Total
210374 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-13152 | 1 Kde | 1 Amarok | 2022-04-28 | 4.3 MEDIUM | 5.5 MEDIUM |
| A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will trigger a memory leak, whereby Amarok 2.8.0 continue to waste resources over time, eventually allows attackers to cause a denial of service. | |||||
| CVE-2019-20799 | 1 Cherokee-project | 1 Cherokee | 2022-04-28 | 5.0 MEDIUM | 7.5 HIGH |
| In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server. | |||||
| CVE-2020-10176 | 1 Assaabloy | 2 Yale Wipc-301w, Yale Wipc-301w Firmware | 2022-04-28 | 10.0 HIGH | 9.8 CRITICAL |
| ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43_p1 devices allow Eval Injection of commands. | |||||
| CVE-2020-10974 | 1 Wavlink | 26 Jetstream Ac3000, Jetstream Ac3000 Firmware, Jetstream Erac3000 and 23 more | 2022-04-28 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000 | |||||
| CVE-2020-10973 | 1 Wavlink | 8 Wn530hg4, Wn530hg4 Firmware, Wn531g3 and 5 more | 2022-04-28 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available. | |||||
| CVE-2021-21887 | 1 Lantronix | 2 Premierwave 2050, Premierwave 2050 Firmware | 2022-04-28 | 6.5 MEDIUM | 9.1 CRITICAL |
| A stack-based buffer overflow vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. | |||||
| CVE-2021-21879 | 1 Lantronix | 1 Premierwave 2050 | 2022-04-28 | 9.0 HIGH | 8.8 HIGH |
| A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability. | |||||
| CVE-2020-6091 | 1 Epson | 2 Eb-1470ui, Eb-1470ui Firmware | 2022-04-28 | 6.4 MEDIUM | 9.1 CRITICAL |
| An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303. A specially crafted series of HTTP requests can cause authentication bypass resulting in information disclosure. An attacker can send an HTTP request to trigger this vulnerability. | |||||
| CVE-2021-41162 | 1 Combodo | 1 Itop | 2022-04-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` page did not properly escape the user supplied parameters, allowing for a cross site scripting attack vector. Users are advised to upgrade. There are no known workarounds for this issue. | |||||
| CVE-2020-1597 | 2 Fedoraproject, Microsoft | 4 Fedora, Asp.net Core, Visual Studio 2017 and 1 more | 2022-04-28 | 5.0 MEDIUM | 7.5 HIGH |
| A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. | |||||
| CVE-2020-1380 | 1 Microsoft | 9 Internet Explorer, Windows 10, Windows 7 and 6 more | 2022-04-28 | 7.6 HIGH | 7.5 HIGH |
| A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1555, CVE-2020-1570. | |||||
| CVE-2020-24331 | 2 Fedoraproject, Trousers Project | 2 Fedora, Trousers | 2022-04-28 | 7.2 HIGH | 7.8 HIGH |
| An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon). | |||||
| CVE-2020-24330 | 2 Fedoraproject, Trousers Project | 2 Fedora, Trousers | 2022-04-28 | 7.2 HIGH | 7.8 HIGH |
| An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed. | |||||
| CVE-2020-0559 | 2 Intel, Microsoft | 78 Ac 3165 Firmware, Ac 3168 Firmware, Ac 7265 Firmware and 75 more | 2022-04-28 | 4.6 MEDIUM | 7.8 HIGH |
| Insecure inherited permissions in some Intel(R) PROSet/Wireless WiFi products on Windows* 7 and 8.1 before version 21.40.5.1 may allow an authenticated user to potentially enable escalation of privilege via local access. | |||||
| CVE-2020-17367 | 4 Debian, Fedoraproject, Firejail Project and 1 more | 4 Debian Linux, Fedora, Firejail and 1 more | 2022-04-28 | 4.6 MEDIUM | 7.8 HIGH |
| Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection. | |||||
| CVE-2020-12780 | 1 Combodo | 1 Itop | 2022-04-28 | 5.0 MEDIUM | 7.5 HIGH |
| A security misconfiguration exists in Combodo iTop, which can expose sensitive information. | |||||
| CVE-2019-19455 | 1 Wowza | 1 Streaming Engine | 2022-04-28 | 7.2 HIGH | 7.8 HIGH |
| Wowza Streaming Engine before 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in / usr / local / WowzaStreamingEngine / manager / bin / in the Linux version of the server by writing arbitrary commands in any file and execute them as root. This issue was resolved in Wowza Streaming Engine 4.8.5. | |||||
| CVE-2020-14309 | 2 Gnu, Opensuse | 2 Grub2, Leap | 2022-04-28 | 4.6 MEDIUM | 6.7 MEDIUM |
| There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data. | |||||
| CVE-2020-15588 | 1 Zohocorp | 1 Manageengine Desktop Central | 2022-04-28 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges. This issue will occur only when untrusted communication is initiated with server. In cloud, Agent will always connect with trusted communication. | |||||
| CVE-2020-15921 | 1 Midasolutions | 1 Eframework | 2022-04-28 | 7.5 HIGH | 9.8 CRITICAL |
| Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution. | |||||