92469 matches found
CVE-2020-24570
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue with resultant SSRF in the commb24proxy module, allowing attackers to steal session information from logged-in users with a crafted link...
CVE-2020-24057
The management website of the Verint S5120FD VerintFW042 unit features a CGI endpoint 'ipfilter.cgi' that allows the user to manage network filtering on the unit. This endpoint is vulnerable to a command injection. An authenticated attacker can leverage this issue to execute arbitrary commands as...
CVE-2020-24138
Cross Site Scripting XSS vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php...
CVE-2020-24453
Improper input validation in the IntelR EPID SDK before version 8, may allow an authenticated user to potentially enable an escalation of privilege via local access...
CVE-2020-24615
Pexip Infinity before 24.1 has Improper Input Validation, leading to temporary denial of service via SIP...
CVE-2020-24345
JerryScript through 2.3.0 allows stack consumption via function anew new Proxya,JSON.parse"",a. NOTE: the vendor states that the problem is the lack of the --stack-limit option...
CVE-2020-24381
GUnet Open eClass Platform aka openeclass before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default...
CVE-2020-24147
Server-side request forgery SSR vulnerability in the WP Smart Import wp-smart-import plugin 1.0.0 for WordPress via the file field...
CVE-2020-24462
Out of bounds write in the IntelR Graphics Driver before version 15.33.53.5161, 15.36.40.5162, 15.40.47.5166, 15.45.33.5164 and 27.20.100.8336 may allow an authenticated user to potentially enable an escalation of privilege via local access...
CVE-2020-24723
Cross Site Scripting XSS vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & Login and User Management System With admin panel 2.1...
CVE-2020-24903
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting XSS caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the...
CVE-2020-24475
Improper initialization in the BMC firmware for some IntelR Server Boards, Server Systems and Compute Modules before version 2.48.ce3e3bd2 may allow an authenticated user to potentially enable denial of service via local access...
CVE-2020-24556
A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business Security Services on Microsoft Windows may allow an attacker to create a hard link to any file on the system, which then could be manipulated to gain a privilege escalation and...
CVE-2020-24718
bhyve, as used in FreeBSD through 12.1 and illumos e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04, does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying...
CVE-2020-24525
Insecure inherited permissions in firmware update tool for some IntelR NUCs may allow an authenticated user to potentially enable escalation of privilege via local access...
CVE-2020-24457
Logic error in BIOS firmware for 8th, 9th and 10th Generation IntelR CoreTM Processors may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access...
CVE-2020-24327
Server Side Request Forgery SSRF vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites...
CVE-2020-24493
Insufficient access control in the firmware for the IntelR 700-series of Ethernet Controllers before version 8.0 may allow a privileged user to potentially enable denial of service via local access...
CVE-2020-24349
njs through 0.4.3, used in NGINX, allows control-flow hijack in njsvalueproperty in njsvalue.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface...