CVE-2020-10929

The CVE-2020-10929 entry concerns NETGEAR R6700 devices running V1.0.4.84_10.0.58. Affected component: string table file upload handling. Root cause: improper validation of user-supplied data leading to an integer overflow during buffer allocation. Impact: remote code execution possible with no a...

CVE-2020-10928

The CVE-2020-10928 entry concerns NETGEAR R6700 routers (V1.0.4.84_10.0.58). Root cause: improper validation of the length of user-supplied data during string table file uploads, causing a heap-based buffer overflow. Impact: network-adjacent attackers can execute arbitrary code in the web server ...

CVE-2020-10928

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue...

CVE-2020-10927

The CVE-2020-10927 entry concerns NETGEAR R6700 routers (variant V1.0.4.84_10.0.58). A flaw in the encryption of firmware update images stems from an inappropriate encryption algorithm, enabling network-adjacent attackers to trigger code execution with root privileges. Authentication is not requi...

CVE-2020-10925

The CVE-2020-10925 issue affects NETGEAR R6700 devices (V1.0.4.84_10.0.58). The root cause is improper validation of the server certificate during HTTPS file downloads, enabling network-adjacent attackers to compromise integrity of downloaded information without authentication. The vulnerability ...

CVE-2020-10925

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files vi...

CVE-2020-10926

The CVE-2020-10926 issue affects NETGEAR R6700 routers running firmware version 1.0.4.84_10.0.58. The root cause is improper validation of the firmware image before performing an update, enabling a network-adjacent attacker (no authentication required) to execute arbitrary code in the router cont...

CVE-2020-10924

CVE-2020-10924 affects NETGEAR R6700 routers (e.g., V1.0.4.84_10.0.58) where the UPnP daemon (/usr/sbin/upnpd) mishandles length validation of user-supplied data, leading to a stack-based buffer overflow and potential code execution as root. The vulnerability is exploitable by network-adjacent at...

CVE-2020-10926

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results fro...

CVE-2020-10924

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

CVE-2020-10923

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A...

CVE-2020-10923

The CVE-2020-10923 vulnerability affects NETGEAR R6700 routers (e.g., firmware around V1.0.4.84_10.0.58). A flaw in the UPnP daemon (LISTENING on TCP 5000) allows network-adjacent attackers to bypass authentication via crafted UPnP messages, potentially enabling root code execution when combined ...

CVE-2020-15418

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.75020200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML Extern...

CVE-2020-15627

Affected product: CentOS Web Panel (cwp-e17.0.9.8.923). Vulnerable component: ajax_mail_autoreply.php. Root cause: improper validation when using the user-supplied account parameter to construct SQL queries, enabling information disclosure. Impact: remote attackers can disclose sensitive informat...

CVE-2020-15628

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmailautoreply.php. When parsing the user parameter, the...

CVE-2020-15628

CVE-2020-15628 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mail_autoreply.php where the parameter parsing for the user input is not properly validated before being used to build SQL queries, enabling a remote SQL injection in the root context. Authentication is not required....

CVE-2020-15625

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxaddmailbox.php. When parsing the username parameter, the...

CVE-2020-15625

CVE-2020-15625 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability resides in the ajax_add_mailbox.php component, where the username parameter is used to construct SQL queries without proper validation, enabling an unauthenticated attacker to disclose sensitive information in the cont...

CVE-2020-15626

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxdashboard.php. When parsing the term parameter, the proce...

CVE-2020-15624

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxnewaccount.php. When parsing the domain parameter, the...