| CVE-2020-2551 Known exploited | Critical 9.8 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Assigned by oracle | Jan 15, 2020 |
| CVE-2019-18426 Known exploited | High 8.2 | A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Assigned by facebook | Jan 21, 2020 |
| CVE-2020-7247 Known exploited | Critical 9.8 | smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated… Assigned by mitre | Jan 29, 2020 |
| CVE-2020-8515 Known exploited | Critical 9.8 | DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacter… Assigned by mitre | Feb 1, 2020 |
| CVE-2020-3118 Known exploited | High 8.8 | Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability Assigned by cisco | Feb 5, 2020 |
| CVE-2020-8644 Known exploited | Critical 9.8 | PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. Assigned by mitre | Feb 5, 2020 |
| CVE-2020-8657 Known exploited | Critical 9.8 | An issue was discovered in EyesOfNetwork 5.3. Assigned by mitre | Feb 6, 2020 |
| CVE-2020-8655 Known exploited | High 7.8 | An issue was discovered in EyesOfNetwork 5.3. Assigned by mitre | Feb 6, 2020 |
| CVE-2019-18988 Known exploited | High 7.0 | TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. Assigned by mitre | Feb 7, 2020 |
| CVE-2019-19356 Known exploited | High 7.5 | Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. Assigned by mitre | Feb 7, 2020 |
| CVE-2020-0618 Known exploited | Critical 9.8 | A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution V… Assigned by microsoft | Feb 11, 2020 |
| CVE-2020-0674 Known exploited | High 7.5 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft | Feb 11, 2020 |
| CVE-2020-0683 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. Assigned by microsoft | Feb 11, 2020 |
| CVE-2020-0688 Known exploited | High 8.8 | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'. Assigned by microsoft | Feb 11, 2020 |
| CVE-2020-7796 Known exploited | Critical 9.8 | Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. Assigned by mitre | Feb 18, 2020 |
| CVE-2020-3153 Known exploited | Medium 6.5 | Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability Assigned by cisco | Feb 19, 2020 |
| CVE-2020-1938 Known exploited | Critical 9.8 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Assigned by apache | Feb 24, 2020 |
| CVE-2020-3837 Known exploited | High 7.8 | A memory corruption issue was addressed with improved memory handling. Assigned by apple | Feb 27, 2020 |
| CVE-2020-6418 Known exploited | High 8.8 | Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Feb 27, 2020 |
| CVE-2019-17026 Known exploited | High 8.8 | Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. Assigned by mozilla | Mar 2, 2020 |
| CVE-2020-9054 Known exploited | Critical 9.8 | ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi Assigned by certcc | Mar 4, 2020 |
| CVE-2019-20500 Known exploited | High 7.8 | D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admi… Assigned by mitre | Mar 5, 2020 |
| CVE-2020-10189 Known exploited | Critical 9.8 | Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. Assigned by mitre | Mar 6, 2020 |
| CVE-2020-10221 Known exploited | High 8.8 | lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter. Assigned by mitre | Mar 8, 2020 |
| CVE-2016-11021 Known exploited | High 7.2 | setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter. Assigned by mitre | Mar 9, 2020 |
| CVE-2020-0041 Known exploited | High 7.8 | In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. Assigned by google_android | Mar 10, 2020 |
| CVE-2020-0069 Known exploited | High 7.8 | In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. Assigned by google_android | Mar 10, 2020 |
| CVE-2020-6207 Known exploited | Critical 10.0 | SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgent… Assigned by sap | Mar 10, 2020 |
| CVE-2020-10181 Known exploited Healthcare | Critical 9.8 | goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_us… Assigned by mitre | Mar 11, 2020 |
| CVE-2020-0787 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service… Assigned by microsoft | Mar 12, 2020 |
| CVE-2020-0796 Known exploited | Critical 10.0 | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution… Assigned by microsoft | Mar 12, 2020 |
| CVE-2020-5847 Known exploited | Critical 9.8 | Unraid through 6.8.0 allows Remote Code Execution. Assigned by mitre | Mar 16, 2020 |
| CVE-2020-5849 Known exploited | High 7.5 | Unraid 6.8.0 allows authentication bypass. Assigned by mitre | Mar 16, 2020 |
| CVE-2020-3950 Known exploited | High 7.8 | VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability d… Assigned by vmware | Mar 17, 2020 |
| CVE-2020-8468 Known exploited | High 8.8 | Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipula… Assigned by trendmicro | Mar 18, 2020 |
| CVE-2020-8467 Known exploited | High 8.8 | A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). Assigned by trendmicro | Mar 18, 2020 |
| CVE-2020-8599 Known exploited | Critical 9.8 | Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass… Assigned by trendmicro | Mar 18, 2020 |
| CVE-2020-7961 Known exploited | Critical 9.8 | Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS). Assigned by mitre | Mar 20, 2020 |
| CVE-2020-5722 Known exploited | Critical 9.8 | The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Assigned by tenable | Mar 23, 2020 |
| CVE-2020-10199 Known exploited | High 8.8 | Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). Assigned by mitre | Apr 1, 2020 |
| CVE-2020-5735 Known exploited | High 8.8 | Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. Assigned by tenable | Apr 8, 2020 |
| CVE-2020-3952 Known exploited | Critical 9.8 | Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls. Assigned by vmware | Apr 10, 2020 |
| CVE-2020-11738 Known exploited | High 7.5 | The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init. Assigned by mitre | Apr 13, 2020 |
| CVE-2020-2883 Known exploited | Critical 9.8 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Assigned by oracle | Apr 15, 2020 |
| CVE-2020-0938 Known exploited | High 7.8 | A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format… Assigned by microsoft | Apr 15, 2020 |
| CVE-2020-0968 Known exploited | High 7.5 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft | Apr 15, 2020 |
| CVE-2020-1020 Known exploited | High 8.8 | A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format… Assigned by microsoft | Apr 15, 2020 |
| CVE-2020-1027 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. Assigned by microsoft | Apr 15, 2020 |
| CVE-2020-3161 Known exploited | Critical 9.8 | Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability Assigned by cisco | Apr 15, 2020 |
| CVE-2020-6820 Known exploited | High 8.1 | Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. Assigned by mozilla | Apr 24, 2020 |
