Archive
August 2020
Vulnerabilities first published in this month (UTC), newest first.
50 results · Clear filters · Feed
-
Unscored —CVE-2020-14364 Public exploit
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue …
-
High 8.8
TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDD…
KEV Sep 2, 2025 -
Unscored —
Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.
-
High 8.8CVE-2020-24972 Public exploit
The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code…
-
Unscored —
In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating…
-
Unscored —CVE-2020-24656 Public exploit
Maltego before 4.2.12 allows XXE attacks.
-
High 8.1CVE-2020-24616 Public exploit
Code Injection in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
-
Unscored —CVE-2020-24609 Public exploit
TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the …
-
Unscored —CVE-2020-24572 Public exploit
An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misc…
-
Critical 10.0
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which all…
-
Unscored —
Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: …
-
Unscored —
SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi p…
-
Unscored —CVE-2020-14356 Public exploit
A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way w…
-
High 7.8
Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.…
KEV Apr 13, 2026 -
Unscored —
An issue was discovered in RiteCMS 2.2.1. An authenticated user can directly execute system commands by uploading a php…
-
Unscored —CVE-2020-24032 Public exploit
tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metachara…
-
High 7.5
Authentication bypass in Apache Shiro
Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.
-
Medium 5.5
Netlogon Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could ru…
KEV Nov 3, 2021 -
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. A…
-
High 7.8
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to ha…
KEV Oct 24, 2022 -
Unscored —
Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix X…
-
High 8.8CVE-2020-13941 Public exploit
Improper Input Validation in Apache Solr
Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, r…
-
Medium 5.5CVE-2020-1493 Public exploit
Microsoft Outlook Information Disclosure Vulnerability
An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific user…
-
Unscored —CVE-2020-24370 Public exploit
ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by ge…
-
Unscored —CVE-2020-9767 Public exploit
A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would allow an attacker who…
-
Medium 6.5
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept …
KEV Nov 3, 2021 -
Unscored —
Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code…
-
Unscored —
A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the d…
-
Unscored —
A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remo…
-
Unscored —
A privilege escalation issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to r…
-
Medium 5.3CVE-2020-7374 Public exploit
Documalis Free PDF Editor / Free PDF Scanner Stack Based Buffer Overflow
Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit this vulnerability to trigger a buffer overflow on the stack an…
-
Unscored —
Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter …
-
Unscored —
Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator …
-
Medium 5.4CVE-2020-2231 Public exploit
Improper Neutralization of Input During Web Page Generation in Jenkins
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission…
-
High 8.0CVE-2020-2229 Public exploit
Jenkins Cross-Site Scripting vulnerability in help icons
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
-
High 8.0
Jenkins Cross-site Scripting vulnerability in project naming strategy
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
-
Critical 9.8
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabb…
KEV Nov 3, 2021 -
Unscored —CVE-2020-0242 Public exploit
In reset of NuPlayerDriver.cpp, there is a possible use-after-free due to improper locking. This could lead to local es…
-
Unscored —CVE-2020-0241 Public exploit
In NuPlayerStreamListener of NuPlayerStreamListener.cpp, there is possible memory corruption due to a double free. This…
-
Unscored —CVE-2020-0240 Public exploit
In NewFixedDoubleArray of factory.cc, there is a possible out of bounds write due to an integer overflow. This could le…