Skip to content
OpenAdvisories

Archive

23 October 2020

Vulnerabilities first published on this day (UTC), newest first.

← September 2020 2020 / October /23 November 2020 →
  1. 147
  2. 273
  3. 3 
  4. 41
  5. 523
  6. 672
  7. 728
  8. 855
  9. 941
  10. 106
  11. 11 
  12. 1260
  13. 1323
  14. 1452
  15. 1552
  16. 16201
  17. 171
  18. 181
  19. 1998
  20. 2049
  21. 21245
  22. 2299
  23. 2328
  24. 24 
  25. 251
  26. 2626
  27. 27173
  28. 2859
  29. 2954
  30. 3026
  31. 3114
All Critical High Medium Low Exploited only Public exploit

28 results · Feed

  • Unscored —
    CVE-2020-27678

    An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and S…

  • Medium 5.4
    CVE-2020-27388

    YOURLS Stored Cross Site Scripting (XSS)

    Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.

    yourls/yourls Packagist
  • Unscored —
    CVE-2020-24848

    FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform…

  • Unscored —
    CVE-2020-24847

    A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protec…

  • Unscored —
    CVE-2020-5990

    NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which …

    NVIDIA NVIDIA GeForce Experience Software
  • Unscored —
    CVE-2020-5978

    NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in its services in which a folder …

    NVIDIA NVIDIA GeForce Experience Software
  • Unscored —
    CVE-2020-5977

    NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Se…

    NVIDIA NVIDIA GeForce Experience Software
  • Unscored —
    CVE-2020-25483

    An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an att…

  • Unscored —
    CVE-2020-25466

    A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on…

  • Unscored —
    CVE-2020-3998

    VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure vulnerability. A malicious at…

    Windows
  • Unscored —
    CVE-2020-3997

    VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful e…

  • Unscored —
    CVE-2020-26561 EPSS 12%

    Belkin LINKSYS WRT160NL 1.0.04.002_US_20130619 devices have a stack-based buffer overflow vulnerability because of spri…

  • Unscored —
    CVE-2019-14715

    Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write o…

  • Unscored —
    CVE-2020-26887 Public exploit

    FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of a DNS Rebinding protection mechanism.

  • Unscored —
    CVE-2020-15004

    OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS.

  • Unscored —
    CVE-2020-15003

    OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string …

  • Unscored —
    CVE-2020-15002 Public exploit

    OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.

  • Unscored —
    CVE-2020-9331

    CryptoPro CSP through 5.0.0.10004 on 32-bit platforms allows Local Privilege Escalation (by local users with the SeChan…

  • Unscored —
    CVE-2020-9361

    CryptoPro CSP through 5.0.0.10004 on 64-bit platforms allows local users with the SeChangeNotifyPrivilege right to caus…

  • Unscored —
    CVE-2019-14716

    Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out).

  • Unscored —
    CVE-2019-14717

    Verifone Verix OS on VerixV Pinpad Payment Terminals with QT000530 have a Buffer Overflow via the Run system call.

  • Unscored —
    CVE-2019-14718

    Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svc_netcontro…

  • Unscored —
    CVE-2019-14719

    Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonst…

  • Unscored —
    CVE-2019-14713

    Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages.

  • Unscored —
    CVE-2019-14712

    Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file genera…

  • Unscored —
    CVE-2019-14711

    Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have a race condition for RBAC bypass.

  • Unscored —
    CVE-2018-8062 Public exploit

    A cross-site scripting (XSS) vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04_R02.A2pD035g.d23i firmwar…

  • High 7.0
    CVE-2020-27216

    Local Temp Directory Hijacking Vulnerability

    In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the pr…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven