PT-2020-17684

Name of the Vulnerable Software and Affected Versions HPAV2 system affected versions not specified Description The issue allows authenticated and encrypted payload MMEs to be forged and remotely sent to any HPAV2 system. This can be achieved by using a jailbreak key that can be recovered from the...

CVE-2020-15099

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code HMAC-SHA1 - either by using a different existing vulnerability or in case t...

CVE-2020-12638: Improper Authentication

An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266NONOSSDK devices through 3.0.3, and ESP8266RTOSSDK devices through 3.3. Broadcasting forged beacon frames forces a device to change its authentication mode to OPEN, effectively disabling its 802.11 encrypti...

PT-2020-13177

Name of the Vulnerable Software and Affected Versions Espressif ESP-IDF versions through 4.2 ESP8266 NONOS SDK versions through 3.0.3 ESP8266 RTOS SDK versions through 3.3 Description An encryption-bypass issue allows broadcasting of forged beacon frames to force a device to change its...

CVE-2020-5767

Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link...

Cross site request forgery (csrf)

Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link...

CVE-2020-5767

Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link...

CVE-2020-5767

Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link...

CVE-2020-5767

CVE-2020-5767 concerns a cross-site request forgery in the WordPress plugin “Email Subscribers & Newsletters” by Icegram, specifically version 4.4.8. The vulnerability allows a remote attacker to cause the affected WordPress user to send forged emails by tricking them into visiting a crafted link...

PT-2020-18688

Name of the Vulnerable Software and Affected Versions Icegram Email Subscribers & Newsletters Plugin for WordPress version 4.4.8 Description The issue allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link, due to cross-site request forgery...

CVE-2020-5767: Cross-Site Request Forgery (CSRF)

Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link...

NETGEAR Router CSRF

The vulnerability of the embedded software of NETGEAR routers such as NETGEAR RBK752, NETGEAR RBK753, NETGEAR RBK753S, NETGEAR RBR750, NETGEAR RBS750, NETGEAR RBK842, NETGEAR RBR840, NETGEAR RBS840, NETGEAR RBK852, NETGEAR RBK853, NETGEAR RBR850, and NETGEAR RBS850 is related to the manipulation ...

Authentication flaw

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6...

CVE-2020-4074

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands. The problem is fixed in 1.7.6.6...

PT-2020-17863 · Prestashop · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions 1.5.0.0 through 1.7.6.6 PrestaShop versions 1.5.0.0 through 1.7.7.6 is not used because 1.7.6.6 is the fixed version mentioned in the NVD source which has higher priority than Telegram. Description: The authentication syst...

kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS

A flaw was discovered in the Linux kernel's USB subsystem in the usbgetextradescriptor function in the drivers/usb/core/usb.c which mishandles a size check during the reading of an extra descriptor data. By using a specially crafted USB device which sends a forged extra descriptor, an unprivilege...

kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS

A flaw was discovered in the Linux kernel's USB subsystem in the usbgetextradescriptor function in the drivers/usb/core/usb.c which mishandles a size check during the reading of an extra descriptor data. By using a specially crafted USB device which sends a forged extra descriptor, an unprivilege...

CVE-2020-14204

In WebFOCUS Business Intelligence 8.0 SP6, the administration portal allows remote attackers to read arbitrary local files or forge server-side HTTP requests via a crafted HTTP request to /ibiapps/WFServlet.cfg because XML external entity injection is possible. This is related to making changes t...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-35448)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.8.2, 3.7.5 and 3.6.7. An attacker can exploit the vulnerability to add a forged link to an email notification...

kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS

A flaw was discovered in the Linux kernel's USB subsystem in the usbgetextradescriptor function in the drivers/usb/core/usb.c which mishandles a size check during the reading of an extra descriptor data. By using a specially crafted USB device which sends a forged extra descriptor, an unprivilege...