CVEs from 2020
Total
4,634
critical
critical 193
high
high 470
medium
medium 675
low
low 56
% Critical
4.2%
% with KEV
3.2%
% with exploit
3.2%
Top products
- banking_digital_experience 30
- retail_xstore_point_of_service 28
- primavera_unifier 27
- retail_service_backbone 15
- financial_services_institutional_performance_analytics 10
- communications_network_charging_and_control 10
- communications_contacts_server 9
- agile_plm 8
| CVE | Severity | CVSS | Risk | Published | Description | Impact |
|---|---|---|---|---|---|---|
| CVE-2020-7247 | critical | — | 10.0 | 4y ago | smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session. | |
| CVE-2020-6819 | critical | — | 10.0 | 5y ago | Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, caus… | |
| CVE-2020-6820 | critical | — | 10.0 | 5y ago | Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unsp… | |
| CVE-2020-16009 | critical | — | 10.0 | 6y ago | multiple issues in chromium | |
| CVE-2020-37239 | critical | 9.8 | 9.8 | 12d ago | libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signature overwriting in freed chunks. Attackers can call babl_… | |
| CVE-2020-37228 | critical | 9.8 | 9.8 | 12d ago | iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode object. Attackers can retr… | |
| CVE-2020-37168 | critical | 9.8 | 9.8 | 15d ago | Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. A… | |
| CVE-2020-37002 | critical | 9.8 | 9.8 | 4mo ago | Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/t… | |
| CVE-2020-28271 | critical | 9.8 | 9.8 | 6y ago | Prototype Pollution in deephas | |
| CVE-2020-9546 | critical | 9.8 | 9.8 | 6y ago | jackson-databind mishandles the interaction between serialization gadgets and typing | |
| CVE-2020-15990 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-26963 | critical | — | 9.5 | — | Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limiting to these API calls. This vulnerability affects Firefox … | |
| CVE-2020-26962 | critical | — | 9.5 | — | Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across … | |
| CVE-2020-15968 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6524 | critical | — | 9.5 | — | Heap buffer overflow in WebAudio in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-15967 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-16006 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6380 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-8955 | critical | — | 9.5 | — | irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified othe… | |
| CVE-2020-6391 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6387 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6518 | critical | — | 9.5 | — | Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had convinced the user to use developer tools to potentially exploit heap corruption via a craft… | |
| CVE-2020-6392 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-25125 | critical | — | 9.5 | — | GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD pre… | |
| CVE-2020-6512 | critical | — | 9.5 | — | Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-6382 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6522 | critical | — | 9.5 | — | Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. | |
| CVE-2020-6792 | critical | — | 9.5 | — | When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 68.5. | |
| CVE-2020-28037 | critical | — | 9.5 | — | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, lea… | |
| CVE-2020-6398 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6393 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6402 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6412 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6396 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6409 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-11523 | critical | — | 9.5 | — | libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow. | |
| CVE-2020-15987 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6410 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6408 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6397 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-15985 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-26956 | critical | — | 9.5 | — | In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbir… | |
| CVE-2020-15680 | critical | — | 9.5 | — | If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed a… | |
| CVE-2020-6404 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6511 | critical | — | 9.5 | — | Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. | |
| CVE-2020-6378 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6388 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6517 | critical | — | 9.5 | — | Heap buffer overflow in history in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-15977 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-16008 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-8794 | critical | — | 9.5 | — | OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTP… | |
| CVE-2020-15973 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-15979 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6405 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6401 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6406 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6414 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6072 | critical | — | 9.5 | — | An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the rr_decode function's return … | |
| CVE-2020-16044 | critical | — | 9.5 | — | Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet. | |
| CVE-2020-28038 | critical | — | 9.5 | — | WordPress before 5.5.2 allows stored XSS via post slugs. | |
| CVE-2020-26968 | critical | — | 9.5 | — | Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… | |
| CVE-2020-6416 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6415 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-12396 | critical | — | 9.5 | — | Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of thes… | |
| CVE-2020-15988 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6413 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6795 | critical | — | 9.5 | — | When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, leading to an unexploitable crash. This vulnerability affects … | |
| CVE-2020-26965 | critical | — | 9.5 | — | Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remember… | |
| CVE-2020-11524 | critical | — | 9.5 | — | libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write. | |
| CVE-2020-6399 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6381 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-15991 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6403 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-28033 | critical | — | 9.5 | — | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. | |
| CVE-2020-6809 | critical | — | 9.5 | — | When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local files. This vulnerability affects Firef… | |
| CVE-2020-9760 | critical | — | 9.5 | — | An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a… | |
| CVE-2020-16004 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6812 | critical | — | 9.5 | — | The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate de… | |
| CVE-2020-28036 | critical | — | 9.5 | — | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. | |
| CVE-2020-6510 | critical | — | 9.5 | — | Heap buffer overflow in background fetch in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-15683 | critical | — | 9.5 | — | Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enoug… | |
| CVE-2020-15992 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-15969 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-15684 | critical | — | 9.5 | — | Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… | |
| CVE-2020-6395 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-15970 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-26960 | critical | — | 9.5 | — | If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerabili… | |
| CVE-2020-16005 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6814 | critical | — | 9.5 | — | Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these co… | |
| CVE-2020-15981 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6515 | critical | — | 9.5 | — | Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-6801 | critical | — | 9.5 | — | Mozilla developers reported memory safety bugs present in Firefox 72. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been expl… | |
| CVE-2020-15986 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6813 | critical | — | 9.5 | — | When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Co… | |
| CVE-2020-6523 | critical | — | 9.5 | — | Out of bounds write in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2020-6389 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-6823 | critical | — | 9.5 | — | A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and gain access to the us… | |
| CVE-2020-14355 | critical | — | 9.5 | — | Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affe… | |
| CVE-2020-15982 | critical | — | 9.5 | — | multiple issues in chromium | |
| CVE-2020-15980 | critical | — | 9.5 | — | multiple issues in chromium |