CVE-2020-36732

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

• https://github.com/miguelc49/CVE-2020-36732-2

• https://github.com/miguelc49/CVE-2020-36732-1

CVE-2020-36730

The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.

• https://github.com/RandomRobbieBF/CVE-2020-36730

CVE-2020-36603

The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function calls, allowing local, unprivileged users to execute arbitrary code with SYSTEM privileges on Microsoft Windows systems. The mhyprot2.sys driver must first be installed by a user with administrative privileges.

• https://github.com/gmh5225/CVE-2020-36603

CVE-2020-36518

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

• https://github.com/ghillert/boot-jackson-cve

CVE-2020-36287

The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions check.

• https://github.com/f4rber/CVE-2020-36287

CVE-2020-36188

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

• https://github.com/Al1ex/CVE-2020-36188

CVE-2020-36184

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

• https://github.com/Al1ex/CVE-2020-36184

CVE-2020-36179

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

• https://github.com/Al1ex/CVE-2020-36179

CVE-2020-36109

ASUS RT-AX86U router firmware below version under 9.0.0.4_386 has a buffer overflow in the blocking_request.cgi function of the httpd module that can cause code execution when an attacker constructs malicious data.

• https://github.com/sunn1day/CVE-2020-36109-POC

• https://github.com/tin-z/CVE-2020-36109-POC

CVE-2020-36079

** DISPUTED ** Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the Files(elFinder) portion of the UI. This can, for example, place a .php file in the server's uploaded/ directory. NOTE: the vendor disputes this because exploitation can only be performed by an admin who has "lots of other possibilities to harm a site."

• https://github.com/azizalshammari/CVE-2020-36079.

CVE-2020-35848

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

• https://github.com/w33vils/CVE-2020-35847_CVE-2020-35848

CVE-2020-35847

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.

• https://github.com/w33vils/CVE-2020-35847_CVE-2020-35848

CVE-2020-35846

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

• https://github.com/JohnHammond/CVE-2020-35846

• https://github.com/0z09e/CVE-2020-35846

• https://github.com/Konstantinos-Papanagnou/CMSpit

CVE-2020-35785

NETGEAR DGN2200v1 devices before v1.0.0.60 mishandle HTTPd authentication (aka PSV-2020-0363, PSV-2020-0364, and PSV-2020-0365).

• https://github.com/Alonzozzz/alonzzzo

CVE-2020-35749

Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjb_file parameter to wp-admin/post.php.

• https://github.com/M4xSec/Wordpress-CVE-2020-35749

CVE-2020-35729

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.

• https://github.com/Al1ex/CVE-2020-35729

CVE-2020-35728

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

• https://github.com/Al1ex/CVE-2020-35728

CVE-2020-35717

zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true).

• https://github.com/hmartos/cve-2020-35717

• https://github.com/Redfox-Secuirty/Hacking-Electron-Apps-CVE-2020-35717-

CVE-2020-35713

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.

• https://github.com/Al1ex/CVE-2020-35713

CVE-2020-35682

Zoho ManageEngine ServiceDesk Plus before 11134 allows an Authentication Bypass (only during SAML login).

• https://github.com/its-arun/CVE-2020-35682

CVE-2020-35669

An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.

• https://github.com/n0npax/CVE-2020-35669

CVE-2020-35606

Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.

• https://github.com/anasbousselham/webminscan

CVE-2020-35590

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.

• https://github.com/N4nj0/CVE-2020-35590

CVE-2020-35575

A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201211) beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N, WR1043ND, WR1045ND, WR740N, WR741ND, WR749N, WR802N, WR840N, WR841HP, WR841N, WR842N, WR842ND, WR845N, WR940N, WR941HP, WR945N, WR949N, and WRD4300 devices.

• https://github.com/dylvie/CVE-2020-35575-TP-LINK-TL-WR841ND-password-disclosure

CVE-2020-35545

Time-based SQL injection exists in Spotweb 1.4.9 via the query string.

• https://github.com/bousalman/CVE-2020-35545

CVE-2020-35498

A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

• https://github.com/freddierice/cve-2020-35498-flag

CVE-2020-35489

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.

• https://github.com/dn9uy3n/Check-WP-CVE-2020-35489

• https://github.com/reneoliveirajr/wp_CVE-2020-35489_checker

• https://github.com/X0UCYB3R/Check-WP-CVE-2020-35489

• https://github.com/Cappricio-Securities/CVE-2020-35489

• https://github.com/g1thubb002/poc-CVE-2020-35489

CVE-2020-35488

The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.)

• https://github.com/GuillaumePetit84/CVE-2020-35488

• https://github.com/githubfoam/nxlog-ubuntu-githubactions

CVE-2020-35476

A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)

• https://github.com/glowbase/CVE-2020-35476

CVE-2020-35391

Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device's HTTP response behavior.

• https://github.com/H454NSec/CVE-2020-35391

• https://github.com/dumitory-dev/CVE-2020-35391-POC

CVE-2020-35314

A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a webshell via the theme/plugin installer.

• https://github.com/AkashLingayat/WonderCMS-CVE-2020-35314

• https://github.com/ybdegit2020/wonderplugin

CVE-2020-35262

Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter.

• https://github.com/the-girl-who-lived/CVE-2020-35262

CVE-2020-35191

The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.

• https://github.com/megadimenex/MegaHiDocker

CVE-2020-29669

In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This process has a vulnerability which can be used to take over the administrator account and results in shell access. As the admin user may read the /etc/shadow file, the password hashes of each user (including root) can be dumped. The root hash can be cracked easily which results in a complete system compromise.

• https://github.com/code-byter/CVE-2020-29669

CVE-2020-29667

In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system because of Insufficient Session Expiration.

• https://github.com/jet-pentest/CVE-2020-29667

CVE-2020-29666

In Lan ATMService M3 ATM Monitoring System 6.1.0, due to a directory-listing vulnerability, a remote attacker can view log files, located in /websocket/logs/, that contain a user's cookie values and the predefined developer's cookie value.

• https://github.com/jet-pentest/CVE-2020-29666

CVE-2020-29661

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.

• https://github.com/wojkos9/arm-CVE-2020-29661

CVE-2020-29607

A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution.

• https://github.com/0xAbbarhSF/CVE-2020-29607

• https://github.com/0xN7y/CVE-2020-29607

CVE-2020-29599

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.

• https://github.com/lnwza0x0a/CVE-2020-29599

CVE-2020-29583

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.

• https://github.com/ruppde/scan_CVE-2020-29583

CVE-2020-29370

An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71.

• https://github.com/nanopathi/linux-4.19.72_CVE-2020-29370

CVE-2020-29364

In NetArt News Lister 1.0.0, the news headlines vulnerable to stored xss attacks. Attackers can inject codes in news titles.

• https://github.com/aslanemre/CVE-2020-29364

CVE-2020-29254

TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These action include allowing attackers to submit their own code through an authenticated user resulting in local file Inclusion. If an authenticated user who is able to edit TikiWiki templates visits an malicious website, template code can be edited.

• https://github.com/S1lkys/CVE-2020-29254

CVE-2020-29156

The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action.

• https://github.com/Ko-kn3t/CVE-2020-29156

CVE-2020-29134

The TOTVS Fluig platform allows path traversal through the parameter "file = .. /" encoded in base64. This affects all versions Fluig Lake 1.7.0, Fluig 1.6.5 and Fluig 1.6.4

• https://github.com/Ls4ss/CVE-2020-29134

CVE-2020-29070

osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.

• https://github.com/aslanemre/cve-2020-29070

CVE-2020-29009

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/seqred-s-a/gameloop-cve

CVE-2020-29008

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/seqred-s-a/gameloop-cve

CVE-2020-29007

The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allows any user with an ability to edit articles (potentially including unauthenticated anonymous users) to execute arbitrary Scheme or shell code by using crafted {{Image data to generate musical scores containing malicious code.

• https://github.com/seqred-s-a/cve-2020-29007

CVE-2020-28949

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

• https://github.com/0x240x23elu/CVE-2020-28948-and-CVE-2020-28949

• https://github.com/JinHao-L/PoC-for-CVE-2020-28948-CVE-2020-28949

CVE-2020-28948

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

• https://github.com/0x240x23elu/CVE-2020-28948-and-CVE-2020-28949

• https://github.com/nopdata/cve-2020-28948

• https://github.com/JinHao-L/PoC-for-CVE-2020-28948-CVE-2020-28949

CVE-2020-28926

ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to the miniDLNA service using HTTP chunked encoding can lead to a signedness bug resulting in a buffer overflow in calls to memcpy/memmove.

• https://github.com/lorsanta/exploit-CVE-2020-28926

CVE-2020-28874

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).

• https://github.com/varandinawer/CVE-2020-28874

CVE-2020-28872

An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows an unauthorized person to create valid credentials.

• https://github.com/sec-it/monitorr-exploit-toolkit

CVE-2020-28871

Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload.

• https://github.com/sec-it/monitorr-exploit-toolkit

CVE-2020-28653

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.

• https://github.com/intrigueio/cve-2020-28653-poc

• https://github.com/tuo4n8/CVE-2020-28653

• https://github.com/mr-r3bot/ManageEngine-CVE-2020-28653

CVE-2020-28647

In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser (XSS).

• https://github.com/SECFORCE/Progress-MOVEit-Transfer-2020.1-Stored-XSS-CVE-2020-28647

CVE-2020-28502

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.

• https://github.com/s-index/poc-list

• https://github.com/s-index/CVE-2020-28502

• https://github.com/dpredrag/CVE-2020-28502

CVE-2020-28488

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

• https://github.com/rafaelcintralopes/CVE-2020-28488

CVE-2020-28478

This affects the package gsap before 3.6.0.

• https://github.com/NetJBS/CVE-2020-28478--PoC

CVE-2020-28458

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.

• https://github.com/fazilbaig1/CVE-2020-28458

CVE-2020-28415

A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28414).

• https://github.com/jet-pentest/CVE-2020-28415

CVE-2020-28414

A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28415).

• https://github.com/jet-pentest/CVE-2020-28414

CVE-2020-28351

The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient validation for the time_zone object in the HOME_MEETING& page.

• https://github.com/dievus/CVE-2020-28351

CVE-2020-28328

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.

• https://github.com/mcorybillington/SuiteCRM-RCE

CVE-2020-28243

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.

• https://github.com/stealthcopter/CVE-2020-28243

CVE-2020-28169

The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory is writable by a user account, but a file in bin is executed as NT AUTHORITY\SYSTEM.

• https://github.com/zubrahzz/FluentD-TD-agent-Exploit-CVE-2020-28169

CVE-2020-28148

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/fengchenzxc/CVE-2020-28148

CVE-2020-28054

JamoDat TSMManager Collector version up to 6.5.0.21 is vulnerable to an Authorization Bypass because the Collector component is not properly validating an authenticated session with the Viewer. If the Viewer has been modified (binary patched) and the Bypass Login functionality is being used, an attacker can request every Collector's functionality as if they were a properly logged-in user: administrating connected instances, reviewing logs, editing configurations, accessing the instances' consoles, accessing hardware configurations, etc.Exploiting this vulnerability won't grant an attacker access nor control on remote ISP servers as no credentials is sent with the request.

• https://github.com/VoidSec/Tivoli-Madness

CVE-2020-28052

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

• https://github.com/kurenaif/CVE-2020-28052_PoC

• https://github.com/madstap/bouncy-castle-generative-test-poc

CVE-2020-28032

WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.

• https://github.com/nth347/CVE-2020-28032_PoC

CVE-2020-28018

Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.

• https://github.com/dorkerdevil/CVE-2020-28018

• https://github.com/zr0tt/CVE-2020-28018

CVE-2020-27976

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option.

• https://github.com/k0rnh0li0/CVE-2020-27976

CVE-2020-27955

Git LFS 2.12.0 allows Remote Code Execution.

• https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955

• https://github.com/r00t4dm/CVE-2020-27955

• https://github.com/ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955-Go

• https://github.com/DeeLMind/CVE-2020-27955-LFS

• https://github.com/TheTh1nk3r/cve-2020-27955

• https://github.com/HK69s/CVE-2020-27955

• https://github.com/userxfan/cve-2020-27955

• https://github.com/NeoDarwin/CVE-2020-27955

• https://github.com/shubham0d/CVE-2020-27955

• https://github.com/FrostsaberX/CVE-2020-27955

• https://github.com/IanSmith123/CVE-2020-27955

• https://github.com/Arnoldqqq/CVE-2020-27955

• https://github.com/nob0dy-3389/CVE-2020-27955

• https://github.com/z50913/CVE-2020-27955

• https://github.com/yhsung/cve-2020-27955-poc

• https://github.com/Kimorea/CVE-2020-27955-LFS

• https://github.com/Marsable/CVE-2020-27955-LFS

• https://github.com/whitetea2424/CVE-2020-27955-LFS-main

CVE-2020-27950

A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.

• https://github.com/synacktiv/CVE-2020-27950

• https://github.com/lyonzon2/browser-crash-tool

CVE-2020-27949

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may cause unexpected changes in memory belonging to processes traced by DTrace.

• https://github.com/seemoo-lab/dtrace-memaccess_cve-2020-27949

CVE-2020-27935

Multiple issues were addressed with improved logic. This issue is fixed in iOS 14.2 and iPadOS 14.2, macOS Big Sur 11.0.1, watchOS 7.1, tvOS 14.2. A sandboxed process may be able to circumvent sandbox restrictions.

• https://github.com/LIJI32/SnatchBox

CVE-2020-27930

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. Processing a maliciously crafted font may lead to arbitrary code execution.

