PT-2020-6758 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to insufficient protection of credentials in the Zyxel CloudCNM SecuManager software, which can allow a remote attacker to gain full access to devices o...

PT-2020-14364 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue is related to weak permissions in the /opt/axess/var/blobstorage/ directory. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting access to the...

PT-2020-14377 · Zyxel · Zyxel Cloudcnm Secumanager

Name of the Vulnerable Software and Affected Versions: Zyxel CloudCNM SecuManager versions 3.1.0 through 3.1.1 Description: The issue concerns an unauthenticated API endpoint, specifically the "zy get user id and key" API. Recommendations: For versions 3.1.0 and 3.1.1, consider restricting access...

PT-2020-14549 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations without requiring authentication. The flaw exists within the ajax dashboard.php file,...

PT-2020-14538 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax ftp...

PT-2020-13878 · Paessler · Prtg Network Monitor

Name of the Vulnerable Software and Affected Versions: PRTG Network Monitor version 20.1.56.1574 Description: The issue allows an attacker with Read/Write privileges to create a map and insert JavaScript code using the Map Designer Properties screen. This can be exploited against any user with Vi...

PT-2020-6431 · Nextcloud +1 · Nextcloud Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client versions prior to 3.3.1 Description: The issue is related to the lack of SSL certificate verification when using the "Register with a Provider" flow in the Nextcloud Desktop Client, allowing a remote attacker to impac...

PT-2020-14070 · Squirrelmail · Squirrelmail

Name of the Vulnerable Software and Affected Versions: SquirrelMail version 1.4.22 Description: The issue arises in compose.php, where the $attachments value from an HTTP POST request is passed to unserialize. This could potentially lead to PHP object injection. However, the vendor disputes this,...

PT-2020-14012 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.21.0 Description: An issue was discovered that allows directory traversal via HTTP. This issue affects Mattermost Server and is related to the mmctl component. Recommendations: For versions prior to 5.21....

PT-2020-13893 · Ngircd · Ngircd

Name of the Vulnerable Software and Affected Versions: ngIRCd versions prior to 26rc2 Description: The Server-Server protocol implementation in ngIRCd allows an out-of-bounds access, as demonstrated by the IRC NJOIN function. Recommendations: For versions prior to 26rc2, update to version 26rc2 o...

PT-2020-13229 · Redash · Redash

Name of the Vulnerable Software and Affected Versions: Redash open-source versions 8.0.0 and prior Description: An authenticated Server-Side Request Forgery SSRF was discovered via the JSON data source. This issue provides flexibility in crafting HTTP requests, such as adding headers and selectin...

PT-2020-13812 · New Media Nv · Dd-Wrt

Name of the Vulnerable Software and Affected Versions: DD-WRT versions through 16214 Description: An issue in the Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host field of the ping command. Exploitation through CSRF might be possible. The...

Universal Plug and Play (UPnP) SUBSCRIBE can be abused to send traffic to arbitrary destinations

Overview The Universal Plug and Play UPnP protocol in effect prior to April 17, 2020 can be abused to send traffic to arbitrary destinations using the SUBSCRIBE functionality. Description The UPnP protocol, as specified by the Open Connectivity Foundation OCF, is designed to provide automatic...

PT-2020-20206

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to 1.15.12 Kubernetes versions prior to 1.16.9 Kubernetes versions prior to 1.17.5 Kubernetes versions 1.0 through 1.14 Kubernetes version 1.18.0 Description The issue allows certain authorized users to leak up to 500...

PT-2020-8637 · Grafana · Grafana

Name of the Vulnerable Software and Affected Versions: Grafana version 5.3.1 Description: The issue is related to an incomplete fix, resulting in a XSS vulnerability via the "Dashboard Text Panel" screen. This allows for potential exploitation. Recommendations: For Grafana version 5.3.1, consider...

PT-2020-13516 · Tenda · Tenda Ac6 +3

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 1.0 V15.03.05.19 multi TD01 Tenda AC9 version 1.0 V15.03.05.196318 CN Tenda AC9 version 3.0 V15.03.06.42 multi Tenda AC15 version 1.0 V15.03.05.19 multi TD01 Tenda AC18 version 15.03.05.196318 CN Description: A buffer overfl...

PT-2020-12536 · Puma +4 · Puma +4

Name of the Vulnerable Software and Affected Versions: Puma versions prior to 3.12.6 Puma versions prior to 4.3.5 Description: A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the...

PT-2020-13349 · Squid +1 · Squid Proxy +1

Name of the Vulnerable Software and Affected Versions: D-Link DSP-W215 version 1.26b03 Description: The issue allows information disclosure by intercepting messages on the local network. This can be demonstrated using a Squid Proxy. Recommendations: For D-Link DSP-W215 version 1.26b03, consider...

PT-2020-13350 · D Link · D-Link Dsp-W215

Name of the Vulnerable Software and Affected Versions: D-Link DSP-W215 version 1.26b03 Description: The issue concerns the transmission of an obfuscated hash by the device, which can be intercepted and decoded by a network sniffer. Recommendations: For D-Link DSP-W215 version 1.26b03, consider...

PT-2020-10768 · Cherokee · Cherokee

Name of the Vulnerable Software and Affected Versions: Cherokee versions 1.2.104 and earlier Description: A cross-site scripting XSS issue was discovered in the handler server info.c file. The requested URL is improperly displayed on the About page in the default configuration of the web server a...