CVE-2020-16916

CVE-2020-16916 is a Windows elevation-of-privilege flaw in the COM server object creation path. The root cause is Windows handling of COM object creation, allowing an attacker who can log on to run a specially crafted application that exploits the vulnerability to gain elevated code execution. Mi...

CVE-2020-16899

CVE-2020-16899 is a denial-of-service vulnerability in the Windows TCP/IP stack caused by improper handling of ICMPv6 Router Advertisement packets. An attacker who can send crafted ICMPv6 RA packets to a remote Windows host could cause the system to stop responding. The CVE explicitly notes that ...

CVE-2020-16898

CVE-2020-16898 is a Windows TCP/IP remote code execution vulnerability triggered by specially crafted ICMPv6 Router Advertisement packets. The issue arises from how the Windows TCP/IP stack handles ICMPv6 RA messages, allowing an attacker to execute code on a targeted Windows host by sending craf...

CVE-2020-9934

CVE-2020-9934 describes a local macOS/TCC bypass via environment-variable poisoning. The root issue is how tccd expands HOME/USER home paths to locate the TCC.db, enabling an attacker with local access to plant a malicious TCC database and alter an app’s entitlements (e.g., microphone/camera) wit...

CVE-2020-9907

CVE-2020-9907 is an Apple AVEVideoEncoder-related memory corruption vulnerability. The issue was mitigated by removing the vulnerable code and is fixed in iOS 13.6 and iPadOS 13.6, and tvOS 13.4.8. Apple’s entry documents indicate the impact as an application potentially executing arbitrary code ...

CVE-2020-15251

CVE-2020-15251 affects the Channelmgnt plug‑in for Sopel prior to 1.0.3. The root cause is an ACL bypass that lets malicious users op/voice and take over a channel; the plug‑in is bundled with MirahezeBot‑Plugins (versions 9.0.0 through

CVE-2020-5135

CVE-2020-5135 is a buffer overflow in SonicOS affecting multiple releases (Gen 6: 6.5.4.7, 6.5.1.12, 6.0.5.3; SonicOSv: 6.5.4.v; Gen 7: 7.0.0.0). The vulnerability allows a remote attacker to cause Denial of Service and potentially execute arbitrary code by sending a malicious request to affected...

CVE-2020-26948

The CVE-2020-26948 issue affects Emby Server prior to version 4.5.0. The Nuclei template confirms a server-side request forgery (SSRF) via the Items/RemoteSearch/Image ImageURL parameter. The vulnerability enables the server to make requests to internal resources, with the CVSS 3.1 vector CVSS:3....

CVE-2020-26919

CVE-2020-26919 affects NETGEAR JGS516PE devices prior to 2.6.0.43, with a lack of function-level access control. Connected documents also describe unauthenticated remote code execution in NETGEAR ProSAFE Plus (pre-2.6.0.43) via public login pages and POST endpoints exposing debug actions (submitI...

CVE-2020-24219

CVE-2020-24219 affects URayTech IPTV/H.264/H.265 video encoders (up to v1.97). The vulnerability is a path traversal/pattern-matching flaw in unauthenticated HTTP handling that allows an attacker to read files from the device, including the configuration file containing the cleartext admin passwo...

CVE-2020-12124

Summary of verified details : The WAVLINK WN530H4 device is affected by a remote command-injection vulnerability in the /cgi-bin/live_api.cgi endpoint. Technical content in the connected nuclei template confirms unauthenticated command execution as root, with high-risk impact. The vulnerability a...

CVE-2020-15227

The CVE-2020-15227 issue affects Nette PHP framework versions prior to 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16 and 3.0.6. A code injection flaw can be triggered by specially crafted URL parameters, potentially enabling remote code execution. Modes of impact include remote compromise and arbitrary ...

CVE-2020-8243

CVE-2020-8243 affects Pulse Connect Secure, specifically the admin web interface prior to 9.1R8.2. An authenticated attacker can upload a custom template to achieve arbitrary code execution via the admin UI. The CVSSv3 base score is 7.2 (High) with network access, low attack complexity, and high ...

CVE-2020-25223

CVE-2020-25223 is a remote code execution vulnerability in the WebAdmin interface of Sophos SG UTM, exploitable without authentication. The flaw allows an unauthenticated attacker to run arbitrary commands as root via a SID-based command injection in WebAdmin. Affected versions are Sophos SG UTM ...

CVE-2020-3569

CVE-2020-3569 affects Cisco IOS XR Software DVMRP. The vulnerability stems from incorrect handling of IGMP packets, allowing an unauthenticated remote attacker to either immediately crash the IGMP process or exhaust memory, potentially destabilizing other processes (e.g., routing protocols). Expl...

CVE-2020-14181

CVE-2020-14181 affects Atlassian Jira Server/Data Center and enables an unauthenticated user to enumerate users via the /ViewUserHover.jspa endpoint due to an information disclosure flaw. Affected versions are: < 7.13.16, 8.0.0–<8.5.7, and 8.6.0–

CVE-2020-10768

CVE-2020-10768 affects the Linux kernel prior to 5.8-rc1, where prctl() can re-enable indirect branch speculation after it has been disabled, enabling Spectre v2-style disclosure. The vulnerability has Local attack vector and primarily impacts confidentiality; no exploitation details are provided...

CVE-2020-10767

CVE-2020-10767 affects the Linux kernel before 5.8-rc1, where Enhanced IBPB mitigation is disabled when STIBP is unavailable or when IBRS is available, enabling a Spectre V2–style attack on local confidentiality. Connected advisories confirm Linux kernel mitigations (IBPB/SSBD) and note a patched...

CVE-2020-10766

CVE-2020-10766 is a Linux kernel vulnerability tied to the SSBD mitigation logic, enabling a local attacker to temporarily disable SSBD during a context switch due to per-task STIPB switching. Connected advisories confirm affected kernels (e.g., Linux 5.4.x/5.8 era) and provide patch info: Debian...

CVE-2019-0230

CVE-2019-0230 affects Apache Struts 2.0.0–2.5.20 and is caused by forced double OGNL evaluation on raw user input in tag attributes, potentially enabling remote code execution. Reported impact is remote code execution with high severity (CVE CVSSv3 9.8). Mitigation documented in the sources inclu...