• https://github.com/FunPhishing/Apple-Safari-Remote-Code-Execution-CVE-2020-27930

CVE-2020-27904

A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1. An application may be able to execute arbitrary code with kernel privileges.

• https://github.com/pattern-f/xattr-oob-swap

CVE-2020-27838

A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.

• https://github.com/Cappricio-Securities/CVE-2020-27838

CVE-2020-27824

A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability.

• https://github.com/pazhanivel07/openjpeg-2.3.0_CVE-2020-27824

CVE-2020-27815

A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

• https://github.com/Trinadh465/linux-4.19.72_CVE-2020-27815

CVE-2020-27786

A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

• https://github.com/kiks7/CVE-2020-27786-Kernel-Exploit

• https://github.com/ii4gsp/CVE-2020-27786

• https://github.com/enlist12/CVE-2020-27786

• https://github.com/elbiazo/CVE-2020-27786

• https://github.com/Trinadh465/linux-4.19.72_CVE-2020-27786

CVE-2020-27747

An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a PIN code for entering from a mobile device using the built-in generator (4 digits), a remote attacker has the opportunity to conduct a brute force attack on this PIN code. As result, remote attacker retrieves all passwords from another systems, available for affected account.

• https://github.com/jet-pentest/CVE-2020-27747

CVE-2020-27688

RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt() method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The accounts used in the configuration files have access to vSphere instances.

• https://github.com/matthiasmaes/CVE-2020-27688

CVE-2020-27666

Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.

• https://github.com/ossf-cve-benchmark/CVE-2020-27666

CVE-2020-27603

BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.

• https://github.com/hannob/CVE-2020-27603-bbb-libreoffice-poc

CVE-2020-27368

Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via GET Parameter.

• https://github.com/swzhouu/CVE-2020-27368

CVE-2020-27359

A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a message and send it to anyone on the platform including admins. The XSS payload would execute on the other account without interaction from the user on several pages.

• https://github.com/sebastian-mora/cve-2020-27358-27359

CVE-2020-27358

An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changing the thread_id parameter in the request to the endpoint Messenger/messenger_download_csv.php?title=Hey&thread_id={THREAD_ID}.

• https://github.com/sebastian-mora/cve-2020-27358-27359

CVE-2020-27301

A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "AES_UnWRAP" function, when an attacker in Wi-Fi range sends a crafted "Encrypted GTK" value as part of the WPA2 4-way-handshake.

• https://github.com/chertoGUN/CVE-2020-27301-hostapd

CVE-2020-27252

Medtronic MyCareLink Smart 25000 all versions are vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited an attacker could remotely execute code on the MCL Smart Patient Reader device, leading to control of the device.

• https://github.com/OccultSlolem/GatorMed

CVE-2020-27223

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

• https://github.com/motikan2010/CVE-2020-27223

• https://github.com/ttestoo/Jetty-CVE-2020-27223

• https://github.com/hshivhare67/Jetty_v9.4.31_CVE-2020-27223

• https://github.com/hshivhare67/Jetty_v9.4.31_CVE-2020-27223_beforepatch

CVE-2020-27199

The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Username and Password authentication function. Using enumeration, an attacker is able to forge a User specific token without the need for correct password to gain access to the mobile application as that victim user.

• https://github.com/9lyph/CVE-2020-27199

CVE-2020-27194

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values, aka CID-5b9fbeb75b6a.

• https://github.com/xmzyshypnc/CVE-2020-27194

• https://github.com/willinin/CVE-2020-27194-exp

CVE-2020-27190

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/qlh831/x-CVE-2020-27190

CVE-2020-26878

Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py.

• https://github.com/htarsoo/CVE-2020-26878

CVE-2020-26733

Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section.

• https://github.com/swzhouu/CVE-2020-26733

CVE-2020-26732

SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

• https://github.com/swzhouu/CVE-2020-26732

CVE-2020-26527

An issue was discovered in API/api/Version in Damstra Smart Asset 2020.7. Cross-origin resource sharing trusts random origins by accepting the arbitrary 'Origin: example.com' header and responding with 200 OK and a wildcard 'Access-Control-Allow-Origin: *' header.

• https://github.com/lukaszstu/SmartAsset-CORS-CVE-2020-26527

CVE-2020-26526

An issue was discovered in Damstra Smart Asset 2020.7. It is possible to enumerate valid usernames on the login page. The application sends a different server response when the username is invalid than when the username is valid ("Unable to find an APIDomain" versus "Wrong email or password").

• https://github.com/lukaszstu/SmartAsset-UE-CVE-2020-26526

CVE-2020-26525

Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers.

• https://github.com/lukaszstu/SmartAsset-SQLinj-CVE-2020-26525

CVE-2020-26413

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible.

• https://github.com/Kento-Sec/GitLab-Graphql-CVE-2020-26413

CVE-2020-26259

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.

• https://github.com/jas502n/CVE-2020-26259

• https://github.com/Al1ex/CVE-2020-26259

CVE-2020-26258

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.

• https://github.com/Al1ex/CVE-2020-26258

CVE-2020-26256

Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDoS vulnerability (Regular Expression Denial of Service) when using ignoreEmpty option when parsing. This has been patched in v4.3.6 You will only be affected by this if you use the ignoreEmpty parsing option. If you do use this option it is recommended that you upgrade to the latest version v4.3.6 This vulnerability was found using a CodeQL query which identified EMPTY_ROW_REGEXP regular expression as vulnerable.

• https://github.com/ossf-cve-benchmark/CVE-2020-26256

CVE-2020-26243

Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed. This is fixed in versions 0.3.9.7 and 0.4.4. The following workarounds are available: 1) Set the option no_unions for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. 2) Set the type of the submessage field inside oneof to FT_POINTER. This way the whole submessage will be dynamically allocated and the problematic code is not executed. 3) Use an arena allocator for nanopb, to make sure all memory can be released afterwards.

• https://github.com/HimanshuS67/external_nanopb-c_AOSP10_CVE-2020-26243

CVE-2020-26233

Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core before version 2.0.289, when recursively cloning a Git repository on Windows with submodules, Git will first clone the top-level repository and then recursively clone all submodules by starting new Git processes from the top-level working directory. If a malicious git.exe executable is present in the top-level repository then this binary will be started by Git Credential Manager Core when attempting to read configuration, and not git.exe as found on the %PATH%. This only affects GCM Core on Windows, not macOS or Linux-based distributions. GCM Core version 2.0.289 contains the fix for this vulnerability, and is available from the project's GitHub releases page. GCM Core 2.0.289 is also bundled in the latest Git for Windows release; version 2.29.2(3). As a workaround, users should avoid recursively cloning untrusted repositories with the --recurse-submodules option.

• https://github.com/an1p3lg5/CVE-2020-26233

• https://github.com/whr819987540/test_CVE-2020-26233

CVE-2020-26226

In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.

• https://github.com/ossf-cve-benchmark/CVE-2020-26226

CVE-2020-26217

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

• https://github.com/novysodope/CVE-2020-26217-XStream-RCE-POC

• https://github.com/Al1ex/CVE-2020-26217

• https://github.com/epicosy/XStream-1

CVE-2020-26061

ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. The ResetPassword function does not validate whether the user has successfully authenticated using security questions. An unauthenticated, remote attacker can send a crafted HTTP request to the /account/ResetPassword page to set a new password for any registered user.

• https://github.com/missing0x00/CVE-2020-26061

CVE-2020-25867

SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to get access without authentication.

• https://github.com/thomasfady/CVE-2020-25867

CVE-2020-25860

The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.

• https://github.com/rauc/rauc-1.5-integration

CVE-2020-25803

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.

• https://github.com/mbadanoiu/CVE-2022-40634

CVE-2020-25790

** DISPUTED ** Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being fixed for 5.2.

• https://github.com/7Mitu/CVE-2020-25790

CVE-2020-25785

An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CFtpProtocol::FtpLogin during the update procedure.

• https://github.com/tezeb/accfly

CVE-2020-25784

An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CNetClientGuard::SubOprMsg during incoming message handling.

• https://github.com/tezeb/accfly

CVE-2020-25783

An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated heap-based buffer overflow in the function CNetClientTalk::OprMsg during incoming message handling.

• https://github.com/tezeb/accfly

CVE-2020-25782

An issue was discovered on Accfly Wireless Security IR Camera 720P System with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CNetClientManage::ServerIP_Proto_Set during incoming message handling.

• https://github.com/tezeb/accfly

CVE-2020-25769

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/defrancescojp/CVE-2020-25769

CVE-2020-25749

The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) could allow an remote attacker to take full control of the device with a high-privileged account. The vulnerability exists because a system account has a default and static password. The Telnet service cannot be disabled and this password cannot be changed via standard functionality.

• https://github.com/jet-pentest/CVE-2020-25749

CVE-2020-25748

A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339). Someone in the middle can intercept and modify the video data from the camera, which is transmitted in an unencrypted form. One can also modify responses from NTP and RTSP servers and force the camera to use the changed values.

• https://github.com/jet-pentest/CVE-2020-25748

CVE-2020-25747

The Telnet service of Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) can allow a remote attacker to gain access to RTSP and ONFIV services without authentication. Thus, the attacker can watch live streams from the camera, rotate the camera, change some settings (brightness, clarity, time), restart the camera, or reset it to factory settings.

• https://github.com/jet-pentest/CVE-2020-25747

CVE-2020-25705

A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version

• https://github.com/tdwyer/CVE-2020-25705

• https://github.com/nanopathi/linux-4.19.72_CVE-2020-25705

CVE-2020-25686

A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the "Birthday Attacks" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

• https://github.com/knqyf263/dnspooq

CVE-2020-25685

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

• https://github.com/knqyf263/dnspooq

CVE-2020-25684

A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

• https://github.com/knqyf263/dnspooq

CVE-2020-25668

A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op.

• https://github.com/hshivhare67/Kernel_4.1.15_CVE-2020-25668

CVE-2020-25637

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

• https://github.com/brahmiboudjema/CVE-2020-25637-libvirt-double-free

CVE-2020-25632

A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

• https://github.com/pauljrowland/BootHoleFix

CVE-2020-25627

The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.

• https://github.com/HoangKien1020/CVE-2020-25627

CVE-2020-25613

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

• https://github.com/metapox/CVE-2020-25613

CVE-2020-25579

In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes.

• https://github.com/farazsth98/freebsd-dirent-info-leak-bugs

CVE-2020-25578

In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 several file systems were not properly initializing the d_off field of the dirent structures returned by VOP_READDIR. In particular, tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. As a result, eight uninitialized kernel stack bytes may be leaked to userspace by these file systems.

• https://github.com/farazsth98/freebsd-dirent-info-leak-bugs

CVE-2020-25557

In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. After that, when attacker logs in to the application, attacker's code will be run. As a result of this vulnerability, authenticated user can run command on the server.

• https://github.com/sec-it/CMSUno-RCE

CVE-2020-25540

ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.

• https://github.com/Schira4396/CVE-2020-25540

• https://github.com/RajChowdhury240/ThinkAdmin-CVE-2020-25540

• https://github.com/simonlee-hello/CVE-2020-25540

• https://github.com/lowkey0808/cve-2020-25540

CVE-2020-25538

An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in the web page. In this way, attacker can takeover the control of the server.

• https://github.com/sec-it/CMSUno-RCE

CVE-2020-25519

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/g-rubert/wordpress_DoS

CVE-2020-25518

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/g-rubert/wordpress_DoS

CVE-2020-25515

Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book , http://<site>/lms/index.php?page=books.

• https://github.com/Ko-kn3t/CVE-2020-25515

CVE-2020-25514

Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php.

• https://github.com/Ko-kn3t/CVE-2020-25514

CVE-2020-25498

Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter.

• https://github.com/the-girl-who-lived/CVE-2020-25498

CVE-2020-25488

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/Ko-kn3t/CVE-2020-25488

CVE-2020-25487

PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php.

• https://github.com/Ko-kn3t/CVE-2020-25487

CVE-2020-25478

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/santokum/CVE-2020-25478--ASUS-RT-AC87U-TFTP-is-vulnerable-to-Denial-of-Service-DoS-attack

CVE-2020-25399

Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat.

• https://github.com/h3llraiser/CVE-2020-25399

CVE-2020-25398

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality.

• https://github.com/h3llraiser/CVE-2020-25398

CVE-2020-25385

Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact users who open a maliciously crafted link or third-party web page.

• https://github.com/EmreOvunc/Nagios-Log-Server-2.1.7-Persistent-Cross-Site-Scripting

CVE-2020-25273

In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection.

• https://github.com/Ko-kn3t/CVE-2020-25273

CVE-2020-25272

In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in book_now.php.

• https://github.com/Ko-kn3t/CVE-2020-25272

CVE-2020-25271

PHPGurukul hospital-management-system-in-php 4.0 allows XSS via admin/patient-search.php, doctor/search.php, book-appointment.php, doctor/appointment-history.php, or admin/appointment-history.php.

• https://github.com/Ko-kn3t/CVE-2020-25271

CVE-2020-25270

PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, or City.

• https://github.com/Ko-kn3t/CVE-2020-25270

CVE-2020-25265

AppImage libappimage before 1.0.3 allows attackers to trigger an overwrite of a system-installed .desktop file by providing a .desktop file that contains Name= with path components.

• https://github.com/refi64/CVE-2020-25265-25266

CVE-2020-25223

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

• https://github.com/darrenmartyn/sophucked

• https://github.com/twentybel0w/CVE-2020-25223

• https://github.com/reneww/poc-CVE-2020-25223

CVE-2020-25213

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.

