Total
29064 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-3222 | 1 Cisco | 1 Ios Xe | 2024-11-21 | 3.3 LOW | 4.3 MEDIUM |
| A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to bypass access control restrictions on an affected device. The vulnerability is due to the presence of a proxy service at a specific endpoint of the web UI. An attacker could exploit this vulnerability by connecting to the proxy service. An exploit could allow the attacker to bypass access restrictions on the network by proxying their access request through the management network of the affected device. As the proxy is reached over the management virtual routing and forwarding (VRF), this could reduce the effectiveness of the bypass. | |||||
| CVE-2020-3208 | 1 Cisco | 5 1120, 1240, 809 and 2 more | 2024-11-21 | 7.2 HIGH | 6.7 MEDIUM |
| A vulnerability in the image verification feature of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) could allow an authenticated, local attacker to boot a malicious software image on an affected device. The vulnerability is due to insufficient access restrictions on the area of code that manages the image verification feature. An attacker could exploit this vulnerability by first authenticating to the targeted device and then logging in to the Virtual Device Server (VDS) of an affected device. The attacker could then, from the VDS shell, disable Cisco IOS Software integrity (image) verification. A successful exploit could allow the attacker to boot a malicious Cisco IOS Software image on the targeted device. To exploit this vulnerability, the attacker must have valid user credentials at privilege level 15. | |||||
| CVE-2020-3199 | 1 Cisco | 5 1120, 1240, 809 and 2 more | 2024-11-21 | 8.3 HIGH | 8.8 HIGH |
| Multiple vulnerabilities in the Cisco IOx application environment of Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) that are running Cisco IOS Software could allow an attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. | |||||
| CVE-2020-3186 | 1 Cisco | 25 Asa 5505, Asa 5505 Firmware, Asa 5510 and 22 more | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| A vulnerability in the management access list configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured management interface access list on an affected system. The vulnerability is due to the configuration of different management access lists, with ports allowed in one access list and denied in another. An attacker could exploit this vulnerability by sending crafted remote management traffic to the local IP address of an affected system. A successful exploit could allow the attacker to bypass the configured management access list policies, and traffic to the management interface would not be properly denied. | |||||
| CVE-2020-3117 | 1 Cisco | 2 Content Security Management Appliance, Web Security Appliance | 2024-11-21 | 4.3 MEDIUM | 4.7 MEDIUM |
| A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance (WSA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to inject crafted HTTP headers in the web server's response. The vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user to access a crafted URL and receive a malicious HTTP response. A successful exploit could allow the attacker to inject arbitrary HTTP headers into valid HTTP responses sent to a user's browser. | |||||
| CVE-2020-36700 | 1 King-theme | 1 Page Builder Kingcomposer | 2024-11-21 | N/A | 8.8 HIGH |
| The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress options, delete arbitrary files/folders, and inject arbitrary content. | |||||
| CVE-2020-36474 | 1 Safecurl Project | 1 Safecurl | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| SafeCurl before 0.9.2 has a DNS rebinding vulnerability. | |||||
| CVE-2020-36249 | 1 Owncloud | 1 File Firewall | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares. | |||||
| CVE-2020-35875 | 1 Tokio | 1 Tokio-rustls | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly. | |||||
| CVE-2020-35784 | 1 Netgear | 8 Gs116e, Gs116e Firmware, Jgs516pe and 5 more | 2024-11-21 | 6.5 MEDIUM | 6.2 MEDIUM |
| Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, and GS116Ev2 before 2.6.0.48. | |||||
| CVE-2020-35782 | 1 Netgear | 8 Gs116e, Gs116e Firmware, Jgs516pe and 5 more | 2024-11-21 | 7.8 HIGH | 8.1 HIGH |
| Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before 2.6.0.48. The TFTP firmware update mechanism does not properly implement firmware validations, allowing remote attackers to write arbitrary data to internal memory. | |||||
| CVE-2020-35737 | 1 Newgensoft | 1 Egov | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference. | |||||
| CVE-2020-35605 | 2 Debian, Kitty Project | 2 Debian Linux, Kitty | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message. | |||||
| CVE-2020-35579 | 1 Subconverter Project | 1 Subconverter | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request for it, but does not consider that the external request target may indirectly redirect back to this original /sub endpoint. Thus, a request loop and a denial of service may occur. | |||||
| CVE-2020-35577 | 1 Endalia | 1 Selection Portal | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
| In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier (aka CommonDownload identification number). | |||||
| CVE-2020-35554 | 1 Google | 1 Android | 2024-11-21 | 4.6 MEDIUM | 7.8 HIGH |
| An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. There is a WebView SSL error-handler vulnerability. The LG ID is LVE-SMP-200026 (December 2020). | |||||
| CVE-2020-35501 | 2 Linux, Redhat | 2 Linux Kernel, Enterprise Linux | 2024-11-21 | 3.6 LOW | 3.4 LOW |
| A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem | |||||
| CVE-2020-35481 | 1 Solarwinds | 1 Serv-u | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection. | |||||
| CVE-2020-35168 | 2 Dell, Oracle | 6 Bsafe Crypto-c-micro-edition, Bsafe Micro-edition-suite, Database and 3 more | 2024-11-21 | 7.5 HIGH | 4.7 MEDIUM |
| Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability. | |||||
| CVE-2020-35167 | 2 Dell, Oracle | 6 Bsafe Crypto-c-micro-edition, Bsafe Micro-edition-suite, Database and 3 more | 2024-11-21 | 7.5 HIGH | 4.8 MEDIUM |
| Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability. | |||||