CVE-2020-12637

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
May 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-126386.8An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOCVE-2020-126396.1phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.CVE-2020-12647.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel ElevaCVE-2020-126409.8Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plCVE-2020-126419.8rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setCVE-2020-126427.5An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosurCVE-2020-126434.3OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.CVE-2020-126445.0OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API.CVE-2020-126459.8OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and CVE-2020-126465.4OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.CVE-2020-126478.8Unisys ALGOL Compiler 58.1 before 58.1a.15, 59.1 before 59.1a.9, and 60.0 before 60.0a.5 can emit invalid code sequences under rare circumstCVE-2020-126486.1A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configur
CVE-2020-12637: Critical severity, CVSS 9.8 | Vulnix