• https://github.com/mansoorr123/wp-file-manager-CVE-2020-25213

• https://github.com/Aron-Tn/0day-elFinder-2020

• https://github.com/BLY-Coder/Python-exploit-CVE-2020-25213

• https://github.com/kakamband/WPKiller

• https://github.com/E1tex/Python-CVE-2020-25213

• https://github.com/b1ackros337/CVE-2020-25213

• https://github.com/piruprohacking/CVE-2020-25213

• https://github.com/Nguyen-id/CVE-2020-25213

• https://github.com/0000000O0Oo/Wordpress-CVE-2020-25213

• https://github.com/forse01/CVE-2020-25213-Wordpress

CVE-2020-25200

** DISPUTED ** Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Initially, the server will return error 401. However, if the username is valid, then after 20 login attempts, the server will start responding with error 400. Invalid usernames will receive error 401 indefinitely. Note: This has been disputed by the vendor as not a vulnerability. They argue that this is an intended design.

• https://github.com/lukaszstu/pritunl-CVE-2020-25200

CVE-2020-25134

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /settings/?format=../ URIs to pages/settings.inc.php.

• https://github.com/ynsmroztas/CVE-2020-25134

CVE-2020-25078

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.

• https://github.com/jorhelp/Ingram

• https://github.com/1n7erface/PocList

• https://github.com/MzzdToT/CVE-2020-25078

• https://github.com/chinaYozz/CVE-2020-25078

CVE-2020-25068

Setelsa Conacwin v3.7.1.2 is vulnerable to a local file inclusion vulnerability. This vulnerability allows a remote unauthenticated attacker to read internal files on the server via an http:IP:PORT/../../path/file_to_disclose Directory Traversal URI. NOTE: The manufacturer indicated that the affected version does not exist. Furthermore, they indicated that they detected this problem in an internal audit more than 3 years ago and fixed it in 2017.

• https://github.com/bryanroma/CVE-2020-25068

CVE-2020-24972

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

• https://github.com/SpiralBL0CK/CVE-2020-24972

CVE-2020-24955

SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivileged users to restore a malicious DLL from quarantine into the system32 folder via an NTFS directory junction, as demonstrated by a crafted ualapi.dll file that is detected as malware.

• https://github.com/nmht3t/CVE-2020-24955

CVE-2020-24949

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).

• https://github.com/r90tpass/CVE-2020-24949

CVE-2020-24916

CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.

• https://github.com/vulnbe/poc-yaws-cgi-shell-injection

CVE-2020-24913

A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.

• https://github.com/agarma/CVE-2020-24913-PoC

CVE-2020-24881

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.

• https://github.com/harshtech123/cve-2020-24881

CVE-2020-24815

A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allows authenticated users to access the content of internal network resources or leak files from the local system via HTML containers embedded in a dossier/dashboard document. NOTE: 10.4., no fix will be released as version will reach end-of-life on 31/12/2020.

• https://github.com/darkvirus-7x/exploit-CVE-2020-24815

CVE-2020-24765

InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request.

• https://github.com/fbkcs/CVE-2020-24765

CVE-2020-24750

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

• https://github.com/Al1ex/CVE-2020-24750

CVE-2020-24656

Maltego before 4.2.12 allows XXE attacks.

• https://github.com/terzinodipaese/Internet-Security-Project

CVE-2020-24616

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

• https://github.com/0xkami/cve-2020-24616-poc

CVE-2020-24597

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/HoangKien1020/CVE-2020-24597

CVE-2020-24572

An issue was discovered in includes/webconsole.php in RaspAP 2.5. With authenticated access, an attacker can use a misconfigured (and virtually unrestricted) web console to attack the underlying OS (Raspberry Pi) running this software, and execute commands on the system (including ones for uploading of files and execution of code).

• https://github.com/gerbsec/CVE-2020-24572-POC

• https://github.com/lb0x/cve-2020-24572

CVE-2020-24490

Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access. This affects all Linux kernel versions that support BlueZ.

• https://github.com/AbrarKhan/linux_CVE-2020-24490-beforePatch

• https://github.com/AbrarKhan/Linux-4.19.72_CVE-2020-24490

CVE-2020-24397

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges.

• https://github.com/patois/zohocorp_dc

CVE-2020-24379

WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.

• https://github.com/vulnbe/poc-yaws-dav-xxe

CVE-2020-24370

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

• https://github.com/RenukaSelvar/lua_CVE-2020-24370

• https://github.com/RenukaSelvar/lua_CVE-2020-24370_AfterPatch

CVE-2020-24227

Playground Sessions v2.5.582 (and earlier) for Windows, stores the user credentials in plain text allowing anyone with access to UserProfiles.sol to extract the email and password.

• https://github.com/nathunandwani/CVE-2020-24227

CVE-2020-24186

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.

• https://github.com/hev0x/CVE-2020-24186-wpDiscuz-7.0.4-RCE

• https://github.com/substing/CVE-2020-24186_reverse_shell_upload

• https://github.com/Sakura-501/CVE-2020-24186-exploit

• https://github.com/meicookies/CVE-2020-24186

CVE-2020-24148

Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.

• https://github.com/dwisiswant0/CVE-2020-24148

CVE-2020-24089

An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a denial of service (DoS).

• https://github.com/rjt-gupta/CVE-2020-24089

CVE-2020-24088

An issue was discovered in MmMapIoSpace routine in Foxconn Live Update Utility 2.1.6.26, allows local attackers to escalate privileges.

• https://github.com/rjt-gupta/CVE-2020-24088

CVE-2020-24033

An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all settings including deleting users, creating new users with escalated privileges.

• https://github.com/M0NsTeRRR/CVE-2020-24033

CVE-2020-24032

tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone.

• https://github.com/jet-pentest/CVE-2020-24032

CVE-2020-24030

ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access to sensitive data via token reuse.

• https://github.com/underprotection/CVE-2020-24030

• https://github.com/redteambrasil/CVE-2020-24030

CVE-2020-24029

Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request.

• https://github.com/underprotection/CVE-2020-24029

• https://github.com/redteambrasil/CVE-2020-24029

CVE-2020-24028

ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates.

• https://github.com/underprotection/CVE-2020-24028

• https://github.com/redteambrasil/CVE-2020-24028

CVE-2020-23968

Ilex International Sign&go Workstation Security Suite 7.1 allows elevation of privileges via a symlink attack on ProgramData\Ilex\S&G\Logs\000-sngWSService1.log.

• https://github.com/ricardojba/CVE-2020-23968-ILEX-SignGo-EoP

CVE-2020-23934

An issue was discovered in RiteCMS 2.2.1. An authenticated user can directly execute system commands by uploading a php web shell in the "Filemanager" section.

• https://github.com/H0j3n/CVE-2020-23934

CVE-2020-23839

A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the login form.

• https://github.com/boku7/CVE-2020-23839

CVE-2020-23593

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross site request forgery (CSRF) attack to enable syslog mode through ' /mgm_log_cfg.asp.' The system starts to log events, 'Remote' mode or 'Both' mode on "Syslog -- Configuration page" logs events and sends to remote syslog server IP and Port.

• https://github.com/huzaifahussain98/CVE-2020-23593

CVE-2020-23592

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Reset ONU to Factory Default through ' /mgm_dev_reset.asp.' Resetting to default leads to Escalation of Privileges by logging-in with default credentials.

• https://github.com/huzaifahussain98/CVE-2020-23592

CVE-2020-23591

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker to upload arbitrary files through " /mgm_dev_upgrade.asp " which can "delete every file for Denial of Service (using 'rm -rf .' in the code), reverse connection (using '.asp' webshell), backdoor.

• https://github.com/huzaifahussain98/CVE-2020-23591

CVE-2020-23590

A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack to change the Password for "WLAN SSID" through "wlwpa.asp".

• https://github.com/huzaifahussain98/CVE-2020-23590

CVE-2020-23589

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to cause a Denial of Service by Rebooting the router through " /mgm_dev_reboot.asp."

• https://github.com/huzaifahussain98/CVE-2020-23589

CVE-2020-23588

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to "Enable or Disable Ports" and to "Change port number" through " /rmtacc.asp ".

• https://github.com/huzaifahussain98/CVE-2020-23588

CVE-2020-23587

A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to men in the middle attack by adding New Routes in RoutingConfiguration on " /routing.asp ".

• https://github.com/huzaifahussain98/CVE-2020-23587

CVE-2020-23586

A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Add Network Traffic Control Type Rule.

• https://github.com/huzaifahussain98/CVE-2020-23586

CVE-2020-23585

A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028. The vulnerability is due to insufficient CSRF protections for the "mgm_config_file.asp" because of which attacker can create a crafted "csrf form" which sends " malicious xml data" to "/boaform/admin/formMgmConfigUpload". the exploit allows attacker to "gain full privileges" and to "fully compromise of router & network".

• https://github.com/huzaifahussain98/CVE-2020-23585

CVE-2020-23584

Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using " | " to execute commands on " /diag_tracert_admin.asp " in the "PingTest" parameter that leads to command execution.

• https://github.com/huzaifahussain98/CVE-2020-23584

CVE-2020-23583

OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system.

• https://github.com/huzaifahussain98/CVE-2020-23583

CVE-2020-23582

A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to create Multiple WLAN BSSID.

• https://github.com/huzaifahussain98/CVE-2020-23582

CVE-2020-23490

There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file.

• https://github.com/ahussam/AVideo3xploit

CVE-2020-23489

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.

• https://github.com/ahussam/AVideo3xploit

CVE-2020-23342

A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.

• https://github.com/DXY0411/CVE-2020-23342

CVE-2020-23162

Sensitive information disclosure and weak encryption in Pyrescom Termod4 time management devices before 10.04k allows remote attackers to read a session-file and obtain plain-text user credentials.

• https://github.com/Outpost24/Pyrescom-Termod-PoC

CVE-2020-23161

Local file inclusion in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to traverse directories and read sensitive files via the Maintenance > Logs menu and manipulating the file-path in the URL.

• https://github.com/Outpost24/Pyrescom-Termod-PoC

CVE-2020-23160

Remote code execution in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to arbitrary commands as root on the devices.

• https://github.com/Outpost24/Pyrescom-Termod-PoC

CVE-2020-21378

SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin_members_group.php.

• https://github.com/sukusec301/SeaCMS-v10.1

CVE-2020-20282

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/3mrgnc3/Moodle_3.9_RCE_AutoPwn

CVE-2020-20093

The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages.

• https://github.com/zadewg/RIUS

CVE-2020-19587

Cross Site Scripting (XSS) vulnerability in configMap parameters in Yellowfin Business Intelligence 7.3 allows remote attackers to run arbitrary code via MIAdminStyles.i4 Admin UI.

• https://github.com/Deepak983/CVE-2020-19587

CVE-2020-19586

Incorrect Access Control issue in Yellowfin Business Intelligence 7.3 allows remote attackers to escalate privilege via MIAdminStyles.i4 Admin UI.

• https://github.com/Deepak983/CVE-2020-19586

CVE-2020-19364

OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.

• https://github.com/EmreOvunc/OpenEMR_Vulnerabilities

CVE-2020-19363

Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directories.

• https://github.com/EmreOvunc/Vtiger-CRM-Vulnerabilities

CVE-2020-19362

Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page.

• https://github.com/EmreOvunc/Vtiger-CRM-Vulnerabilities

CVE-2020-19361

Reflected XSS in Medintux v2.16.000 CCAM.php by manipulating the mot1 parameter can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page.

• https://github.com/EmreOvunc/Medintux-V2.16.000-Reflected-XSS-Vulnerability

CVE-2020-19360

Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead to sensitive information disclosure.

• https://github.com/EmreOvunc/FHEM-6.0-Local-File-Inclusion-LFI-Vulnerability

• https://github.com/a1665454764/CVE-2020-19360

• https://github.com/zzzz966/CVE-2020-19360

CVE-2020-18326

Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary administrator user.

• https://github.com/hamm0nz/CVE-2020-18326

CVE-2020-18325

Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.

• https://github.com/hamm0nz/CVE-2020-18325

CVE-2020-18324

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.

• https://github.com/hamm0nz/CVE-2020-18324

CVE-2020-17533

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.

• https://github.com/pazeray/CVE-2020-17533

CVE-2020-17531

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.

• https://github.com/154802388/CVE-2020-17531

CVE-2020-17530

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

• https://github.com/ka1n4t/CVE-2020-17530

• https://github.com/wuzuowei/CVE-2020-17530

• https://github.com/Al1ex/CVE-2020-17530

• https://github.com/fengziHK/CVE-2020-17530-strust2-061

• https://github.com/uzzzval/CVE-2020-17530

• https://github.com/phil-fly/CVE-2020-17530

• https://github.com/CyborgSecurity/CVE-2020-17530

• https://github.com/secpool2000/CVE-2020-17530

• https://github.com/gh0st27/Struts2Scanner

• https://github.com/ludy-dev/freemarker_RCE_struts2_s2-061

• https://github.com/nth347/CVE-2020-17530

• https://github.com/keyuan15/CVE-2020-17530

• https://github.com/killmonday/CVE-2020-17530-s2-061

• https://github.com/154802388/CVE-2020-17531

CVE-2020-17527

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

• https://github.com/forse01/CVE-2020-17527-Tomcat

CVE-2020-17523

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

• https://github.com/jweny/shiro-cve-2020-17523

CVE-2020-17519

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.

