CVE-2020-5849

Summary (CVE-2020-5849) Unraid 6.8.0 contains an authentication bypass that can lead to remote code execution when exploited alongside the related issue (CVE-2020-5847). The Nessus plugin notes that Unraid

CVE-2020-5847

Unraid 6.8.0 and earlier contains two CVEs: CVE-2020-5847 (remote code execution via insecure use of PHP extract) and CVE-2020-5849 (authentication bypass). Reports and exploit references (Metasploit module and Exploit-DB) confirm practical impact: authenticated admin access can be gained, then a...

CVE-2020-0796

CVE-2020-0796 (SMBGhost) is a Windows SMBv3 Client/Server remote code execution vulnerability. The CIRCL sighting notes publicly available PoC activity and a Metasploit module trajectory, indicating a pre-auth RCE path via SMBv3 processing. References cited include PoC/exploit context for SMBGhos...

CVE-2020-0787

CVE-2020-0787 is a privilege-escalation flaw in Microsoft Windows BITS (Background Intelligent Transfer Service) caused by improper handling of symbolic links. The issue can allow an attacker who can run code on a vulnerable host to escalate to system-level privileges and execute arbitrary code. ...

CVE-2020-10181

Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 is affected by a cross-site request forgery (CSRF) vulnerability (CVE-2020-10181) in goform/formEMR30 that enables creation of arbitrary administrator users. Exploitation demonstrated via a payload like setString=new_useradministrator sent to /...

CVE-2020-6207

CVE-2020-6207 affects SAP Solution Manager 7.2, specifically the End User Experience Monitoring (EEM) servlet. The vulnerability is due to missing authentication checks, allowing unauthenticated access that can compromise all connected SMDAgents and enables remote code execution or command execut...

CVE-2020-0069

The CVE-2020-0069 issue affects MediaTek CMDQ driver ioctl handlers in Android kernel, where insufficient input sanitization and missing SELinux restrictions can cause an out-of-bounds write, enabling local privilege escalation without extra privileges or user interaction. Public material confirm...

CVE-2020-0041

CVE-2020-0041 affects the Android kernel binder subsystem: in binder_transaction there is an out-of-bounds write caused by an incorrect bounds check, enabling local privilege escalation with no user interaction. The vulnerability is documented across multiple advisories (upstream kernel/UTSA entr...

CVE-2016-11021

The CVE-2016-11021 entry concerns D-Link DCS-930L devices with version 2.12 and earlier. The vulnerability arises from a flaw in the setSystemCommand handling, allowing a remote attacker to execute arbitrary OS commands via the SystemCommand parameter. The Red Hat, CISA KEV, CVE records and PT-Se...

CVE-2020-10221

CVE-2020-10221 (rConfig) is a remote code execution vulnerability in the rConfig utility. Multiple connected sources confirm that lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection flaw that allows an attacker to execute arbitrary OS commands, by injecting shell metacharacters ...

CVE-2020-10189

CVE-2020-10189 affects Zoho ManageEngine Desktop Central prior to build 10.0.474, enabling unauthenticated remote code execution via deserialization of untrusted data in FileStorage.getChartImage related to CewolfServlet/MDMLogUploaderServlet. Connected reports confirm real-world exploitation (e....

CVE-2019-20500

CVE-2019-20500 affects D-Link DWL-2600AP devices with firmware 4.2.0.15 Rev A. An authenticated OS command injection exists via the Web interface Save Configuration functionality, exploiting shell metacharacters in admin.cgi?action=config_save and related parameters (configBackup or downloadServe...

CVE-2020-10173

CVE-2020-10173 affects Comtrend VR-3033 routers (DE11-416SSG-C01_R02.A2pvI042j1.d26m). The flaw is Multiple Authenticated Command Injection via the ping and traceroute diagnostic pages, demonstrated by shell metacharacters in the pingIpAddress parameter to ping.cgi. Exploitation requires at least...

CVE-2020-9054

CVE-2020-9054 (ZyXEL NAS) affects ZyXEL NAS devices on firmware v5.21 and earlier (NAS326, NAS520, NAS540, NAS542) where the weblogin.cgi authentication path fails to sanitize the username, enabling pre-authentication command injection. The vulnerability can allow an unauthenticated remote attack...

CVE-2020-9757

Craft CMS SEOmatic component before 3.3.0 is vulnerable to Server-Side Template Injection that can lead to remote code execution via malformed data submitted to the metacontainers controller. The CVE-2020-9757 entry is corroborated by multiple connected documents (Nuclei template, Red Hat advisor...

CVE-2019-17026

CVE-2019-17026 describes a type-confusion vulnerability in the IonMonkey JIT used by Mozilla products. The issue stems from incorrect alias information when storing array elements, enabling a type confusion that could be exploited for arbitrary code execution. Affected products include Firefox ES...

CVE-2020-9547

CVE-2020-9547 involves jackson-databind 2.x before 2.9.10.4 where deserialization gadget typing interaction (related to ibatis-sqlmap) enables likely remote code execution. Connected IBM advisories enumerate multiple CBEs in jackson-databind and show affected IBM products; remediation guidance ge...

CVE-2020-9548

CVE-2020-9548 affects Cloudera Data Platform Private Cloud Base (IBM) 7.1.9. It is a deserialization vulnerability in FasterXML jackson-databind 2.x up to 2.9.10.3/4 where interaction between serialization gadgets and typing (relating to br.com.anteros.dbcp.AnterosDBCPConfig) can lead to remote c...

CVE-2020-6418

CVE-2020-6418 (Google Chrome / Chromium V8 type confusion) is a remote code-execution risk caused by a type confusion in V8 before version 80.0.3987.122, allowing heap corruption via a crafted HTML page. Public references confirm multiple advisories and fixes across distributions: Debian fixed in...

CVE-2020-3837

CVE-2020-3837 is an Apple memory-corruption issue fixed in iOS 13.3.1, iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, and watchOS 6.1.2, with potential to run arbitrary code with kernel privileges. Connected analysis documents reveal concrete Android exploitation research tied to this CVE fa...