CVE-2020-27932

CVE-2020-27932 is a kernel-type-confusion issue in Apple’s XNU (mach turnstiles) that could allow a malicious app to execute code with kernel privileges. Connected sources confirm the root cause as a type confusion in kernel IPC machinery and note exploitation in-the-wild only in a macOS/iOS/macO...

CVE-2020-29597

Summary: CVE-2020-29597 affects IncomCMS 2.0, with an insecure file upload in modules/uploader/showcase/script.php that allows unauthenticated upload of files to the server. The issue is documented across multiple sources (NVD entry, Red Hat advisory, CNVD, CNVD- and CIRCL references, and exploit...

CVE-2020-15257

The CVE describes a privilege-escalation issue in containerd where access controls on the shim API socket allowed a container in the same network namespace to run new processes with elevated privileges. Affected releases are containerd before 1.3.9 and before 1.4.3; the vulnerability stems from e...

CVE-2015-9550

CVE-2015-9550 affects TOTOLINK A850R-V1 (1.0.1-B20150707.1612) and F1-V2 (1.1-B20150708.1646). A crafted packet sent to the WAN interface can cause the WAN web management interface to be opened. Root cause: reception of a specific hel,xasf packet triggering exposure of the WAN UI. Impact describe...

CVE-2015-9551

The CVE-2015-9551 entry concerns TOTOLINK A850R-V1 (firmware 1.0.1-B20150707.1612) and F1-V2 (firmware 1.1-B20150708.1646) with Remote Code Execution in the management interface via the formSysCmd parameter. The available documents identify the affected products and the attack vector but do not p...

CVE-2020-13942

CVE-2020-13942 affects Apache Unomi before 1.5.2, where OGNL/MVEL-based input could lead to remote code execution via the /context.json endpoint. The root cause is unsafely evaluating scripting expressions in conditions, allowing an attacker to invoke Java classes and functions; multiple public P...

CVE-2020-4006

CVE-2020-4006 (VMware) is a remote command-injection flaw in VMware Workspace ONE Access, Access Connector, Identity Manager, and Identity Manager Connector. A attacker with network access to the administrative configurator (port 8443) and valid credentials could execute commands with unrestricte...

CVE-2020-13671

CVE-2020-13671 affects Drupal Core. The issue arises from Drupal core not properly sanitizing certain uploaded filenames, causing files to be interpreted with an incorrect extension and served with the wrong MIME type or potentially executed as PHP under some hosting configurations. Affected vers...

CVE-2020-28948

CVE-2020-28948 affects Archive_Tar (PHP PEAR) up to version 1.4.10/1.4.11, where an unserialization flaw occurs because phar: is blocked but PHAR: is not blocked. This can enable write operations via directory traversal when processing crafted archives (documented as a related vulnerability to CV...

CVE-2020-28949

CVE-2020-28949 affects PEAR Archive_Tar (v1.4.10 and earlier). The issue is that Archive_Tar’s filename sanitization only addressed phar attacks; other stream-wrapper attacks (e.g., file://) can overwrite files, enabling potential arbitrary file writes. Affected ecosystem includes PHP-pear compon...

CVE-2019-20933

InfluxDB before 1.7.6 contains an authentication bypass in the authenticate function (services/httpd/handler.go) where a JWT token may carry an empty SharedSecret. This can allow an attacker to bypass authentication and gain unauthorized access, potentially enabling data modification or administr...

Shenzhen Yuanmeng Cloud Technology Co., Ltd. WeiPHP has file reading vulnerability

WeiPHP is an open source microsoft public platform development framework. Shenzhen Yuanmeng Yun Technology Co., Ltd WeiPHP has a file reading vulnerability, which can be exploited by attackers to obtain sensitive information...

CVE-2020-13638

CVE-2020-13638 affects the rConfig product (3.9.x) where lib/crud/userprocess.php contains an authentication bypass that can lead to administrator account creation. The issue is explicitly described as bypassing authentication and enabling admin account creation, with a fixed release in 3.9.7 (up...

CVE-2020-1599

CVE-2020-1599 is referenced in connected material (notably Microsoft ZLoader defense-evasion coverage) as a vulnerability used to aid attacker techniques (e.g., signing/validating files to mask malice). The documents do not provide concrete technical details on the root cause, affected products/v...

CVE-2020-17087

CVE-2020-17087 is a Windows Kernel Local Privilege Escalation vulnerability tied to a heap-based overflow in cng.sys. Connected exploit sources describe a local-vector attack requiring initial code execution, then abusing an IOCTL to .\\.GLOBALROOT\Device\Cng with a crafted size parameter that ca...

CVE-2020-17049

CVE-2020-17049 is a Kerberos KDC service-ticket delegation bypass in IBM Application Gateway, enabling a compromised service using Kerberos Constrained Delegation to tamper with service tickets and force KDC acceptance. The vulnerability affects IBM Application Gateway versions 19.12–24.06. IBM’s...

CVE-2020-13927

Apache Airflow CVE-2020-13927: An authentication bypass existed in the Experimental API where unauthenticated requests could be processed by default in older Airflow versions. The issue was mitigated by changing the default from allowing all API requests to denying them by default starting with A...

CVE-2020-25592

CVE-2020-25592 affects SaltStack Salt via salt-netapi, where eauth credentials/tokens are not properly validated, allowing an unauthenticated user to bypass authentication and invoke Salt SSH. Evidence in connected advisories confirms the issue and that multiple distributions issued fixes (e.g., ...

CVE-2020-16846

CVE-2020-16846 affects SaltStack Salt via the Salt API SSH Client. The issue allows an unauthenticated, network-accessible user to execute arbitrary commands by injecting shell commands through crafted requests to the Salt API when the SSH client is enabled. The vulnerability is cited across mult...

CVE-2020-27387

HorizontCMS 1.0.0-beta is affected by an unrestricted PHP file upload vulnerability in the FileManager. An authenticated user can upload a PHP payload via /admin/file-manager/fileupload, get it renamed to a random name with a .php extension, and then trigger execution by accessing /storage/. This...