CVE-2020-11539

CVE-2020-11539 affects Tata Sonata Smart SF Rush v1.12. The connected sources describe a Bluetooth Low Energy security flaw where OTA data is unencrypted and there is no authentication/signature verification, allowing an attacker to influence device parameters. Root cause: lack of pairing securit...

CVE-2020-10569

SysAid On-Premise 20.1.11 is reported to expose the AJP port by default, enabling a GhostCat-related file-read/remote-command exposure and unauthenticated file uploads that can be chained to execute commands. The description explicitly links these issues to AJP access and file upload weaknesses, ...

CVE-2020-11967

CVE-2020-11967 affects IQrouter firmware up to v3.3.1. The vulnerability is caused by Incorrect Access Control, enabling remote attackers to take full device control (e.g., restart network, reboot, upgrade, reset) without authentication. Documentation consistently notes this risk is most relevant...

CVE-2020-11968

CVE-2020-11968 affects IQrouter web-panel up to version 3.3.1, where an incorrect access control allows remote readers to view system logs. The core issue is access control weakness in the web UI, not an execution bug by default. Public notes consistently mention this can occur on brand-new netwo...

CVE-2020-11966

IQrouter vulnerable through version 3.3.1: the web-panel Lua function reset_password can be invoked remotely to arbitrarily change the root password. Affected: IQrouter firmware up to 3.3.1 (brand-new/unconfigured networks discussed in sources). Underlying issue: reset_password function exposes p...

CVE-2020-11964

IQrouter up to version 3.3.1 is affected by CVE-2020-11964 due to a vulnerability in the web-panel Lua function diag_set_password, which remote attackers can abuse to change the root password arbitrarily. Affected product: IQrouter firmware

CVE-2020-11963

CVE-2020-11963 affects IQrouter up to firmware 3.3.1. When the device is unconfigured, the web-panel is vulnerable to Bash Shell Metacharacter Injection leading to remote code execution and potential root privileges. Documented impact includes multiple RCE vectors in the web-panel; exploitation r...

CVE-2020-3161

The CVE-2020-3161 issue affects the web server used by Cisco IP Phones, where improper input validation of HTTP requests can allow an unauthenticated, remote attacker to execute code with root privileges or trigger a reload, causing a DoS. The vulnerability is tied to input validation flaws in th...

CVE-2020-1027

CVE-2020-1027 is a Windows privilege-escalation vulnerability affecting Windows kernel memory handling and the CSRSS subsystem. The Windows kernel path (memory object handling) enabled local privilege escalation via write-what-where style abuse in kernel fault paths, while the CSRSS path allowed ...

CVE-2020-1020

CVE-2020-1020 describes a remote code execution in Microsoft Windows via the Windows Adobe Font Manager Library when handling specially crafted Adobe Type 1 PostScript fonts. The flaw affects Windows versions other than Windows 10, with exploitation enabling code execution remotely after processi...

CVE-2020-1003

Technical details for CVE-2020-1003 are not publicly provided in the supplied documents; no affected products, root cause, or remediation are specified here. Monitor for authoritative updates from MSRC/NVD.

CVE-2020-1000

Technical details for CVE-2020-1000 are not publicly provided in the connected documents you supplied. Monitor for updates.

CVE-2020-0970

CVE-2020-0970 describes a remote code execution vulnerability in the ChakraCore scripting engine, arising from how the engine handles in-memory objects. It is associated with ChakraCore used by Microsoft Edge/Internet Explorer, and is explicitly distinguished from CVE-2020-0968. The connected doc...

CVE-2020-0968

CVE-2020-0968 is described as a remote code execution vulnerability in the Internet Explorer Script Engine memory handling. The connected document set also references a separate ChakraCore scripting engine memory corruption RCE (GHSA-233H-59M2-QQF2), noting a similar vulnerability class but not p...

CVE-2020-0938

CVE-2020-0938 affects the Windows Adobe Font Manager Library by improperly handling specially crafted multi-master Font 1 PostScript fonts. The root cause is a vulnerability in the font parser that can allow remote code execution when processing crafted documents. For all Windows versions except ...

CVE-2020-0913

CVE-2020-0913 is a Windows kernel elevation-of-privilege vulnerability. The initial description states an attacker could exploit improper handling of memory-resident objects to gain higher privileges. Connected sources corroborate a Windows kernel EoP class issue tied to memory object handling, w...

CVE-2020-2883

CVE-2020-2883 is an Oracle WebLogic Server deserialization vulnerability (Core) that allows unauthenticated remote code execution over network access via IIOP/T3, potentially taking over the WebLogic server. Affected Oracle Fusion Middleware WebLogic versions include 10.3.6.0.0, 12.1.3.0.0, 12.2....

CVE-2020-11738

CVE-2020-11738 affects WordPress installations using the Snap Creek Duplicator plugin (pre-1.3.28) and Duplicator Pro (pre-3.8.7.1). The vulnerability is a directory traversal flaw triggered by a ../ in the file parameter to duplicator_download or duplicator_init, enabling unauthenticated access ...

CVE-2020-3952

CVE-2020-3952 affects VMware vCenter Server’s Directory Service (vmdir) when the Platform Services Controller does not enforce access controls, enabling a network-accessible attacker (port 389) to perform an authentication bypass and potentially gain control over the vCenter Directory. Public sou...

CVE-2020-5735

CVE-2020-5735 affects Amcrest cameras and NVRs via a stack-based buffer overflow over port 37777. The vulnerability allows an authenticated remote attacker to crash the device and potentially execute arbitrary code. Public references (NVD, Red Hat, CISA KEV) reiterate a stack-based overflow impac...