• https://github.com/MrCl0wnLab/SimplesApachePathTraversal

• https://github.com/B1anda0/CVE-2020-17519

• https://github.com/murataydemir/CVE-2020-17519

• https://github.com/dolevf/apache-flink-directory-traversal.nse

• https://github.com/QmF0c3UK/CVE-2020-17519

• https://github.com/givemefivw/CVE-2020-17519

• https://github.com/yaunsky/CVE-2020-17519-Apache-Flink

• https://github.com/hoanx4/CVE-2020-17519

• https://github.com/radbsie/CVE-2020-17519-Exp

• https://github.com/zhangweijie11/CVE-2020-17519

• https://github.com/Osyanina/westone-CVE-2020-17519-scanner

CVE-2020-17518

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.

• https://github.com/zhzyker/vulmap

• https://github.com/QmF0c3UK/CVE-2020-17518

• https://github.com/murataydemir/CVE-2020-17518

• https://github.com/rakjong/Flink-CVE-2020-17518-getshell

CVE-2020-17496

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

• https://github.com/ludy-dev/vBulletin_5.x-tab_panel-RCE

• https://github.com/ctlyz123/CVE-2020-17496

CVE-2020-17456

SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.

• https://github.com/TAPESH-TEAM/CVE-2020-17456-Seowon-SLR-120S42G-RCE-Exploit-Unauthenticated

• https://github.com/Al1ex/CVE-2020-17456

CVE-2020-17453

WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.

• https://github.com/karthi-the-hacker/CVE-2020-17453

• https://github.com/ydycjz6j/CVE-2020-17453-PoC

CVE-2020-17382

The MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overflow (0x80102040, 0x80102044, 0x80102050,and 0x80102054).

• https://github.com/uf0o/CVE-2020-17382

• https://github.com/houseofxyz/CVE-2020-17382

CVE-2020-17144

Microsoft Exchange Remote Code Execution Vulnerability

• https://github.com/zcgonvh/CVE-2020-17144

• https://github.com/Airboi/CVE-2020-17144-EXP

CVE-2020-17136

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

• https://github.com/cssxn/CVE-2020-17136

• https://github.com/xyddnljydd/CVE-2020-17136

CVE-2020-17087

Windows Kernel Local Elevation of Privilege Vulnerability

• https://github.com/vp777/Windows-Non-Paged-Pool-Overflow-Exploitation

• https://github.com/TinToSer/CVE2020-17087

• https://github.com/revengsh/CVE-2020-17087

• https://github.com/raiden757/CVE-2020-17087

• https://github.com/ykg88/OHTS_IE6052-CVE-2020-17087

CVE-2020-17086

Raw Image Extension Remote Code Execution Vulnerability

• https://github.com/T81oub/CVE-2020-17086

CVE-2020-17057

Windows Win32k Elevation of Privilege Vulnerability

• https://github.com/lsw29475/CVE-2020-17057

• https://github.com/fengjixuchui/cve-2020-17057

CVE-2020-17035

Windows Kernel Elevation of Privilege Vulnerability

• https://github.com/flamelu/CVE-2020-17035-patch-analysis

CVE-2020-17008

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/jas502n/CVE-2020-17008

CVE-2020-16947

<p>A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the targeted user. If the targeted user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Outlook software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p> <p>Note that where severity is indicated as Critical in the Affected Products table, the Preview Pane is an attack vector.</p> <p>The security update addresses the vulnerability by correcting how Outlook handles objects in memory.</p>

• https://github.com/0neb1n/CVE-2020-16947

• https://github.com/MasterSploit/CVE-2020-16947

• https://github.com/Ken-Abruzzi/cve_2020_16947

CVE-2020-16939

<p>An elevation of privilege vulnerability exists when Group Policy improperly checks access. An attacker who successfully exploited this vulnerability could run processes in an elevated context.</p> <p>To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system.</p> <p>The security update addresses the vulnerability by correcting how Group Policy checks access.</p>

• https://github.com/rogue-kdc/CVE-2020-16939

CVE-2020-16938

<p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.</p>

• https://github.com/ioncodes/CVE-2020-16938

CVE-2020-16899

<p>A denial of service vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could cause a target system to stop responding.</p> <p>To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer. The vulnerability would not allow an attacker to execute code or to elevate user rights directly.</p> <p>The update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets.</p>

• https://github.com/advanced-threat-research/CVE-2020-16899

CVE-2020-16898

<p>A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client.</p> <p>To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer.</p> <p>The update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets.</p>

• https://github.com/advanced-threat-research/CVE-2020-16898

• https://github.com/0xeb-bp/cve-2020-16898

• https://github.com/ZephrFish/CVE-2020-16898

• https://github.com/momika233/CVE-2020-16898-exp

• https://github.com/komomon/CVE-2020-16898--EXP-POC

• https://github.com/jiansiting/cve-2020-16898

• https://github.com/corelight/CVE-2020-16898

• https://github.com/komomon/CVE-2020-16898-EXP-POC

• https://github.com/Maliek/CVE-2020-16898_Check

• https://github.com/initconf/CVE-2020-16898-Bad-Neighbor

• https://github.com/Q1984/CVE-2020-16898

• https://github.com/esnet-security/cve-2020-16898

• https://github.com/CPO-EH/CVE-2020-16898_Workaround

• https://github.com/CPO-EH/CVE-2020-16898_Checker

CVE-2020-16846

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

• https://github.com/hamza-boudouche/projet-secu

• https://github.com/zomy22/CVE-2020-16846-Saltstack-Salt-API

CVE-2020-16270

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of targeted application and perform phishing-related attacks. Vulnerable application used in more than 3000 organizations in different sectors from retail to industries.

• https://github.com/Security-AVS/CVE-2020-16270

CVE-2020-16152

The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.

• https://github.com/eriknl/CVE-2020-16152

• https://github.com/Nate0634034090/nate158g-m-w-n-l-p-d-a-o-e

CVE-2020-16127

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location.

• https://github.com/zev3n/Ubuntu-Gnome-privilege-escalation

CVE-2020-16126

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.

• https://github.com/zev3n/Ubuntu-Gnome-privilege-escalation

CVE-2020-16125

gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu (and potentially derivatives) this could be be chained with an additional issue that could allow a local user to create a new privileged account.

• https://github.com/za970120604/CVE-2020-16125-Reproduction

CVE-2020-16040

Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• https://github.com/maldev866/ChExp_CVE_2020_16040

CVE-2020-16012

Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

• https://github.com/aleksejspopovs/cve-2020-16012

CVE-2020-15999

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• https://github.com/oxfemale/CVE-2020-15999

• https://github.com/Marmeus/CVE-2020-15999

• https://github.com/maarlo/CVE-2020-15999

CVE-2020-15956

ActiveMediaServer.exe in ACTi NVR3 Standard Server 3.0.12.42 allows remote unauthenticated attackers to trigger a buffer overflow and application termination via a malformed payload.

• https://github.com/megamagnus/cve-2020-15956

CVE-2020-15946

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/danyx07/PoC-RCE-Rukovoditel

CVE-2020-15931

Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (that is configured within the product in its installation state) by generating a single Kerberos Pre-Authentication Failed (ID 4771) event on a Domain Controller.

• https://github.com/optiv/CVE-2020-15931

CVE-2020-15916

goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in the lanIp POST parameter.

• https://github.com/geniuszlyy/CVE-2020-15916

CVE-2020-15906

tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.

• https://github.com/S1lkys/CVE-2020-15906

CVE-2020-15873

In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php.

• https://github.com/limerencee/cs4239-cve-2020-15873

CVE-2020-15848

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/faklad/CVE-2020-15848

CVE-2020-15808

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/manucuf/CVE202015808

CVE-2020-15802

Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport, either LE or BR/EDR, and replace a bonding already established on the opposing transport, BR/EDR or LE, potentially overwriting an authenticated key with an unauthenticated key, or a key with greater entropy with one with less.

• https://github.com/francozappa/blur

CVE-2020-15780

An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.

• https://github.com/Annavid/CVE-2020-15780-exploit

CVE-2020-15778

** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

• https://github.com/cpandya2909/CVE-2020-15778

• https://github.com/Neko-chanQwQ/CVE-2020-15778-Exploit

• https://github.com/Evan-Zhangyf/CVE-2020-15778

CVE-2020-15589

A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the client to skip TLS certificate validation, leading to a man-in-the-middle attack against HTTPS and unauthenticated remote code execution.

• https://github.com/patois/zohocorp_dc

CVE-2020-15588

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges. This issue will occur only when untrusted communication is initiated with server. In cloud, Agent will always connect with trusted communication.

• https://github.com/patois/zohocorp_dc

CVE-2020-15568

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.

• https://github.com/divinepwner/TerraMaster-TOS-CVE-2020-15568

• https://github.com/n0bugz/CVE-2020-15568

CVE-2020-15492

An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) includes user input into a filesystem access without any further validation. This might allow an unauthenticated attacker to read files on the server via Directory Traversal, or possibly have unspecified other impact.

• https://github.com/patrickhener/CVE-2020-15492

CVE-2020-15436

Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.

• https://github.com/Trinadh465/linux-4.19.72_CVE-2020-15436

CVE-2020-15416

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9703.

• https://github.com/k3vinlusec/R7000_httpd_BOF_CVE-2020-15416

CVE-2020-15399

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/mkelepce/CVE-2020-15399

CVE-2020-15392

A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames.

• https://github.com/inflixim4be/CVE-2020-15392

CVE-2020-15368

AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a request to zero CR3.

• https://github.com/stong/CVE-2020-15368

• https://github.com/R7flex/asrockploit

CVE-2020-15367

Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page.

• https://github.com/inflixim4be/CVE-2020-15367

CVE-2020-15349

BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC interface that allows file operations to any process (copy, move, delete) as root and changing permissions.

• https://github.com/Traxes/Forklift_LPE

CVE-2020-15261

On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.

• https://github.com/yaoyao-cool/CVE-2020-15261

CVE-2020-15257

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.

• https://github.com/nccgroup/abstractshimmer

CVE-2020-15256

A prototype pollution vulnerability has been found in object-path <= 0.11.4 affecting the set() method. The vulnerability is limited to the includeInheritedProps mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of set() in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the includeInheritedProps: true options or the withInheritedProps instance if using a version >= 0.11.0.

• https://github.com/ossf-cve-benchmark/CVE-2020-15256

CVE-2020-15228

In the @actions/core npm module before version 1.2.6,addPath and exportVariable functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment variables being modified without the intention of the workflow or action author. The runner will release an update that disables the set-env and add-path workflow commands in the near future. For now, users should upgrade to @actions/core v1.2.6 or later, and replace any instance of the set-env or add-path commands in their workflows with the new Environment File Syntax. Workflows and actions using the old commands or older versions of the toolkit will start to warn, then error out during workflow execution.

• https://github.com/guettli/fix-CVE-2020-15228

CVE-2020-15227

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.

• https://github.com/hu4wufu/CVE-2020-15227

• https://github.com/filipsedivy/CVE-2020-15227

• https://github.com/Langriklol/CVE-2020-15227

CVE-2020-15175

In GLPI before version 9.5.2, the ​pluginimage.send.php​ endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. The issue is patched in version 9.5.2.

• https://github.com/Xn2/GLPwn

CVE-2020-15169

In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the t and translate helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.

• https://github.com/glasses618/CVE-2020-15169

CVE-2020-15156

In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.

• https://github.com/ossf-cve-benchmark/CVE-2020-15156

CVE-2020-15152

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.

• https://github.com/ossf-cve-benchmark/CVE-2020-15152

CVE-2020-15148

Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls unserialize() on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.

• https://github.com/Maskhe/CVE-2020-15148-bypasses

• https://github.com/0xkami/cve-2020-15148

CVE-2020-15138

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

• https://github.com/ossf-cve-benchmark/CVE-2020-15138

CVE-2020-15135

save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including uploading/deleting files and adding redirects. If you are logged in as root, this attack is significantly more severe. They can in addition create, delete and update users. If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password. Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded. This issue has been patched in version 1.0.7.

• https://github.com/ossf-cve-benchmark/CVE-2020-15135

CVE-2020-15123

In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE (CVE-2020-7597 for GHSA-5q88-cjfq-g2mh) was issued but the fix was incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer. The attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection.

• https://github.com/ossf-cve-benchmark/CVE-2020-15123

CVE-2020-15119

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

• https://github.com/ossf-cve-benchmark/CVE-2020-15119

CVE-2020-15095

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.

• https://github.com/ossf-cve-benchmark/CVE-2020-15095

CVE-2020-15092

In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most TimelineJS users configure their timeline with a Google Sheets document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if they grant public write access to the document. Some TimelineJS users configure their timeline with a JSON document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if write access to the system hosting that document is otherwise compromised. Version 3.7.0 of TimelineJS addresses this in two ways. For content which is intended to support limited HTML markup for styling and linking, that content is "sanitized" before being added to the DOM. For content intended for simple text display, all markup is stripped. Very few users of TimelineJS actually install the TimelineJS code on their server. Most users publish a timeline using a URL hosted on systems we control. The fix for this issue is published to our system such that those users will automatically begin using the new code. The only exception would be users who have deliberately edited the embed URL to "pin" their timeline to an earlier version of the code. Some users of TimelineJS use it as a part of a wordpress plugin (knight-lab-timelinejs). Version 3.7.0.0 of that plugin and newer integrate the updated code. Users are encouraged to update the plugin rather than manually update the embedded version of TimelineJS.

