CVE-2017-1135

Technical details for CVE-2017-1135 are not publicly available in the provided documents. Monitor for updates from the original entry and connected sources; no affected products, impact, or remediation information can be confirmed from the supplied data.

CVE-2020-10546

rConfig 3.9.4 and earlier versions are affected by an unauthenticated SQL injection in compliancepolicies.inc.php. The underlying issue is that passwords are stored in plaintext by default, enabling an attacker to execute arbitrary SQL queries and potentially move laterally to access monitored ne...

CVE-2020-10548

rConfig 3.9.4 and earlier are affected by unauthenticated SQL injection in devices.inc.php. Multiple sources (NVD, Nuclei template, OpenVAS, CNVD, Red Hat advisory) describe an SQL injection that can be exploited without authentication, with node passwords stored in plaintext by default, enabling...

CVE-2020-13379

CVE-2020-13379 is an SSRF/Incorrect Access Control flaw in Grafana avatar handling, affecting versions 3.0.1–7.0.1. An unauthenticated user can prompt Grafana to fetch arbitrary URLs and return the response, enabling network reconnaissance. Additionally, invalid URL handling could trigger a SegFa...

CVE-2020-13756

Sabberworm PHP CSS Parser vulnerability CVE-2020-13756: before 8.3.1, the code calls eval on untrusted data via getSelectorsBySpecificity() or allSelectors(), enabling potential remote code execution. Affected product is Sabberworm PHP CSS Parser (and the php-horde-css-parser bundle). The issue i...

CVE-2020-7115

CVE-2020-7115 affects Aruba Networks ClearPass Policy Manager web interface. The issue enables an authentication bypass which, once bypassed, could allow an attacker to perform an unauthenticated remote code execution on the underlying system. Public sources describe this as a remote code executi...

CVE-2020-5410

CVE-2020-5410 affects VMware/Tanzu Spring Cloud Config Server. Versions 2.2.x before 2.2.3 and 2.1.x before 2.1.9 (and older unsupported) are vulnerable to a directory-traversal where a crafted URL can cause the server to serve arbitrary configuration files. Root cause: inadequate validation in t...

CVE-2020-8816

CVE-2020-8816 : Pi-hole Web (AdminLTE) 4.3.2 is vulnerable to Remote Code Execution via a crafted DHCP static lease. Exploitation requires privileged dashboard access and is authenticated; the flaw arises from how DHCP static leases are processed, enabling an attacker with dashboard privileges to...

CVE-2020-1956

Apache Kylin CVE-2020-1956 affects 2.3.0 and releases up to 2.6.5 and 3.0.1, where REST APIs concatenate user input into OS commands, enabling likely remote code execution with high impact. Connected documents confirm vulnerable versions and the underlying command injection in the REST layer; som...

CVE-2020-1143

Technical details about CVE-2020-1143 are not provided in the connected documents; monitor for updates and new disclosures before drawing conclusions.

CVE-2020-1070

Technical details for CVE-2020-1070 are not provided in the supplied documents; only a high-level description is available. Monitor for updates.

CVE-2020-1066

CVE-2020-1066 is an elevation-of-privilege vulnerability in Microsoft .NET Framework. The issue arises from the way the framework activates COM objects, enabling a local attacker who already has access to the machine to elevate privileges by running a crafted program. Public sources (NVD/MSRC) de...

CVE-2020-1054

CVE-2020-1054 is a Win32k kernel-mode elevation of privilege vulnerability in Windows where the Windows kernel-driver mishandles memory objects. The CVE entry is distinct from CVE-2020-1143. Public references in the provided set show an exploit for CVE-2020-1054 (Out-of-bounds write in Microsoft ...

CVE-2020-1048

CVE-2020-1048 is a Windows Print Spooler elevation of privilege vulnerability. It arises from improper handling that allows arbitrary writing to the file system, enabling local privilege escalation. Public exploits/public PoCs exist (notably PrintDemon) and have been discussed alongside patch cir...

CVE-2020-6457

CVE-2020-6457 refers to a use-after-free in the speech recognizer of Google Chrome before 81.0.4044.113, which could allow a remote attacker to potentially escape the sandbox via a specially crafted HTML page. The CVE is listed in multiple sources (e.g., Debian security advisories) with remediati...

CVE-2020-13167

Affected software: Netsweeper WebAdmin (Web content filtering) up to version 6.4.3. Vulnerability type & root cause: unauthenticated remote code execution via webadmin/tools/unixlogin.php where, with certain Referer headers, the command line is invoked with client-supplied parameters allowing she...

CVE-2020-12440

CVE-2020-12440 is rejected/not used; this CVE ID does not represent an active vulnerability entry.

CVE-2020-12832

WordPress Simple File List plugin (versions

CVE-2020-9314

CVE-2020-9314 affects Oracle iPlanet Web Server 7.0.x. The issue is described as image injection in the Administration console via the productNameSrc parameter to an admingui URI, arising from an incomplete fix for CVE-2012-0516. It is part of a pair with CVE-2020-9315; while CVE-2020-9314 enable...

CVE-2020-11530

Affected software : WordPress Chop Slider 3 plugin (Chop Slider 3). Vulnerability : blind SQL injection in the id parameter of get_script/index.php. Root cause / vector : the id GET parameter is used in a SQL query without proper handling, allowing arbitrary SQL execution in the WP database conte...