57.971 CVE tracked
788 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.971 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-17527 | HIGH 7.5 | apache tomcat While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated wit | 24.6% | — |
| CVE-2020-17525 | HIGH 7.5 | apache subversion Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. | 40.1% | — |
| CVE-2020-17519 | HIGH 7.5 | apache flink A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by | 97.9% | |
| CVE-2020-17518 | HIGH 7.5 | apache flink Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users | 50.0% | — |
| CVE-2020-17517 | HIGH 7.5 | apache ozone The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthori | 2.3% | — |
| CVE-2020-17516 | HIGH 7.5 | apache cassandra Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can | 1.9% | — |
| CVE-2020-17509 | HIGH 7.5 | apache traffic_server ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected. | 1.8% | — |
| CVE-2020-17508 | HIGH 7.5 | apache traffic_server The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected. | 2.0% | — |
| CVE-2020-1749 | HIGH 7.5 | linux linux_kernel A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted | 1.2% | — |
| CVE-2020-17096 | HIGH 7.5 | microsoft windows_10 Windows NTFS Remote Code Execution Vulnerability | 19.5% | — |
| CVE-2020-17058 | HIGH 7.5 | microsoft edge Microsoft Browser Memory Corruption Vulnerability | 3.1% | — |
| CVE-2020-17053 | HIGH 7.5 | microsoft internet_explorer Internet Explorer Memory Corruption Vulnerability | 3.2% | — |
| CVE-2020-17052 | HIGH 7.5 | microsoft edge Scripting Engine Memory Corruption Vulnerability | 2.7% | — |
| CVE-2020-17047 | HIGH 7.5 | microsoft windows_10 Windows Network File System Denial of Service Vulnerability | 27.1% | — |
| CVE-2020-16992 | HIGH 7.5 | microsoft azure_sphere Azure Sphere Elevation of Privilege Vulnerability | 1.4% | — |
| CVE-2020-16947 | HIGH 7.5 | microsoft 365_apps <p>A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the targeted user. I | 33.8% | — |
| CVE-2020-16927 | HIGH 7.5 | microsoft windows_10 <p>A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RDP service on | 5.9% | — |
| CVE-2020-16899 | HIGH 7.5 | microsoft windows_10 <p>A denial of service vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could cause a target system to stop responding.</p> <p>To exploit this v | 13.5% | — |
| CVE-2020-16896 | HIGH 7.5 | microsoft windows_10 <p>An information disclosure vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could obtain information | 12.6% | — |
| CVE-2020-16863 | HIGH 7.5 | microsoft windows_7 <p>A denial of service vulnerability exists in Windows Remote Desktop Service when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the Remote Deskto | 5.8% | — |
| CVE-2020-1686 | HIGH 7.5 | juniper junos On Juniper Networks Junos OS devices, receipt of a malformed IPv6 packet may cause the system to crash and restart (vmcore). This issue can be trigged by a malformed IPv6 packet destined to the Routing Engine. An attacker can repeatedly send the offending pack | 1.4% | — |
| CVE-2020-1684 | HIGH 7.5 | juniper junos On Juniper Networks SRX Series configured with application identification inspection enabled, receipt of specific HTTP traffic can cause high CPU load utilization, which could lead to traffic interruption. Application identification is enabled by default and i | 1.1% | — |
| CVE-2020-1683 | HIGH 7.5 | juniper junos On Juniper Networks Junos OS devices, a specific SNMP OID poll causes a memory leak which over time leads to a kernel crash (vmcore). Prior to the kernel crash other processes might be impacted, such as failure to establish SSH connection to the device. The ad | 1.1% | — |
| CVE-2020-1679 | HIGH 7.5 | juniper junos On Juniper Networks PTX and QFX Series devices with packet sampling configured using tunnel-observation mpls-over-udp, sampling of a malformed packet can cause the Kernel Routing Table (KRT) queue to become stuck. KRT is the module within the Routing Process D | 1.2% | — |
| CVE-2020-1672 | HIGH 7.5 | juniper junos On Juniper Networks Junos OS devices configured with DHCPv6 relay enabled, receipt of a specific DHCPv6 packet might crash the jdhcpd daemon. The jdhcpd daemon automatically restarts without intervention, but continuous receipt of specific crafted DHCP message | 1.0% | — |