CVE-2021-3920

The CVE-2021-3920 entry concerns grav-plugin-admin for Grav CMS. The vulnerability is Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting). The issue is a stored XSS in getgrav/grav-plugin-admin per the CVE record. Affected component: grav-plugin-admin plugin; root c...

CVE-2017-3920

CVE-2017-3920 entry is rejected/not used and does not represent an active vulnerability.

SUSE: Security Advisory (SUSE-SU-2018:3920-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-3920

CVE-2020-3920 affects the UltraLog Express device management interface (Unisoon) where access authentication is not properly enforced on certain pages/functions, enabling any user to reach a privileged page for managing accounts via a system directory. Multiple sources (NVD, CNVD, CVE records, an...

CVE-2020-3920 Unisoon UltraLog Express - Broken Authentication

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

GPON ONT Home Gateway Authenticated Remote Command Execution (CVE-2019-3920)

Binary data gponcve-2019-3920.nbin...

CVE-2019-3920

CVE-2019-3920 affects Alcatel Lucent I-240W-Q GPON ONT with firmware 3FE54567BOZJ19. The vulnerability is an authenticated command-injection flaw exploitable by a remote, authenticated attacker sending a crafted HTTP request to /GponForm/device_Form?script/. The core impact is authenticated remot...

CVE-2018-3920

An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. A specially crafted 7-Zip file can cause a CRC collision, resulting in a firmware update and code execution. An attacker can insert an SDcard to trigger this vulnerability...

CVE-2018-3920

Vulnerability CVE-2018-3920 affects Yi Home Camera 27US with firmware 1.8.7.0D. A specially crafted 7-Zip file can trigger a CRC collision during firmware update via SD card, enabling local code execution on the device. Talos and NVD describe the impact as firmware-update abuse leading to arbitra...

Debian DSA-3920-1 : qemu - security update

Multiple vulnerabilities were found in qemu, a fast processor emulator : - CVE-2017-9310 Denial of service via infinite loop in e1000e NIC emulation. - CVE-2017-9330 Denial of service via infinite loop in USB OHCI emulation. - CVE-2017-9373 Denial of service via memory leak in IDE AHCI emulation....

Debian Security Advisory DSA 3920-1 (qemu - security update)

Multiple vulnerabilities were found in qemu, a fast processor emulator: CVE-2017-9310 Denial of service via infinite loop in e1000e NIC emulation. CVE-2017-9330 Denial of service via infinite loop in USB OHCI emulation. CVE-2017-9373 Denial of service via memory leak in IDE AHCI emulation...

Debian: Security Advisory (DSA-3920-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-3920

id3/ID3.cpp in libstagefright in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service device hang or reboot via a crafted file, aka internal bug 30744884...

CVE-2016-3920

id3/ID3.cpp in libstagefright in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service device hang or reboot via a crafted file, aka internal bug 30744884...

CVE-2016-3920

CVE-2016-3920 affects Android Mediaserver (libstagefright) via id3/ID3.cpp. A crafted file could cause a denial of service (device hang or reboot) in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01. Connected sources confirm the issue and note that...

Kanboard 1.0.5 Cross Site Request Forgery Vulnerability

Cross-site request forgery CSRF vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI. Product: Kanboard Vendor: http://kanboard.net/ Vulnerable Versions: 1.0....

CVE-2014-3920

Cross-site request forgery CSRF vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI...

CVE-2014-3920

Cross-site request forgery CSRF vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI...

CVE-2014-3920

CVE-2014-3920 refers to a CSRF vulnerability in Kanboard up to version 1.0.5 (fixed by vendor in 1.0.6). The issue arises from insufficient validation of the HTTP request origin, allowing a remote attacker to coerce an authenticated administrator into adding another administrative user via a save...

CVE-2014-3920

Cross-site request forgery CSRF vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a save action to the default URI...