• https://github.com/ossf-cve-benchmark/CVE-2020-15092

CVE-2020-15053

An issue was discovered in Artica Proxy CE before 4.28.030.418. Reflected XSS exists via these search fields: real time request, System Events, Proxy Events, Proxy Objects, and Firewall objects.

• https://github.com/pratikshad19/CVE-2020-15053

CVE-2020-15052

An issue was discovered in Artica Proxy CE before 4.28.030.418. SQL Injection exists via the Netmask, Hostname, and Alias fields.

• https://github.com/pratikshad19/CVE-2020-15052

CVE-2020-15051

An issue was discovered in Artica Proxy before 4.30.000000. Stored XSS exists via the Server Domain Name, Your Email Address, Group Name, MYSQL Server, Database, MYSQL Username, Group Name, and Task Description fields.

• https://github.com/pratikshad19/CVE-2020-15051

CVE-2020-15002

OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.

• https://github.com/skr0x1c0/SSRF-CVE-2020-15002

• https://github.com/skr0x1c0/Blind-SSRF-CVE-2020-15002

CVE-2020-14974

The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to unlock a file and kill processes (even ones running as SYSTEM) that hold a handle, via IOCTL code 0x222124.

• https://github.com/Aterror2be/CVE-2020-14974

CVE-2020-14965

On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML context of the target pages and stations in the access-control settings via targets_lists_name or hosts_lists_name. The vulnerability can also be exploited through a CSRF, requiring no authentication as an administrator.

• https://github.com/g-rubert/CVE-2020-14965

CVE-2020-14955

In Jiangmin Antivirus 16.0.13.129, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220440.

• https://github.com/intrigus-lgtm/CVE-2020-14955

CVE-2020-14947

OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/ms_config/ms_snmp_config.php is mishandled in get_mib_oid.

• https://github.com/mhaskar/CVE-2020-14947

CVE-2020-14883

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/0xn0ne/weblogicScanner

• https://github.com/1n7erface/PocList

• https://github.com/jas502n/CVE-2020-14882

• https://github.com/murataydemir/CVE-2020-14883

• https://github.com/B1anda0/CVE-2020-14883

• https://github.com/fan1029/CVE-2020-14883EXP

• https://github.com/amacloudobia/CVE-2020-14883

• https://github.com/Osyanina/westone-CVE-2020-14883-scanner

CVE-2020-14882

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/zhzyker/exphub

• https://github.com/zhzyker/vulmap

• https://github.com/0xn0ne/weblogicScanner

• https://github.com/1n7erface/PocList

• https://github.com/jas502n/CVE-2020-14882

• https://github.com/GGyao/CVE-2020-14882_ALL

• https://github.com/pprietosanchez/CVE-2020-14750

• https://github.com/s1kr10s/CVE-2020-14882

• https://github.com/NS-Sp4ce/CVE-2020-14882

• https://github.com/XTeam-Wing/CVE-2020-14882

• https://github.com/murataydemir/CVE-2020-14883

• https://github.com/GGyao/CVE-2020-14882_POC

• https://github.com/adm1in/CodeTest

• https://github.com/milo2012/CVE-2020-14882

• https://github.com/QmF0c3UK/CVE-2020-14882

• https://github.com/wsfengfan/cve-2020-14882

• https://github.com/ludy-dev/Weblogic_Unauthorized-bypass-RCE

• https://github.com/corelight/CVE-2020-14882-weblogicRCE

• https://github.com/xfiftyone/CVE-2020-14882

• https://github.com/exploitblizzard/CVE-2020-14882-WebLogic

• https://github.com/kk98kk0/CVE-2020-14882

• https://github.com/mmioimm/cve-2020-14882

• https://github.com/Danny-LLi/CVE-2020-14882

• https://github.com/0thm4n3/cve-2020-14882

• https://github.com/murataydemir/CVE-2020-14882

• https://github.com/N0Coriander/CVE-2020-14882-14883

• https://github.com/Ormicron/CVE-2020-14882-GUI-Test

• https://github.com/ovProphet/CVE-2020-14882-checker

• https://github.com/qianniaoge/CVE-2020-14882_Exploit_Gui

• https://github.com/pwn3z/CVE-2020-14882-WebLogic

• https://github.com/alexfrancow/CVE-2020-14882

• https://github.com/BabyTeam1024/CVE-2020-14882

• https://github.com/LucasPDiniz/CVE-2020-14882

• https://github.com/xMr110/CVE-2020-14882

• https://github.com/nik0nz7/CVE-2020-14882

CVE-2020-14871

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

• https://github.com/hackingyseguridad/ssha

• https://github.com/robidev/CVE-2020-14871-Exploit

CVE-2020-14756

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/Y4er/CVE-2020-14756

• https://github.com/somatrasss/weblogic2021

CVE-2020-14750

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/0xn0ne/weblogicScanner

• https://github.com/pprietosanchez/CVE-2020-14750

• https://github.com/corelight/CVE-2020-14882-weblogicRCE

• https://github.com/kkhacklabs/CVE-2020-14750

CVE-2020-14645

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/DSO-Lab/defvul

• https://github.com/Y4er/CVE-2020-14645

• https://github.com/Schira4396/CVE-2020-14645

• https://github.com/DaBoQuan/CVE-2020-14645

• https://github.com/ChenZIDu/CVE-2020-14645

• https://github.com/HYWZ36/CVE-2020-14645-code

CVE-2020-14644

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/potats0/cve_2020_14644

• https://github.com/cokeBeer/logi

• https://github.com/0xkami/cve-2020-14644

CVE-2020-14386

A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.

• https://github.com/cgwalters/cve-2020-14386

CVE-2020-14381

A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

• https://github.com/nanopathi/linux-4.19.72_CVE-2020-14381

CVE-2020-14372

A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.

• https://github.com/kukrimate/CVE-2020-14372

CVE-2020-14368

A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery (CSRF) and consequently allowing a cross-site WebSocket hijack on Theia IDE. This flaw allows an attacker to gain full access to the victim's workspace through the /services endpoint. To perform a successful attack, the attacker conducts a Man-in-the-middle attack (MITM) and tricks the victim into executing a request via an untrusted link, which performs the CSRF and the Socket hijack. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

• https://github.com/codingchili/CVE-2020-14368

CVE-2020-14364

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.

• https://github.com/gejian-iscas/CVE-2020-14364

• https://github.com/y-f00l/CVE-2020-14364

CVE-2020-14356

A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.

• https://github.com/ShaikUsaf/linux-4.19.72_CVE-2020-14356

CVE-2020-14343

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

• https://github.com/j4k0m/loader-CVE-2020-14343

CVE-2020-14321

In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.

• https://github.com/HoangKien1020/CVE-2020-14321

• https://github.com/lanzt/CVE-2020-14321

• https://github.com/3mrgnc3/Moodle_3.9_RCE_AutoPwn

• https://github.com/f0ns1/CVE-2020-14321-modified-exploit

CVE-2020-14320

In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.

• https://github.com/3mrgnc3/Moodle_3.9_RCE_AutoPwn

CVE-2020-14295

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.

• https://github.com/0z09e/CVE-2020-14295

• https://github.com/mrg3ntl3m4n/CVE-2020-14295

• https://github.com/hadrian3689/cacti_1.2.12

CVE-2020-14294

An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board.

• https://github.com/patrickhener/CVE-2020-14294

CVE-2020-14293

conf_datetime in Secudos DOMOS 5.8 allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field (obtained from the web interface).

• https://github.com/patrickhener/CVE-2020-14293

CVE-2020-14292

In the COVIDSafe application through 1.0.21 for Android, unsafe use of the Bluetooth transport option in the GATT connection allows attackers to trick the application into establishing a connection over Bluetooth BR/EDR transport, which reveals the public Bluetooth address of the victim's phone without authorisation, bypassing the Bluetooth address randomisation protection in the user's phone.

• https://github.com/alwentiu/CVE-2020-14292

CVE-2020-14210

Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL information. It provides a function to response to Request URL information when blocking.

• https://github.com/monitorapp-aicc/report

CVE-2020-14195

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

• https://github.com/Al1ex/CVE-2020-14195

CVE-2020-14181

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0.

• https://github.com/Rival420/CVE-2020-14181

• https://github.com/bk-rao/CVE-2020-14181

• https://github.com/und3sc0n0c1d0/UserEnumJira

CVE-2020-14179

Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1.

• https://github.com/c0brabaghdad1/CVE-2020-14179

• https://github.com/mrnazu/CVE-2020-14179

• https://github.com/0x0060/CVE-2020-14179

CVE-2020-14144

** DISPUTED ** The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides."

• https://github.com/p0dalirius/CVE-2020-14144-GiTea-git-hooks-rce

CVE-2020-14066

IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for clients to access.

• https://github.com/networksecure/CVE-2020-14066

• https://github.com/pinpinsec/CVE-2020-14066

CVE-2020-14065

IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.

• https://github.com/networksecure/CVE-2020-14065

• https://github.com/pinpinsec/CVE-2020-14065

CVE-2020-14064

IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.

• https://github.com/networksecure/CVE-2020-14064

CVE-2020-14000

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code is getExtensionIdForOpcode in serialization/sb3.js. The use of _ is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. NOTE: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.

• https://github.com/ossf-cve-benchmark/CVE-2020-14000

CVE-2020-13996

The J2Store plugin before 3.3.13 for Joomla! allows a SQL injection attack by a trusted store manager.

• https://github.com/mkelepce/CVE-2020-13996

CVE-2020-13995

U.S. Air Force Sensor Data Management System extract75 has a buffer overflow that leads to code execution. An overflow in a global variable (sBuffer) leads to a Write-What-Where outcome. Writing beyond sBuffer will clobber most global variables until reaching a pointer such as DES_info or image_info. By controlling that pointer, one achieves an arbitrary write when its fields are assigned. The data written is from a potentially untrusted NITF file in the form of an integer. The attacker can gain control of the instruction pointer.

• https://github.com/dbrumley/extract75-cve-2020-13995

CVE-2020-13973

OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.

• https://github.com/epicosy/json-sanitizer

CVE-2020-13965

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

• https://github.com/mbadanoiu/CVE-2020-13965

CVE-2020-13958

A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the document event handler and other hyperlinks require a control-click.

• https://github.com/Grey-Junior/CVE-2020-13958

CVE-2020-13957

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.

• https://github.com/Imanfeng/Apache-Solr-RCE

• https://github.com/s-index/poc-list

• https://github.com/s-index/CVE-2020-13957

CVE-2020-13945

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

• https://github.com/K3ysTr0K3R/CVE-2020-13945-EXPLOIT

• https://github.com/YutuSec/Apisix_Crack

• https://github.com/x0root/CVE-2020-13945-EXPLOIT

CVE-2020-13942

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.

• https://github.com/zhzyker/vulmap

• https://github.com/eugenebmx/CVE-2020-13942

• https://github.com/shifa123/CVE-2020-13942-POC-

• https://github.com/1135/unomi_exploit

• https://github.com/lp008/CVE-2020-13942

• https://github.com/yaunsky/Unomi-CVE-2020-13942

• https://github.com/blackmarketer/CVE-2020-13942

• https://github.com/Prodrious/CVE-2020-13942

• https://github.com/hoanx4/apche_unomi_rce

CVE-2020-13937

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.

• https://github.com/yaunsky/CVE-2020-13937

• https://github.com/Al1ex/CVE-2020-13937

• https://github.com/kailing0220/CVE-2020-13937

CVE-2020-13935

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

• https://github.com/RedTeamPentesting/CVE-2020-13935

• https://github.com/aabbcc19191/CVE-2020-13935

CVE-2020-13933

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

• https://github.com/EXP-Docs/CVE-2020-13933

• https://github.com/0xkami/cve-2020-13933

• https://github.com/KingBangQ/CVE-2020-13933Project

CVE-2020-13925

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.

• https://github.com/bit4woo/CVE-2020-13925

CVE-2020-13921

Resolved Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.

• https://github.com/shanika04/apache_skywalking

CVE-2020-13889

showAlert() in the administration panel in Bludit 3.12.0 allows XSS.

• https://github.com/gh0st56/CVE-2020-13889

CVE-2020-13886

Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow cgi-bin/cgiServer.exx?page=../ Directory Traversal.

• https://github.com/Ls4ss/CVE-2020-13886

CVE-2020-13885

Citrix Workspace App before 1912 on Windows has Insecure Permissions which allows local users to gain privileges during the uninstallation of the application.

• https://github.com/hessandrew/CVE-2020-13885

CVE-2020-13884

Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows local users to gain privileges during the uninstallation of the application.

• https://github.com/hessandrew/CVE-2020-13884

CVE-2020-13851

Artica Pandora FMS 7.44 allows remote command execution via the events feature.

• https://github.com/hadrian3689/pandorafms_7.44

CVE-2020-13802

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.

• https://github.com/vulnbe/poc-rebar3

CVE-2020-13777

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.

• https://github.com/0xxon/cve-2020-13777

• https://github.com/shigeki/challenge_CVE-2020-13777

• https://github.com/prprhyt/PoC_TLS1_3_CVE-2020-13777

CVE-2020-13699

TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated by a teamviewer10: --play URL. An attacker could force a victim to send an NTLM authentication request and either relay the request or capture the hash for offline password cracking. This affects teamviewer10, teamviewer8, teamviewerapi, tvchat1, tvcontrol1, tvfiletransfer1, tvjoinv8, tvpresent1, tvsendfile1, tvsqcustomer1, tvsqsupport1, tvvideocall1, and tvvpn1. The issue is fixed in 8.0.258861, 9.0.258860, 10.0.258873, 11.0.258870, 12.0.258869, 13.2.36220, 14.2.56676, 14.7.48350, and 15.8.3.

