Fortinet Warns of Active Exploitation of FortiOS SSL VPN 2FA Bypass Vulnerability

Fortinet on Wednesday said it observed "recent abuse" of a five-year-old security flaw in FortiOS SSL VPN in the wild under certain configurations. The vulnerability in question is CVE-2020-12812 CVSS score: 5.2, an improper authentication vulnerability in SSL VPN in FortiOS that could allow a us...

CVE-2020-25200

creationtimestamp| type| source ---|---|--- 2025-12-23 21:02:57+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3maonj3d4kn2g...

CVE-2020-9402

creationtimestamp| type| source ---|---|--- 2025-12-23 00:53:09+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/dast/cves/2020/CVE-2020-9402.yaml 2025-12-30 21:02:58+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mbaarl7egx2l...

Security Bulletin: Vulnerability in Perl affects IBM Netezza Appliance

Summary The Perl package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2020-10543, CVE-2020-10878, CVE-2020-12723, CVE-2025-40909 Vulnerability Details CVEID:CVE-2020-10543 DESCRIPTION: Perl before 5.30.3 on 32-bit platforms allows a heap-based buff...

EUVD-2025-203312

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

MJML before 5.0.0-alpha.9 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

VulnCheck KEV: CVE-2020-27866

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this...

PT-2025-51175

Name of the Vulnerable Software and Affected Versions MJML versions through 4.18.0 Description The software contains a directory traversal flaw within the mj-include functionality. This allows an attacker to check for the existence of files and, in cases where the type is set to "css", read files...

CVE-2020-0014

creationtimestamp| type| source ---|---|--- 2025-12-12 09:00:05+00:00| published-proof-of-concept| Telegram/EftIdxh0m82pCg23mhioS-smQ0jukHsVEz7My1KFRejYJM...

Exploit for CVE-2020-1938

Ghostcat Scanner - CVE-2020-1938 A powerful Python exploit to...

TrippLite SU2200RTXL2Ua Improper Neutralization of Input During Web Page Generation (CVE-2020-26801)

A stored cross-site scripting XSS vulnerability was discovered in /Forms/devicevars1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vulnerability allows authenticated attackers to obtain other users' information via a crafted POST request. This plugin only works with Tenable.ot...

CVE-2020-36884

creationtimestamp| type| source ---|---|--- 2025-12-10 23:04:40+00:00| seen| https://bsky.app/profile/potato.software/post/3m7o6asw2mt2r...

CVE-2020-36888

creationtimestamp| type| source ---|---|--- 2025-12-10 22:18:57+00:00| seen| https://bsky.app/profile/potato.software/post/3m7o3p2rfwm24...

CVE-2020-36897

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write a...

CVE-2020-36901

UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new...

CVE-2020-36898

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to delete arbitrary file...

CVE-2020-36894

Eibiz i-Media Server Digital Signage 3.8.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through AMF-encoded object manipulation. Attackers can send crafted serialized objects to the /messagebroker/amf endpoint to create administrative...

CVE-2020-36893

Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system...

CVE-2020-36898

Summary: CVE-2020-36898 affects QiHang Media Web Digital Signage 3.0.9, exposing an unauthenticated file-deletion vulnerability in the QH.aspx endpoint. The issue allows a remote attacker to delete arbitrary files by POSTing a radius of file paths using directory traversal via the data parameter,...

CVE-2020-36885 Sony IPELA Network Camera 1.82.01 Remote Stack Buffer Overflow via ftpclient.cgi

Sony IPELA Network Camera 1.82.01 contains a stack buffer overflow vulnerability in the ftpclient.cgi endpoint that allows remote attackers to execute arbitrary code. Attackers can exploit the vulnerability by sending a crafted POST request with oversized data to the FTP client functionality,...