CVE-2020-10204

CVE-2020-10204 is a remote code execution vulnerability in Sonatype Nexus Repository Manager (NXRM) prior to version 3.21.2. The affected component is Nexus Repository Manager, with the root cause described across connected advisories as an RCE in versions before 3.21.2. Publicly available materi...

CVE-2020-1943

CVE-2020-1943 affects Apache OFBiz 16.11.01–16.11.07. The vulnerability is a cross-site scripting flaw caused by unsanitized data sent with the contentId parameter to the /control/stream endpoint. Impact, as reported, is execution of malicious scripts in the victim’s browser (potential session-re...

CVE-2020-11455

CVE-2020-11455 affects LimeSurvey versions before 4.1.12+200324, exposing a path traversal vulnerability in the file manager (application/controllers/admin/LimeSurveyFileManager.php). The vulnerability in the getZipFile path traversal allows arbitrary file download, with reports noting the retrie...

CVE-2020-7065

CVE-2020-7065 concerns PHP mb_strtolower() with UTF-32LE encoding. Affects PHP 7.3.x below 7.3.16 and 7.4.x below 7.4.4; invalid strings can cause a stack-allocated buffer overrun, leading to memory corruption, crashes, and potential code execution. Publicly documented fixes appear in PHP 7.3.16+...

CVE-2020-7064

CVE-2020-7064 is a PHP EXIF parsing vulnerability: when exif_read_data() processes EXIF data, malicious input may cause PHP to read one byte of uninitialized memory, enabling information disclosure or a crash. Affected are PHP 7.2.x below 7.2.9, 7.3.x below 7.3.16, and 7.4.x below 7.4.4. The issu...

CVE-2020-5284

Next.js versions before 9.3.2 are vulnerable to a local file traversal in the dist directory (.next). Attackers can craft HTTP requests to access files within dist/.next, potentially leading to information disclosure. The issue does not affect files outside dist/.next. A fix is available in Next....

CVE-2020-10828

CVE-2020-10828 is a stack-based buffer overflow in the cvmd process on DrayTek Vigor3900, Vigor2960, and Vigor300B devices. Versions prior to 1.5.1 are affected and allow remote code execution via a crafted remote HTTP request. This is confirmed by multiple sources in connected documents (vendor ...

CVE-2020-10827

CVE-2020-10827 refers to a stack-based buffer overflow in the apmd service on Draytek Vigor3900, Vigor2960, and Vigor300B devices. The vulnerability, present in firmware prior to 1.5.1, allows remote code execution via a crafted HTTP request. Multiple connected sources corroborate the affected mo...

CVE-2020-10826

CVE-2020-10826 affects DrayTek Vigor3900, Vigor2960, and Vigor300B before version 1.5.1. The issue allows remote command injection via a crafted HTTP request to /cgi-bin/activate.cgi when DEBUG mode is enabled, enabling an attacker to execute arbitrary commands on affected devices. The root cause...

CVE-2020-5722

The Grandstream UCM6200 series (UCM62xx) is affected by CVE-2020-5722: an unauthenticated remote SQL injection via crafted HTTP requests in the HTTP interface, with potential to execute shell commands as root on versions before 1.0.19.20 and to inject HTML in password recovery emails on versions ...

CVE-2020-8497

Artica Pandora FMS

CVE-2020-7961

The CVE-2020-7961 issue affects Liferay Portal’s JSONWS deserialization of untrusted data, enabling unauthenticated remote code execution. Vulnerable software is Liferay Portal prior to 7.2.1 CE GA2, where the root cause is unsafe deserialization in JSONWebServiceActionParameters processed via JS...

CVE-2019-19351

CVE-2019-19351 affects the container openshift/jenkins-slave-base-rhel7-container used in OpenShift 4 and 3.11. The vulnerability is an insecure modification of /etc/passwd inside the container, enabling privilege escalation if an attacker gains container access. Related advisories (Red Hat RHSA-...

CVE-2020-8598

CVE-2020-8598 affects Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security servers (9.0/9.5/10.0). The vulnerability is in a server component: a vulnerable service DLL that could allow an unauthenticated remote attacker to execute arbitrary code with SYSTEM privileges. Publ...

CVE-2020-8470

The CVE-2020-8470 entry concerns Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security server components. A vulnerable service DLL on the server could allow an unauthenticated attacker to delete arbitrary files with SYSTEM privileges. Public references indicate this is one o...

CVE-2020-8599

CVE-2020-8599 affects Trend Micro Apex One (2019) and OfficeScan XG servers. The issue is in a vulnerable EXE on the server that could let an unauthenticated remote attacker write arbitrary data to an arbitrary path and bypass ROOT login. The description indicates no authentication is required to...

CVE-2020-8467

CVE-2020-8467 affects Trend Micro Apex One (2019) and OfficeScan XG via a vulnerability in the migration tool component that enables remote code execution. The attack requires user authentication to be attempted. NVD scoring indicates high impact (CVSSv3.1 base 8.8; HIGH). CISA KEV catalogs this ...

CVE-2020-8468

CVE-2020-8468 affects Trend Micro Apex One (2019), OfficeScan XG and Worry‑Free Business Security agents. Described as a content validation escape vulnerability that could allow an attacker to manipulate agent client components; an attack requires user authentication. The connected documents prov...

CVE-2020-3950

Mode C: CVE-2020-3950 affects VMware Fusion (11.x up to 11.5.1/11.5.2), VMware Remote Console for Mac (11.x up to 11.0.1), and Horizon Client for Mac (5.x up to 5.4.0). Root cause: improper use of setuid binaries enabling local privilege escalation from a normal user to root on systems running th...

CVE-2020-5849

Summary (CVE-2020-5849) Unraid 6.8.0 contains an authentication bypass that can lead to remote code execution when exploited alongside the related issue (CVE-2020-5847). The Nessus plugin notes that Unraid