• https://github.com/Dilshan-Eranda/CVE-2020-13699

CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)

• https://github.com/asterite3/CVE-2020-13640

CVE-2020-13519

A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c402088 functionality of NZXT CAM 4.8.0. A specially crafted I/O request packet (IRP) can cause increased privileges. An attacker can send a malicious IRP to trigger this vulnerability.

• https://github.com/SpiralBL0CK/poc-for-CVE-2020-13519-still-under-construction-

CVE-2020-13457

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/alt3kx/CVE-2020-13457

CVE-2020-13445

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.

• https://github.com/mbadanoiu/MAL-001

CVE-2020-13424

The XCloner component before 3.5.4 for Joomla! allows Authenticated Local File Disclosure.

• https://github.com/mkelepce/CVE-2020-13424

CVE-2020-13405

userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request.

• https://github.com/mrnazu/CVE-2020-13405

CVE-2020-13401

An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.

• https://github.com/arax-zaeimi/Docker-Container-CVE-2020-13401

CVE-2020-13277

An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5

• https://github.com/EXP-Docs/CVE-2020-13277

CVE-2020-13259

A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. This could be exploited in conjunction with CVE-2020-13260.

• https://github.com/UrielYochpaz/CVE-2020-13259

CVE-2020-13254

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

• https://github.com/danpalmer/django-cve-2020-13254

CVE-2020-13162

A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM) allows unprivileged users to run a Microsoft Installer executable with elevated privileges.

• https://github.com/redtimmy/tu-TOCTOU-kaiu-TOCMEU-CVE-2020-13162-

CVE-2020-13159

Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name, dhclient_mac, Hostname, or Alias field. NOTE: this may overlap CVE-2020-10818.

• https://github.com/InfoSec4Fun/CVE-2020-13159

CVE-2020-13158

Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter.

• https://github.com/InfoSec4Fun/CVE-2020-13158

CVE-2020-13151

Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute() calls, but this is insufficient. Anyone with network access can use a crafted UDF to execute arbitrary OS commands on all nodes of the cluster at the permission level of the user running the Aerospike service.

• https://github.com/b4ny4n/CVE-2020-13151

CVE-2020-13094

Dolibarr before 11.0.4 allows XSS.

• https://github.com/mkelepce/CVE-2020-13094

CVE-2020-12928

A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any authenticated user to escalate privileges to NT authority system.

• https://github.com/tijme/amd-ryzen-master-driver-v17-exploit

• https://github.com/ekknod/AmdRyzenMasterCheat

CVE-2020-12873

An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. A user with privileges to edit a FreeMarker template (e.g., a webscript) may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running Alfresco.

• https://github.com/mbadanoiu/CVE-2023-49964

CVE-2020-12856

OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.

• https://github.com/alwentiu/COVIDSafe-CVE-2020-12856

CVE-2020-12828

An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations over a socket bound to localhost. Binding to the socket and providing a path where a malicious executable file resides leads to executing the malicious executable file with SYSTEM privileges.

• https://github.com/0xsha/ZombieVPN

CVE-2020-12800

The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.

• https://github.com/amartinsec/CVE-2020-12800

CVE-2020-12753

An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Arbitrary code execution can occur via the bootloader because of an EL1/EL3 coldboot vulnerability involving raw_resources. The LG ID is LVE-SMP-200006 (May 2020).

• https://github.com/shinyquagsire23/CVE-2020-12753-PoC

CVE-2020-12720

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.

• https://github.com/cocomelonc/vulnexipy

CVE-2020-12717

The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected.

• https://github.com/wabzqem/covidsafe-CVE-2020-12717-exploit

CVE-2020-12712

A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile.

• https://github.com/SanderUbink/CVE-2020-12712

CVE-2020-12702

Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during the pairing process.

• https://github.com/salgio/ESPTouchCatcher

• https://github.com/salgio/eWeLink-QR-Code

CVE-2020-12696

The iframe plugin before 4.5 for WordPress does not sanitize a URL.

• https://github.com/g-rubert/CVE-2020-12696

CVE-2020-12695

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

• https://github.com/yunuscadirci/CallStranger

• https://github.com/corelight/callstranger-detector

CVE-2020-12688

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/TheCyberGeek/Centreon-20.04

CVE-2020-12641

rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

• https://github.com/mbadanoiu/CVE-2020-12641

• https://github.com/mbadanoiu/MAL-004

CVE-2020-12640

Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.

• https://github.com/mbadanoiu/CVE-2020-12640

CVE-2020-12629

include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.

• https://github.com/mkelepce/CVE-2020-12629

CVE-2020-12625

An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.

• https://github.com/mbadanoiu/CVE-2020-12625

CVE-2020-12593

Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data.

• https://github.com/nasbench/CVE-2020-12593

CVE-2020-12432

The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtain an API access token, which can be accomplished if the attacker is able to upload a .docx or .odt file. The associated API endpoints for exploitation are /wopi/files and /wopi/getAccessToken.

• https://github.com/d7x/CVE-2020-12432

CVE-2020-12351

Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

• https://github.com/naren-jayram/Linux-Heap-Based-Type-Confusion-in-L2CAP

CVE-2020-12265

The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.

• https://github.com/ossf-cve-benchmark/CVE-2020-12265

CVE-2020-12255

rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file upload by checking content-type without considering the file extension and header. Thus, an attacker can exploit this by uploading a .php file to vendor.php that contains arbitrary PHP code and changing the content-type to image/gif.

• https://github.com/vishwaraj101/CVE-2020-12255

CVE-2020-12124

A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.

• https://github.com/Scorpion-Security-Labs/CVE-2020-12124

• https://github.com/db44k/CVE-2020-12124

CVE-2020-12116

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.

• https://github.com/BeetleChunks/CVE-2020-12116

CVE-2020-12112

BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.

• https://github.com/tchenu/CVE-2020-12112

CVE-2020-12078

An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.

• https://github.com/mhaskar/CVE-2020-12078

• https://github.com/84KaliPleXon3/CVE-2020-12078

CVE-2020-12077

The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks), leading to remote code execution.

• https://github.com/RandomRobbieBF/CVE-2020-12077

CVE-2020-11996

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

• https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996

CVE-2020-11990

We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead the victim to install) a specially crafted (or malicious) Android application would be able to access pictures taken with the app externally.

• https://github.com/forse01/CVE-2020-11990-Cordova

CVE-2020-11989

Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

• https://github.com/HYWZ36/HYWZ36-CVE-2020-11989-code

CVE-2020-11978

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.

• https://github.com/pberba/CVE-2020-11978

CVE-2020-11975

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.

• https://github.com/1135/unomi_exploit

CVE-2020-11932

It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.

• https://github.com/ProjectorBUg/CVE-2020-11932

• https://github.com/Staubgeborener/CVE-2020-11932

• https://github.com/code-developers/CVE-2020-11932

CVE-2020-11901

The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.

• https://github.com/advanced-threat-research/Ripple-20-Detection-Logic

CVE-2020-11898

The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an information leak.

• https://github.com/scamwork/POC_CVE-2020-11898

CVE-2020-11897

The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets.

• https://github.com/advanced-threat-research/Ripple-20-Detection-Logic

CVE-2020-11896

The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

• https://github.com/advanced-threat-research/Ripple-20-Detection-Logic

• https://github.com/Fans0n-Fan/Treck20-Related

• https://github.com/0xkol/ripple20-digi-connect-exploit

CVE-2020-11890

An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration.

• https://github.com/HoangKien1020/CVE-2020-11890

CVE-2020-11883

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.

• https://github.com/0ndras3k/CVE-2020-11883

CVE-2020-11881

An array index error in MikroTik RouterOS 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5, allows an unauthenticated remote attacker to crash the SMB server via modified setup-request packets, aka SUP-12964.

• https://github.com/botlabsDev/CVE-2020-11881

CVE-2020-11851

Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in the execution of arbitrary code.

• https://github.com/ch1nghz/CVE-2020-11851

CVE-2020-11819

In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.

• https://github.com/danyx07/PoC-RCE-Rukovoditel

CVE-2020-11794

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/w4cky/CVE-2020-11794

CVE-2020-11738

The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.

• https://github.com/raghu66669999/wordpress-snapcreek

CVE-2020-11710

** DISPUTED ** An issue was discovered in docker-kong (for Kong) through 2.0.3. The admin API port may be accessible on interfaces other than 127.0.0.1. NOTE: The vendor argue that this CVE is not a vulnerability because it has an inaccurate bug scope and patch links. “1) Inaccurate Bug Scope - The issue scope was on Kong's docker-compose template, and not Kong's docker image itself. In reality, this issue is not associated with any version of the Kong gateway. As such, the description stating ‘An issue was discovered in docker-kong (for Kong) through 2.0.3.’ is incorrect. This issue only occurs if a user decided to spin up Kong via docker-compose without following the security documentation. The docker-compose template is meant for users to quickly get started with Kong, and is meant for development purposes only. 2) Incorrect Patch Links - The CVE currently points to a documentation improvement as a “Patch” link: https://github.com/Kong/docs.konghq.com/commit/d693827c32144943a2f45abc017c1321b33ff611.This link actually points to an improvement Kong Inc made for fool-proofing. However, instructions for how to protect the admin API were already well-documented here: https://docs.konghq.com/2.0.x/secure-admin-api/#network-layer-access-restrictions , which was first published back in 2017 (as shown in this commit: https://github.com/Kong/docs.konghq.com/commit/e99cf875d875dd84fdb751079ac37882c9972949) Lastly, the hyperlink to https://github.com/Kong/kong (an unrelated Github Repo to this issue) on the Hyperlink list does not include any meaningful information on this topic.”

• https://github.com/RandomRobbieBF/kong-pwn

CVE-2020-11652

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

• https://github.com/jasperla/CVE-2020-11651-poc

• https://github.com/rossengeorgiev/salt-security-backports

• https://github.com/0xc0d/CVE-2020-11651

• https://github.com/ssrsec/CVE-2020-11651-CVE-2020-11652-EXP

• https://github.com/bravery9/SaltStack-Exp

• https://github.com/chef-cft/salt-vulnerabilities

• https://github.com/Al1ex/CVE-2020-11652

• https://github.com/limon768/CVE-2020-11652-POC

• https://github.com/fanjq99/CVE-2020-11652

• https://github.com/appcheck-ng/salt-rce-scanner-CVE-2020-11651-CVE-2020-11652

CVE-2020-11651

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

• https://github.com/jasperla/CVE-2020-11651-poc

• https://github.com/rossengeorgiev/salt-security-backports

• https://github.com/dozernz/cve-2020-11651

• https://github.com/0xc0d/CVE-2020-11651

• https://github.com/ssrsec/CVE-2020-11651-CVE-2020-11652-EXP

• https://github.com/bravery9/SaltStack-Exp

• https://github.com/kevthehermit/CVE-2020-11651

• https://github.com/chef-cft/salt-vulnerabilities

• https://github.com/Al1ex/CVE-2020-11652

• https://github.com/lovelyjuice/cve-2020-11651-exp-plus

• https://github.com/limon768/CVE-2020-11652-POC

• https://github.com/RakhithJK/CVE-2020-11651

• https://github.com/hardsoftsecurity/CVE-2020-11651-PoC

• https://github.com/appcheck-ng/salt-rce-scanner-CVE-2020-11651-CVE-2020-11652

CVE-2020-11650

An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent.

• https://github.com/weinull/CVE-2020-11650

CVE-2020-11579

An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation process) allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled.

• https://github.com/ShielderSec/CVE-2020-11579

CVE-2020-11547

PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.

• https://github.com/ch-rigu/CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure

CVE-2020-11546

SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.

• https://github.com/Official-BlackHat13/CVE-2020-11546

• https://github.com/damit5/CVE-2020-11546

CVE-2020-11539

An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any authentication or signature verification. Thus, any attacker can control a parameter of the device.

• https://github.com/the-girl-who-lived/CVE-2020-11539

CVE-2020-11520

The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to write to arbitrary kernel memory addresses because the IOCTL dispatcher lacks pointer validation. Exploiting this vulnerability results in privileged code execution.

• https://github.com/patois/winmagic_sd

CVE-2020-11519

The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to read or write to physical disc sectors via a \.\SecureDocDevice handle. Exploiting this vulnerability results in privileged code execution.

• https://github.com/patois/winmagic_sd

CVE-2020-11493

In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information about an uninitialized object because of direct transformation from PDF Object to Stream without concern for a crafted XObject.

• https://github.com/fengjixuchui/CVE-2020-11493

CVE-2020-11492

An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and then impersonate their privileges.

• https://github.com/CrackerCat/CVE-2020-11492

CVE-2020-11444

Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.

• https://github.com/zhzyker/exphub

• https://github.com/jas502n/CVE-2020-10199

• https://github.com/zhzyker/CVE-2020-11444

• https://github.com/CN016/Nexus-Repository-Manager-3-CVE-2020-11444-

CVE-2020-11179

Arbitrary read and write to kernel addresses by temporarily overwriting ring buffer pointer and creating a race condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

• https://github.com/sparrow-labz/CVE-2020-11179-Adreno-Qualcomm-GPU

CVE-2020-11113

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

• https://github.com/Al1ex/CVE-2020-11113

CVE-2020-11110

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

• https://github.com/AVE-Stoik/CVE-2020-11110-Proof-of-Concept

CVE-2020-11108

The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.

