Total
2183 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-14598 | 1 Oracle | 1 Customer Relationship Management Gateway For Mobile Devices | 2024-11-21 | 6.4 MEDIUM | 9.1 CRITICAL |
| Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite (component: Setup of Mobile Applications). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Gateway for Mobile Devices. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle CRM Gateway for Mobile Devices accessible data as well as unauthorized access to critical data or complete access to all Oracle CRM Gateway for Mobile Devices accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). | |||||
| CVE-2020-14275 | 1 Hcltechsw | 1 Hcl Commerce | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations. | |||||
| CVE-2020-14189 | 1 Atlassian | 1 Jira Comment | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment. | |||||
| CVE-2020-14188 | 1 Atlassian | 1 Jira Create | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue. | |||||
| CVE-2020-14131 | 1 Mi | 1 Xiaomi | 2024-11-21 | N/A | 9.8 CRITICAL |
| The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe access of millions of Xiaomi users worldwide Life. | |||||
| CVE-2020-14129 | 1 Mi | 1 Xiaomi | 2024-11-21 | N/A | 9.8 CRITICAL |
| A logic vulnerability exists in a Xiaomi product. The vulnerability is caused by an identity verification failure, which can be exploited by an attacker who can obtain a brief elevation of privilege. | |||||
| CVE-2020-14072 | 1 Mk-auth | 1 Mk-auth | 2024-11-21 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts. | |||||
| CVE-2020-13931 | 1 Apache | 1 Tomee | 2024-11-21 | 6.8 MEDIUM | 9.8 CRITICAL |
| If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case. | |||||
| CVE-2020-13909 | 1 Facade | 1 Ignition | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix. | |||||
| CVE-2020-13802 | 1 Erlang | 1 Rebar3 | 2024-11-21 | 10.0 HIGH | 9.8 CRITICAL |
| Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification. | |||||
| CVE-2020-13693 | 1 Bbpress | 1 Bbpress | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. | |||||
| CVE-2020-13665 | 1 Drupal | 1 Drupal | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1. | |||||
| CVE-2020-13420 | 1 Openiam | 1 Openiam | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script. | |||||
| CVE-2020-13417 | 4 Apple, Aviatrix, Linux and 1 more | 6 Macos, Controller, Gateway and 3 more | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters. | |||||
| CVE-2020-12889 | 1 Misp | 1 Misp-maltego | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. | |||||
| CVE-2020-12856 | 3 Alberta, Health, Tracetogether | 3 Abtracetogether, Covidsafe, Tracetogether | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used. | |||||
| CVE-2020-12821 | 1 Protocol | 1 Gossipsub | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack. | |||||
| CVE-2020-12773 | 1 Realtek | 1 Adsl Router Soc Firmware | 2024-11-21 | 6.5 MEDIUM | 9.6 CRITICAL |
| A security misconfiguration vulnerability exists in the SDK of some Realtek ADSL/PON Modem SoC firmware, which allows attackers using a default password to execute arbitrary commands remotely via the build-in network monitoring tool. | |||||
| CVE-2020-12083 | 1 Flexera | 1 Flexnet Code Insight | 2024-11-21 | 6.5 MEDIUM | 9.9 CRITICAL |
| An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64). | |||||
| CVE-2020-11998 | 2 Apache, Oracle | 7 Activemq, Communications Diameter Signaling Router, Communications Element Manager and 4 more | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13 | |||||