Skip to content
OpenAdvisories

Archive

24 June 2020

Vulnerabilities first published on this day (UTC), newest first.

← May 2020 2020 / June /24 July 2020 →
  1. 138
  2. 256
  3. 3127
  4. 4100
  5. 533
  6. 65
  7. 78
  8. 834
  9. 9222
  10. 1074
  11. 11123
  12. 1228
  13. 13 
  14. 143
  15. 1590
  16. 1653
  17. 1752
  18. 1884
  19. 19193
  20. 202
  21. 218
  22. 2280
  23. 2327
  24. 2466
  25. 2574
  26. 26104
  27. 272
  28. 283
  29. 2972
  30. 3052
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.5
    CVE-2020-13700 Scanner template EPSS 13%

    acf-to-rest-api plugin insecure direct object reference (IDOR) via permalink manipulation

    An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wp_optio…

    airesvsg/acf-to-rest-api Packagist
  • High 7.5
    CVE-2020-7667

    Arbitrary File Write via Archive Extraction (Zip Slip)

    In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note:…

    github.com/sassoftware/go-rpmutils Go
  • High 8.2
    CVE-2020-10280

    RVD#2568: Apache server is vulnerable to a DoS

    The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard.

    Mobile Industrial Robots A/S MiR100
  • High 7.5
    CVE-2020-10273

    RVD#2560: Unprotected intellectual property in Mobile Industrial Robots (MiR) controllers

    MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. This flaw allows attackers with access to the robot or the robot network (while in combination with o…

    Mobile Industrial Robots A/S MiR100
  • High 7.1
    CVE-2020-10274

    RVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps)

    The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows an…

    Mobile Industrial Robots A/S MiR100