Total
318114 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-13896 | 1 Maipu | 2 Mp1800x-50, Mp1800x-50 Firmware | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| The web interface of Maipu MP1800X-50 7.5.3.14(R) devices allows remote attackers to obtain sensitive information via the form/formDeviceVerGet URI, such as system id, hardware model, hardware version, bootloader version, software version, software image file, compilation time, and system uptime. This is similar to CVE-2019-1653. | |||||
| CVE-2020-13895 | 1 P5-crypt-perl Project | 1 P5-crypt-perl | 2024-11-21 | 6.8 MEDIUM | 8.8 HIGH |
| Crypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 (prime256v1). This could conceivably have a security-relevant impact if an attacker wishes to use public r and s values when guessing whether signature verification will fail. | |||||
| CVE-2020-13894 | 1 Dext5 | 1 Dext5 | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field. | |||||
| CVE-2020-13893 | 1 Sage | 1 Easypay | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations (Best-fit Mapping), as demonstrated by the full-width variants of the less-than sign (%EF%BC%9C) and greater-than sign (%EF%BC%9E). | |||||
| CVE-2020-13892 | 1 Themeboy | 1 Sportspress | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| The SportsPress plugin before 2.7.2 for WordPress allows XSS. | |||||
| CVE-2020-13891 | 1 Mattermost | 1 Mattermost | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022. | |||||
| CVE-2020-13890 | 1 Laborator | 1 Neon | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard. | |||||
| CVE-2020-13889 | 1 Bludit | 1 Bludit | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| showAlert() in the administration panel in Bludit 3.12.0 allows XSS. | |||||
| CVE-2020-13888 | 1 Kordil Edms Project | 1 Kordil Edms | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| Kordil EDMS through 2.2.60rc3 allows stored XSS in users_edit.php, users_management_edit.php, and user_management.php. | |||||
| CVE-2020-13887 | 1 Kordil Edms Project | 1 Kordil Edms | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| documents_add.php in Kordil EDMS through 2.2.60rc3 allows Remote Command Execution because .php files can be uploaded to the documents folder. | |||||
| CVE-2020-13886 | 1 Intelbras | 6 Tip200, Tip200 Firmware, Tip200lite and 3 more | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow cgi-bin/cgiServer.exx?page=../ Directory Traversal. | |||||
| CVE-2020-13885 | 1 Citrix | 1 Workspace App | 2024-11-21 | 7.2 HIGH | 7.8 HIGH |
| Citrix Workspace App before 1912 on Windows has Insecure Permissions which allows local users to gain privileges during the uninstallation of the application. | |||||
| CVE-2020-13884 | 1 Citrix | 1 Workspace App | 2024-11-21 | 7.2 HIGH | 7.8 HIGH |
| Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows local users to gain privileges during the uninstallation of the application. | |||||
| CVE-2020-13883 | 1 Wso2 | 3 Api Manager, Api Microgateway, Identity Server As Key Manager | 2024-11-21 | 6.5 MEDIUM | 6.7 MEDIUM |
| In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a Lifecycle. | |||||
| CVE-2020-13882 | 2 Cisofy, Fedoraproject | 2 Lynis, Fedora | 2024-11-21 | 3.7 LOW | 4.2 MEDIUM |
| CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks. | |||||
| CVE-2020-13881 | 4 Arista, Canonical, Debian and 1 more | 4 Cloudvision Portal, Ubuntu Linux, Debian Linux and 1 more | 2024-11-21 | 4.3 MEDIUM | 7.5 HIGH |
| In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used. | |||||
| CVE-2020-13877 | 1 Resourcexpress | 1 Meeting Monitor | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection issues in various ASPX pages of ResourceXpress Meeting Monitor 4.9 could lead to remote code execution and information disclosure. | |||||
| CVE-2020-13873 | 1 Codologic | 1 Codoforum | 2024-11-21 | 10.0 HIGH | 9.8 CRITICAL |
| A SQL Injection vulnerability in get_topic_info() in sys/CODOF/Forum/Topic.php in Codoforum before 4.9 allows remote attackers (pre-authentication) to bypass the admin page via a leaked password-reset token of the admin. (As an admin, an attacker can upload a PHP shell and execute remote code on the operating system.) | |||||
| CVE-2020-13872 | 2 Microsoft, Royalapps | 2 Windows, Royal Ts | 2024-11-21 | 3.3 LOW | 8.8 HIGH |
| Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach. | |||||
| CVE-2020-13871 | 6 Debian, Fedoraproject, Netapp and 3 more | 12 Debian Linux, Fedora, Cloud Backup and 9 more | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. | |||||