• https://github.com/Frichetten/CVE-2020-11108-PoC

CVE-2020-11107

An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini for all users (including admins) to enable arbitrary command execution.

• https://github.com/S1lkys/CVE-2020-11107

• https://github.com/andripwn/CVE-2020-11107

CVE-2020-11079

node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.

• https://github.com/ossf-cve-benchmark/CVE-2020-11079

CVE-2020-11077

In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This is a similar but different vulnerability from CVE-2020-11076. The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

• https://github.com/dentarg/cougar

CVE-2020-11076

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

• https://github.com/dentarg/cougar

CVE-2020-11060

In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.

• https://github.com/0xdreadnaught/cve-2020-11060-poc

• https://github.com/zeromirror/cve_2020-11060

CVE-2020-11059

In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm. This has been fixed in 21.10.1.

• https://github.com/ossf-cve-benchmark/CVE-2020-11059

CVE-2020-11023

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

• https://github.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023

• https://github.com/DanielRuf/snyk-js-jquery-565129

• https://github.com/Cybernegro/CVE-2020-11023

• https://github.com/Snorlyd/https-nj.gov---CVE-2020-11023

• https://github.com/andreassundstrom/cve-2020-11023-demonstration

CVE-2020-11022

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

• https://github.com/0xAJ2K/CVE-2020-11022-CVE-2020-11023

• https://github.com/DanielRuf/snyk-js-jquery-565129

• https://github.com/ossf-cve-benchmark/CVE-2020-11022

• https://github.com/Snorlyd/https-nj.gov---CVE-2020-11022

CVE-2020-11021

Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8.

• https://github.com/ossf-cve-benchmark/CVE-2020-11021

CVE-2020-11019

In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0.

• https://github.com/Lixterclarixe/CVE-2020-11019

CVE-2020-10977

GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.

• https://github.com/dotPY-hax/gitlab_RCE

• https://github.com/thewhiteh4t/cve-2020-10977

• https://github.com/cocomelonc/vulnexipy

• https://github.com/Bin4xin/bin4xin.github.io

• https://github.com/KooroshRZ/CVE-2020-10977

• https://github.com/liath/CVE-2020-10977

• https://github.com/vandycknick/gitlab-cve-2020-10977

• https://github.com/lisp3r/cve-2020-10977-read-and-execute

• https://github.com/possib1e/cve-2020-10977

• https://github.com/JustMichi/CVE-2020-10977.py

• https://github.com/erk3/gitlab-12.9.0-file-read

CVE-2020-10963

FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.

• https://github.com/scopion/CVE-2020-10963

CVE-2020-10915

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10401.

• https://github.com/Cinnamon1212/Modified-CVE-2020-10915-MsfModule

CVE-2020-10882

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. When parsing the slave_mac parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9650.

• https://github.com/lnversed/CVE-2020-10882

CVE-2020-10770

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.

• https://github.com/ColdFusionX/Keycloak-12.0.1-CVE-2020-10770

CVE-2020-10759

A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity.

• https://github.com/justinsteven/CVE-2020-10759-poc

CVE-2020-10757

A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.

• https://github.com/ShaikUsaf/linux-4.19.72_CVE-2020-10757

CVE-2020-10749

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.

• https://github.com/knqyf263/CVE-2020-10749

CVE-2020-10713

A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

• https://github.com/eclypsium/BootHole

CVE-2020-10673

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

• https://github.com/Al1ex/CVE-2020-10673

• https://github.com/harry1080/CVE-2020-10673

CVE-2020-10665

Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker Desktop for Windows Stable before 2.2.0.4, and Docker Desktop for Windows Edge before 2.2.2.0.

• https://github.com/spaceraccoon/CVE-2020-10665

CVE-2020-10663

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

• https://github.com/rails-lts/json_cve_2020_10663

CVE-2020-10596

OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.

• https://github.com/miguelc49/CVE-2020-10596-1

• https://github.com/miguelc49/CVE-2020-10596-2

CVE-2020-10560

An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can be used to read any file with the permissions of the webserver. This can lead to further compromise. The attacker must conduct a brute-force attack against the SiteKey to insert into a crafted URL for components/OssnComments/ossn_com.php and/or libraries/ossn.lib.upgrade.php.

• https://github.com/kevthehermit/CVE-2020-10560

• https://github.com/alex-seymour/CVE-2020-10560-Key-Recovery

CVE-2020-10558

The driving interface of Tesla Model 3 vehicles in any release before 2020.4.10 allows Denial of Service to occur due to improper process separation, which allows attackers to disable the speedometer, web browser, climate controls, turn signal visual and sounds, navigation, autopilot notifications, along with other miscellaneous functions from the main screen.

• https://github.com/nullze/CVE-2020-10558

• https://github.com/AmazingOut/Tesla-CVE-2020-10558

CVE-2020-10551

QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. This file is writable by anyone belonging to the NT AUTHORITY\Authenticated Users group, which includes all local and remote users. This can be abused by local attackers to escalate privileges to NT AUTHORITY\SYSTEM by writing a malicious executable to the location of TsService.

• https://github.com/seqred-s-a/CVE-2020-10551

CVE-2020-10239

An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows access for non-superadmin users.

• https://github.com/HoangKien1020/CVE-2020-10239

CVE-2020-10238

An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.

• https://github.com/HoangKien1020/CVE-2020-10238

CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.

• https://github.com/arvind2022/isac_rconfig3.9

CVE-2020-10204

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

• https://github.com/zhzyker/exphub

• https://github.com/CLincat/vulcat

• https://github.com/jas502n/CVE-2020-10199

• https://github.com/magicming200/CVE-2020-10199_CVE-2020-10204

• https://github.com/wsfengfan/CVE-2020-10199-10204

• https://github.com/zhzyker/CVE-2020-10204

CVE-2020-10199

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

• https://github.com/zhzyker/exphub

• https://github.com/zhzyker/CVE-2020-10199_POC-EXP

• https://github.com/jas502n/CVE-2020-10199

• https://github.com/aleenzz/CVE-2020-10199

• https://github.com/magicming200/CVE-2020-10199_CVE-2020-10204

• https://github.com/wsfengfan/CVE-2020-10199-10204

• https://github.com/hugosg97/CVE-2020-10199-Nexus-3.21.01

CVE-2020-10189

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.

• https://github.com/WLDDTeam/WindowsDefualtServicesChecker

• https://github.com/zavke/CVE-2020-10189-ManageEngine

CVE-2020-10148

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.

• https://github.com/B1anda0/CVE-2020-10148

• https://github.com/rdoix/CVE-2020-10148-Solarwinds-Orion

CVE-2020-10135

Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.

• https://github.com/francozappa/bias

• https://github.com/m4rm0k/CVE-2020-10135-BIAS

CVE-2020-10132

SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration.

• https://github.com/InfoSec4Fun/CVE-2020-10132

CVE-2020-10131

SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter.

• https://github.com/InfoSec4Fun/CVE-2020-10131

CVE-2020-10130

SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system.

• https://github.com/InfoSec4Fun/CVE-2020-10130

CVE-2020-10129

SearchBlox before Version 9.2.1 is vulnerable to Privileged Escalation-Lower user is able to access Admin functionality.

• https://github.com/InfoSec4Fun/CVE-2020-10129

CVE-2020-10128

SearchBlox product with version before 9.2.1 is vulnerable to stored cross-site scripting at multiple user input parameters. In SearchBlox products multiple parameters are not sanitized/validate properly which allows an attacker to inject malicious JavaScript.

• https://github.com/InfoSec4Fun/CVE-2020-10128

CVE-2020-9999

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, iTunes for Windows 12.10.9. Processing a maliciously crafted text file may lead to arbitrary code execution.

• https://github.com/tdcoming/CVE-2020-9999

• https://github.com/tdcoming/CVE-2020-99999999

CVE-2020-9992

This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0, Xcode 12.0. An attacker in a privileged network position may be able to execute arbitrary code on a paired device during a debug session over the network.

• https://github.com/c0ntextomy/c0ntextomy

CVE-2020-9934

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.

• https://github.com/mattshockl/CVE-2020-9934

CVE-2020-9922

A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra. Processing a maliciously crafted email may lead to writing arbitrary files.

• https://github.com/Wowfunhappy/Fix-Apple-Mail-CVE-2020-9922

CVE-2020-9898

This issue was addressed with improved entitlements. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A sandboxed process may be able to circumvent sandbox restrictions.

• https://github.com/tdcoming/CVE-2020-98989

CVE-2020-9854

A logic issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5. An application may be able to gain elevated privileges.

• https://github.com/A2nkF/unauthd

CVE-2020-9802

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to arbitrary code execution.

• https://github.com/khcujw/CVE-2020-9802

CVE-2020-9767

A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which the service was running with elevated privileges to elevate their system privileges as well through use of a malicious DLL. Zoom addressed this issue, which only applies to Windows users, in the 5.0.4 client release.

• https://github.com/shubham0d/Zoom-dll-hijacking

CVE-2020-9759

A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable files.

• https://github.com/RootMyTV/RootMyTV.github.io

CVE-2020-9758

An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level access, leading to full account takeover. The attack fetches multiple credentials because they are stored in the database (stored XSS). This affects the mobile/chat URI via the lgn and psswrd parameters.

• https://github.com/ari034/CVE-2020-9758

CVE-2020-9715

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .

• https://github.com/lsw29475/CVE-2020-9715

• https://github.com/wonjunchun/CVE-2020-9715

CVE-2020-9548

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

• https://github.com/fairyming/CVE-2020-9548

CVE-2020-9547

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

• https://github.com/fairyming/CVE-2020-9547

CVE-2020-9496

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

• https://github.com/g33xter/CVE-2020-9496

• https://github.com/yuaneuro/ofbiz-poc

• https://github.com/dwisiswant0/CVE-2020-9496

• https://github.com/s4dbrd/CVE-2020-9496

• https://github.com/Ly0nt4r/CVE-2020-9496

• https://github.com/Vulnmachines/apache-ofbiz-CVE-2020-9496

• https://github.com/cyber-niz/CVE-2020-9496

• https://github.com/ambalabanov/CVE-2020-9496

CVE-2020-9495

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects.

• https://github.com/ggolawski/CVE-2020-9495

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

• https://github.com/HynekPetrak/log4shell-finder

CVE-2020-9484

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

• https://github.com/threedr3am/tomcat-cluster-session-sync-exp

• https://github.com/masahiro331/CVE-2020-9484

• https://github.com/IdealDreamLast/CVE-2020-9484

• https://github.com/osamahamad/CVE-2020-9484-Mass-Scan

• https://github.com/PenTestical/CVE-2020-9484

• https://github.com/0dayCTF/CVE-2020-9484

• https://github.com/d3fudd/CVE-2020-9484_Exploit

• https://github.com/VICXOR/CVE-2020-9484

• https://github.com/anjai94/CVE-2020-9484-exploit

• https://github.com/AssassinUKG/CVE-2020-9484

• https://github.com/RepublicR0K/CVE-2020-9484

• https://github.com/ColdFusionX/CVE-2020-9484

• https://github.com/HxDDD/CVE-PoC

• https://github.com/qerogram/CVE-2020-9484

• https://github.com/seanachao/CVE-2020-9484

• https://github.com/DXY0411/CVE-2020-9484

• https://github.com/Disturbante/CVE-2020-9484

• https://github.com/DanQMoo/CVE-2020-9484-Scanner

• https://github.com/savsch/PoC_CVE-2020-9484

CVE-2020-9483

Resolved When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.

• https://github.com/CLincat/vulcat

• https://github.com/Neko-chanQwQ/CVE-2020-9483

• https://github.com/shanika04/apache_skywalking

CVE-2020-9480

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

• https://github.com/XiaoShaYu617/CVE-2020-9480

CVE-2020-9472

Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.

• https://github.com/john-dooe/CVE-2020-9472

CVE-2020-9470

An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the contents of the session and session_admin directories, which expose active session cookies within the Wing FTP HTTP interface and administration panel. These cookies may be used to hijack user and administrative sessions, including the ability to execute Lua commands as root within the administration panel.

• https://github.com/Al1ex/CVE-2020-9470

CVE-2020-9461

Octech Oempro 4.7 through 4.11 allow stored XSS by an authenticated user. The FolderName parameter of the Media.CreateFolder command is vulnerable.

• https://github.com/g-rubert/CVE-2020-9461

CVE-2020-9460

Octech Oempro 4.7 through 4.11 allow XSS by an authenticated user. The parameter CampaignName in Campaign.Create is vulnerable.

• https://github.com/g-rubert/CVE-2020-9460

CVE-2020-9442

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there.

• https://github.com/hessandrew/CVE-2020-9442

CVE-2020-9380

IPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by uploading a script.

• https://github.com/migueltarga/CVE-2020-9380

CVE-2020-9377

** UNSUPPORTED WHEN ASSIGNED ** D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

• https://github.com/renatoalencar/dlink-dir610-exploits

CVE-2020-9376

** UNSUPPORTED WHEN ASSIGNED ** D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

• https://github.com/renatoalencar/dlink-dir610-exploits

CVE-2020-9375

TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexpected Referer field.

• https://github.com/thewhiteh4t/cve-2020-9375

CVE-2020-9332

ftusbbus2.sys in FabulaTech USB for Remote Desktop through 2020-02-19 allows privilege escalation via crafted IoCtl code related to a USB HID device.

• https://github.com/Sentinel-One/CVE-2020-9332

CVE-2020-9289

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key.

