CVE-2020-8794

OpenSMTPD (vulnerable in 6.6.3p1 and earlier; fixed in 6.6.4p1/6.6.4) is affected by an out-of-bounds read in mta_io/mta_session.c when handling multi-line replies, enabling remote code execution. The issue primarily arises in the client-side code but can be triggered through server bounce handli...

CVE-2020-1938

CVE-2020-1938 (Tomcat AJP vulnerability) : The issue affects Apache Tomcat where the AJP Connector, enabled by default in several legacy releases, could be reached through untrusted networks. An attacker could exploit the configured AJP path to read arbitrary files in the web application and pote...

CVE-2020-9374

CVE-2020-9374 affects TP-Link TL-WR849N device with firmware version 0.9.1 4.16. The vulnerability is a remote command execution in the diagnostics area triggered by sending shell metacharacters to the panel’s traceroute feature, indicating a command-injection flaw in the diagnostics path. Exploi...

CVE-2020-3153

Cisco AnyConnect Secure Mobility Client for Windows is affected by CVE-2020-3153: an attacker with valid Windows credentials can exploit the installer IPC path handling to copy files to system directories with SYSTEM privileges, enabling privilege escalation (and DLL hijacking) via vpndownloader....

CVE-2020-7796

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 is vulnerable to SSRF when the WebEx zimlet is installed and the zimlet JSP is enabled. The issue is documented in CVE-2020-7796 and is corroborated by multiple sources (NVD, Nuclei template, Red Hat advisory, CNVD, osv.dev, etc.). Impact des...

CVE-2020-7209

CVE-2020-7209 affects LinuxKI Toolset v6.0-1 and earlier. A remote command execution vulnerability exists in the kivis.php endpoint where the pid parameter is passed to shell_exec, allowing arbitrary commands on the target. The issue is fixed in release 6.0-2. The vulnerability is exploitable ove...

CVE-2020-0767

Technical details for CVE-2020-0767 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2020-0713

Technical details for CVE-2020-0713 are not publicly available in the provided documents. Monitor for updates from official advisories; no affected products, vectors, or fixes are disclosed here.

CVE-2020-0712

Technical details about CVE-2020-0712 are not publicly provided in the connected documents. The available sources describe unrelated EUVD entries (malicious code/malware notes). Monitor for updates from the listed references and authoritative security advisories.

CVE-2020-0710

CVE-2020-0710 describes a remote code execution in the ChakraCore scripting engine related to how it handles objects in memory. The CVE entry cites a high impact (CVSS v3.1 base score 7.5) with network access required and user interaction needed. Affected component: ChakraCore memory object handl...

CVE-2020-0711

Technical details about CVE-2020-0711 are not publicly provided in the connected documents. The EUVD entries mention malware but do not specify affected product, root cause, impact, or remediation.

CVE-2020-0688

CVE-2020-0688 is a remote-code-execution vulnerability in Microsoft Exchange Server. The issue centers on Exchange Control Panel/ViewState deserialization and improper handling of install-time validation keys, enabling an attacker to execute code on a vulnerable server. Public sources in the conn...

CVE-2020-0686

The CVE-2020-0686 entry describes an elevation-of-privilege vulnerability in Windows Installer when MSI packages process symbolic links. Affected component: Windows Installer in Windows. Root cause: improper handling of symbolic links during MSI processing leading to privilege escalation. Impact:...

CVE-2020-0683

CVE-2020-0683 is a Windows Installer Elevation of Privilege vulnerability. The issue occurs when MSI packages process symbolic links, allowing a local attacker to bypass access restrictions and add or remove files. Technical details across connected sources confirm the affected component (Windows...

CVE-2020-0673

CVE-2020-0673 is a remote code execution vulnerability in Internet Explorer’s scripting engine related to memory handling for objects. The underlying issue is a memory corruption flaw that can be triggered via crafted objects, leading to arbitrary code execution on affected systems. The CVSS 3.1 ...

CVE-2020-0674

Technical details for CVE-2020-0674 are not publicly provided in the supplied documents; no specific affected products/versions or remediation details are present. Monitor for updates from authoritative sources.

CVE-2020-0618

CVE-2020-0618 affects Microsoft SQL Server Reporting Services (SSRS) and is a remote code execution vulnerability caused by improper handling of page requests, with deserialization of viewstate cited in some sources. The vulnerability can allow code execution on the Report Server service account,...

CVE-2020-8840

CVE-2020-8840 affects FasterXML jackson-databind 2.0.0–2.9.10.2, where missing blocking of xbean-reflect/JNDI chains (notably org.apache.xbean.propertyeditor.JndiConverter) enables JNDI injection leading to remote code execution. Affected component is jackson-databind’s deserialization path; impa...

CVE-2019-19356

CVE-2019-19356 affects Netis WF2419 routers. A authenticated attacker can achieve remote code execution as root via the router Web management page, based on vulnerable firmware versions V1.2.31805 and V2.2.36123. The root cause is lack of input sanitization in the web interface, enabling exploita...

CVE-2019-18988

CVE-2019-18988 affects TeamViewer Desktop up to 14.7.1965, where a single AES key was reused across different customer installations (used for OptionsPasswordAES). This allows an attacker who gains the key to decrypt protected data stored in registry/configuration files, potentially revealing the...