CVE-2020-14958

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-281

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jun 21, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-149595.4Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script CVE-2020-14968.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An atCVE-2020-149607.2A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter,CVE-2020-149615.3Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.CVE-2020-149625.4Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web scCVE-2020-149654.8On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML conteCVE-2020-149667.5An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking ovCVE-2020-149679.8An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect cipCVE-2020-149689.8An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signaturCVE-2020-149697.5app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch APCVE-2020-14975.5An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploitCVE-2020-149717.8Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then resto
CVE-2020-14958: Medium severity, CVSS 6.5 | Vulnix