE-2020-16009 | critical | — | 10.0 | 6y ago | multiple issues in chromium | |
| CVE-2020-37239 | critical | 9.8 | 9.8 | 12d ago | libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_… | |
| CVE-2020-37228 | critical | 9.8 | 9.8 | 12d ago | iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode object. Attackers can retr… | |
| CVE-2020-37168 | critical | 9.8 | 9.8 | 15d ago | Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. A… | |
| CVE-2020-37002 | critical | 9.8 | 9.8 | 4mo ago | Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/t… | |
| CVE-2020-28271 | critical | 9.8 | 9.8 | 6y ago | Prototype Pollution in deephas | |
| CVE-2020-9546 | critical | 9.8 | 9.8 | 6y ago | jackson-databind mishandles the interaction between serialization gadgets and typing | |
| CVE-2020-28040 | critical | — | 9.5 | — | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. | |
| CVE-2020-15682 | critical | — | 9.5 | — | When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an o… | |
| CVE-2020-6531 | critical | — | 9.5 | — | Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | |
| CVE-2020-15684 | critical | — | 9.5 | — | Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… | |
| CVE-2020-15680 | critical | — | 9.5 | — | If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed a… | |
| CVE-2020-6800 | critical | — | 9.5 | — | Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enoug… | |
| CVE-2020-6521 | critical | — | 9.5 | — | Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. | |
| CVE-2020-26965 | critical | — | 9.5 | — | Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remember… | |
| CVE-2020-6801 | critical | — | 9.5 | — | Mozilla developers reported memory safety bugs present in Firefox 72. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… | |
| CVE-2020-26952 | critical | — | 9.5 | — | Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash when handling out-of-memory errors. This vulnerability affect… | |
| CVE-2020-6522 | critical | — | 9.5 | — | Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. | |
| CVE-2020-6510 | critical | — | 9.5 | — | Heap buffer overflow in background fetch in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-6535 | critical | — | 9.5 | — | Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a … | |
| CVE-2020-15983 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6792 | critical | — | 9.5 | — | When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 68.5. | |
| CVE-2020-6557 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-11523 | critical | — | 9.5 | — | libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow. | |
| CVE-2020-6078 | critical | — | 9.5 | — | An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdns_recv, the return value of the mdns_read_h… | |
| CVE-2020-6382 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6513 | critical | — | 9.5 | — | Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. | |
| CVE-2020-6519 | critical | — | 9.5 | — | Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page. | |
| CVE-2020-16006 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-26959 | critical | — | 9.5 | — | During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerabil… | |
| CVE-2020-28033 | critical | — | 9.5 | — | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. | |
| CVE-2020-6525 | critical | — | 9.5 | — | Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-6526 | critical | — | 9.5 | — | Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. | |
| CVE-2020-6536 | critical | — | 9.5 | — | Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox (URL bar) via a crafted… | |
| CVE-2020-6379 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6805 | critical | — | 9.5 | — | When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. This vulnerability affects Thunderbi… | |
| CVE-2020-6404 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-15973 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6517 | critical | — | 9.5 | — | Heap buffer overflow in history in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-6515 | critical | — | 9.5 | — | Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-6397 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-11524 | critical | — | 9.5 | — | libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write. | |
| CVE-2020-6823 | critical | — | 9.5 | — | A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and gain access to the us… | |
| CVE-2020-12395 | critical | — | 9.5 | — | Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enoug… | |
| CVE-2020-15979 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6400 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-25125 | critical | — | 9.5 | — | GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD pre… | |
| CVE-2020-6795 | critical | — | 9.5 | — | When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, leading to an unexploitable crash. This vulnerability affects … | |
| CVE-2020-15981 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6079 | critical | — | 9.5 | — | An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is … | |
| CVE-2020-6533 | critical | — | 9.5 | — | Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-6821 | critical | — | 9.5 | — | When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously, this memor… | |
| CVE-2020-6385 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6457 | critical | — | 9.5 | — | arbitrary code execution in chromium | |
| CVE-2020-6396 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6395 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6077 | critical | — | 9.5 | — | An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages, the implementation does not properly keep track … | |
| CVE-2020-15978 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-26969 | critical | — | 9.5 | — | Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… | |
| CVE-2020-16007 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6796 | critical | — | 9.5 | — | A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have caused memory corruption and a potentially … | |
| CVE-2020-6806 | critical | — | 9.5 | — | By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a poten… | |
| CVE-2020-6807 | critical | — | 9.5 | — | When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the stream was destroyed, causing a use-after-free and a potential… | |
| CVE-2020-6815 | critical | — | 9.5 | — | Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evidence of memory corruption or escalation of privilege and we presume that with eno… | |
| CVE-2020-6814 | critical | — | 9.5 | — | Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these co… | |
| CVE-2020-6398 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6512 | critical | — | 9.5 | — | Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-6399 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-26956 | critical | — | 9.5 | — | In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbir… | |
| CVE-2020-15683 | critical | — | 9.5 | — | Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enoug… | |
| CVE-2020-26960 | critical | — | 9.5 | — | If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerabili… | |
| CVE-2020-6516 | critical | — | 9.5 | — | Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | |
| CVE-2020-15681 | critical | — | 9.5 | — | When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table, resulting in a potential… | |
| CVE-2020-14355 | critical | — | 9.5 | — | Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affe… | |
| CVE-2020-16044 | critical | — | 9.5 | — | Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet. | |
| CVE-2020-11100 | critical | — | 9.5 | — | In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2… | |
| CVE-2020-26968 | critical | — | 9.5 | — | Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… | |
| CVE-2020-6393 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6392 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6401 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-26951 | critical | — | 9.5 | — | A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privilege… | |
| CVE-2020-6825 | critical | — | 9.5 | — | Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corrupti… | |
| CVE-2020-12392 | critical | — | 9.5 | — | The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and past… | |
| CVE-2020-15984 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-15991 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6810 | critical | — | 9.5 | — | After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscreen mode. Combined with spoofing the brow… | |
| CVE-2020-6824 | critical | — | 9.5 | — | Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Priv… | |
| CVE-2020-6391 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6798 | critical | — | 9.5 | — | If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly… | |
| CVE-2020-6381 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6389 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-15982 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6388 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6411 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-15980 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-11521 | critical | — | 9.5 | — | libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write. | |
| CVE-2020-15989 | critical | — | 9.5 | — | multiple issues in chromium |