• https://github.com/synacktiv/CVE-2020-9289

CVE-2020-9283

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

• https://github.com/brompwnie/CVE-2020-9283

CVE-2020-9273

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

• https://github.com/ptef/CVE-2020-9273

CVE-2020-9054

Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2

• https://github.com/darrenmartyn/CVE-2020-9054

CVE-2020-9047

A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system.

• https://github.com/norrismw/CVE-2020-9047

CVE-2020-9038

Joplin through 1.0.184 allows Arbitrary File Read via XSS.

• https://github.com/JavierOlmedo/CVE-2020-9038

• https://github.com/ossf-cve-benchmark/CVE-2020-9038

CVE-2020-9008

Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.

• https://github.com/kyletimmermans/blackboard-xss

CVE-2020-9006

The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)

• https://github.com/s3rgeym/cve-2020-9006

CVE-2020-8961

An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. The Self-Protection feature does not prohibit a write operation from an external process. Thus, code injection can be used to turn off this feature. After that, one can construct an event that will modify a file at a specific location, and pass this event to the driver, thereby defeating the anti-virus functionality.

• https://github.com/Parasect-Team/for-avira

CVE-2020-8958

Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the boaform/admin/formPing Dest IP Address field.

• https://github.com/qurbat/CVE-2020-8958

• https://github.com/Asjidkalam/CVE-2020-8958

CVE-2020-8950

The AUEPLauncher service in Radeon AMD User Experience Program Launcher through 1.0.0.1 on Windows allows elevation of privilege by placing a crafted file in %PROGRAMDATA%\AMD\PPC\upload and then creating a symbolic link in %PROGRAMDATA%\AMD\PPC\temp that points to an arbitrary folder with an arbitrary file name.

• https://github.com/sailay1996/amd_eop_poc

CVE-2020-8888

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/SnipJoe/CVE-2020-8888

• https://github.com/tdcoming/CVE-2020-88888

CVE-2020-8840

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

• https://github.com/jas502n/jackson-CVE-2020-8840

• https://github.com/fairyming/CVE-2020-8840

• https://github.com/Wfzsec/FastJson1.2.62-RCE

• https://github.com/Veraxy00/CVE-2020-8840

• https://github.com/Blyth0He/CVE-2020-8840

• https://github.com/dpredrag/CVE-2020-8840

CVE-2020-8835

In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)

• https://github.com/snappyJack/Rick_write_exp_CVE-2020-8835

• https://github.com/digamma-ai/CVE-2020-8835-verification

• https://github.com/KashaMalaga/cve2020-8835

• https://github.com/zilong3033/CVE-2020-8835

• https://github.com/SplendidSky/CVE-2020-8835

• https://github.com/Prabhashaka/Exploitation-CVE-2020-8835

CVE-2020-8825

index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.

• https://github.com/hacky1997/CVE-2020-8825

CVE-2020-8816

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

• https://github.com/cybervaca/CVE-2020-8816

• https://github.com/AndreyRainchik/CVE-2020-8816

• https://github.com/team0se7en/CVE-2020-8816

• https://github.com/martinsohn/CVE-2020-8816

CVE-2020-8813

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

• https://github.com/mhaskar/CVE-2020-8813

• https://github.com/cocomelonc/vulnexipy

• https://github.com/p0dalirius/CVE-2020-8813-Cacti-RCE-in-graph_realtime

• https://github.com/hexcowboy/CVE-2020-8813

• https://github.com/0xm4ud/Cacti-CVE-2020-8813

CVE-2020-8811

ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures.

• https://github.com/team0se7en/CVE-2020-8816

CVE-2020-8810

An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for path traversal. This allows the attacker exploiting CVE-2020-8809 to send executable files and place them in an autorun directory, or to place DLLs inside the existing GXDLMS Director installation (run on next execution of GXDLMS Director). This can be used to achieve code execution even if the user doesn't have any add-ins installed.

• https://github.com/seqred-s-a/gxdlmsdirector-cve

CVE-2020-8809

Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those), this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters), this can lead to code execution when combined with CVE-2020-8810.

• https://github.com/seqred-s-a/gxdlmsdirector-cve

CVE-2020-8793

OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.

• https://github.com/optionalg/OpenSMTPD

• https://github.com/FssAy/OpenSMTPD-RS

CVE-2020-8644

PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

• https://github.com/H3rm1tR3b0rn/CVE-2020-8644-PlaySMS-1.4

CVE-2020-8637

A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter.

• https://github.com/DXY0411/CVE-2020-8637

CVE-2020-8635

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files.

• https://github.com/Al1ex/CVE-2020-8635

CVE-2020-8617

Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.

• https://github.com/knqyf263/CVE-2020-8617

• https://github.com/gothburz/cve-2020-8617

CVE-2020-8597

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

• https://github.com/WinMin/CVE-2020-8597

• https://github.com/lakwsh/CVE-2020-8597

• https://github.com/dointisme/CVE-2020-8597

• https://github.com/Dilan-Diaz/Point-to-Point-Protocol-Daemon-RCE-Vulnerability-CVE-2020-8597-

CVE-2020-8559

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

• https://github.com/tdwyer/CVE-2020-8559

• https://github.com/tabbysable/POC-2020-8559

CVE-2020-8558

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.

• https://github.com/tabbysable/POC-2020-8558

• https://github.com/rhysemmas/martian-packets

CVE-2020-8554

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

• https://github.com/rancher/externalip-webhook

• https://github.com/jrmurray000/CVE-2020-8554

• https://github.com/twistlock/k8s-cve-2020-8554-mitigations

• https://github.com/Dviejopomata/CVE-2020-8554

• https://github.com/alebedev87/gatekeeper-cve-2020-8554

CVE-2020-8515

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.

• https://github.com/imjdl/CVE-2020-8515-PoC

• https://github.com/darrenmartyn/CVE-2020-8515

• https://github.com/truerandom/nmap_draytek_rce

CVE-2020-8437

The bencoding parser in BitTorrent uTorrent through 3.5.5 (build 45505) misparses nested bencoded dictionaries, which allows a remote attacker to cause a denial of service.

• https://github.com/mavlevin/uTorrent-CVE-2020-8437

CVE-2020-8423

A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network.

• https://github.com/lnversed/CVE-2020-8423

CVE-2020-8417

The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.

• https://github.com/vulncrate/wp-codesnippets-cve-2020-8417

• https://github.com/waleweewe12/CVE-2020-8417

• https://github.com/Vulnmachines/WordPress_CVE-2020-8417

• https://github.com/Rapidsafeguard/codesnippets_CVE-2020-8417

CVE-2020-8321

A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code execution.

• https://github.com/SatheeshGitHub575/external_curl_CVE-2020-8321

CVE-2020-8300

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.

• https://github.com/stuartcarroll/CitrixADC-CVE-2020-8300

CVE-2020-8290

Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in bztransmit helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.

• https://github.com/geffner/CVE-2020-8290

CVE-2020-8289

Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in bztransmit helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.

• https://github.com/geffner/CVE-2020-8289

CVE-2020-8287

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

• https://github.com/progfay/nodejs-http-transfer-encoding-smuggling-poc

CVE-2020-8277

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

• https://github.com/masahiro331/CVE-2020-8277

• https://github.com/AndrewIjano/CVE-2020-8277

CVE-2020-8254

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server. This vulnerability only affects Windows PDC.To improve the security of connections between Pulse clients and Pulse Connect Secure, see below recommendation(s):Disable Dynamic certificate trust for PDC.

• https://github.com/mbadanoiu/CVE-2020-8254

CVE-2020-8250

A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.

• https://github.com/mbadanoiu/CVE-2020-8250

CVE-2020-8249

A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer overflow.

• https://github.com/mbadanoiu/CVE-2020-8249

CVE-2020-8248

A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.

• https://github.com/mbadanoiu/CVE-2020-8248

CVE-2020-8244

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

• https://github.com/ossf-cve-benchmark/CVE-2020-8244

CVE-2020-8241

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a MITM Attack if end users are convinced to connect to a malicious server.

• https://github.com/withdk/pulse-secure-vpn-mitm-research

CVE-2020-8239

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry privilege escalation attack. This fix also requires Server Side Upgrade due to Standalone Host Checker Client (Windows) and Windows PDC.

• https://github.com/withdk/pulse-secure-vpn-mitm-research

CVE-2020-8218

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

• https://github.com/withdk/pulse-gosecure-rce-poc

CVE-2020-8209

Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6 and Citrix XenMobile Server before 10.9 RP5 and leads to the ability to read arbitrary files.

• https://github.com/B1anda0/CVE-2020-8209

CVE-2020-8205

The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

• https://github.com/ossf-cve-benchmark/CVE-2020-8205

CVE-2020-8203

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

• https://github.com/ossf-cve-benchmark/CVE-2020-8203

CVE-2020-8196

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

• https://github.com/Zeop-CyberSec/citrix_adc_netscaler_lfi

CVE-2020-8195

Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

• https://github.com/Zeop-CyberSec/citrix_adc_netscaler_lfi

CVE-2020-8193

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.

• https://github.com/jas502n/CVE-2020-8193

• https://github.com/Airboi/Citrix-ADC-RCE-CVE-2020-8193

• https://github.com/PR3R00T/CVE-2020-8193-Citrix-Scanner

• https://github.com/Zeop-CyberSec/citrix_adc_netscaler_lfi

• https://github.com/ctlyz123/CVE-2020-8193

CVE-2020-8192

A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.

• https://github.com/ossf-cve-benchmark/CVE-2020-8192

CVE-2020-8175

Uncontrolled resource consumption in jpeg-js before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.

• https://github.com/knokbak/get-pixels-updated

• https://github.com/knokbak/save-pixels-updated

CVE-2020-8165

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

• https://github.com/masahiro331/CVE-2020-8165

• https://github.com/hybryx/CVE-2020-8165

• https://github.com/danielklim/cve-2020-8165-demo

• https://github.com/umiterkol/CVE-2020-8165--Auto-Shell

• https://github.com/progfay/CVE-2020-8165

• https://github.com/AssassinUKG/CVE-2020-8165

• https://github.com/taipansec/CVE-2020-8165

CVE-2020-8163

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.

• https://github.com/lucasallan/CVE-2020-8163

• https://github.com/h4ms1k/CVE-2020-8163

• https://github.com/RedPhantomRoot/CVE-2020-8163

CVE-2020-8149

Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.

• https://github.com/ossf-cve-benchmark/CVE-2020-8149

CVE-2020-8135

The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external network or otherwise interact with internal systems.

• https://github.com/ossf-cve-benchmark/CVE-2020-8135

CVE-2020-8116

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

• https://github.com/ossf-cve-benchmark/CVE-2020-8116

CVE-2020-8103

A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects Bitdefender Antivirus Free versions prior to 1.0.17.178.

• https://github.com/RedyOpsResearchLabs/-CVE-2020-8103-Bitdefender-Antivirus-Free-EoP

CVE-2020-8012

CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.

• https://github.com/wetw0rk/Exploit-Development

CVE-2020-8004

STMicroelectronics STM32F1 devices have Incorrect Access Control.

• https://github.com/wuxx/CVE-2020-8004

CVE-2020-7980

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.

• https://github.com/Xh4H/Satellian-CVE-2020-7980

CVE-2020-7961

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

• https://github.com/mzer0one/CVE-2020-7961-POC

• https://github.com/random-robbie/liferay-pwn

• https://github.com/ShutdownRepo/CVE-2020-7961

• https://github.com/thelostworldFree/CVE-2020-7961-payloads

• https://github.com/shacojx/POC-CVE-2020-7961-Token-iterate

• https://github.com/shacojx/LifeRCEJsonWSTool-POC-CVE-2020-7961-Gui

• https://github.com/shacojx/GLiferay-CVE-2020-7961-golang

• https://github.com/wcxxxxx/CVE-2020-7961

• https://github.com/CrackerCat/CVE-2020-7961-Mass

• https://github.com/manrop2702/CVE-2020-7961

• https://github.com/pashayogi/CVE-2020-7961-Mass

• https://github.com/NMinhTrung/LIFERAY-CVE-2020-7961

CVE-2020-7934

In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.

• https://github.com/3ndG4me/liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934

• https://github.com/Sergio235705/audit-xss-cve-2020-7934

CVE-2020-7931

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template.

• https://github.com/gquere/CVE-2020-7931

CVE-2020-7897

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/mooneee/cve-2020-7897

CVE-2020-7799

An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> Themes), can execute commands on the underlying operating system by abusing freemarker.template.utility.Execute in the Apache FreeMarker engine that processes custom templates.

• https://github.com/ianxtianxt/CVE-2020-7799

• https://github.com/Pikaqi/cve-2020-7799

CVE-2020-7763

This affects the package phantom-html-to-pdf before 0.6.1.

• https://github.com/ossf-cve-benchmark/CVE-2020-7763

CVE-2020-7752

This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.

• https://github.com/ossf-cve-benchmark/CVE-2020-7752

CVE-2020-7750

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

• https://github.com/ossf-cve-benchmark/CVE-2020-7750

CVE-2020-7740

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.

• https://github.com/CS4239-U6/node-pdf-generator-ssrf

CVE-2020-7720

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

• https://github.com/ossf-cve-benchmark/CVE-2020-7720

CVE-2020-7699

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.

• https://github.com/ossf-cve-benchmark/CVE-2020-7699

• https://github.com/hemaoqi-Tom/CVE-2020-7699_reproduce

CVE-2020-7693

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.

• https://github.com/andsnw/sockjs-dos-py

CVE-2020-7676

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.

• https://github.com/ossf-cve-benchmark/CVE-2020-7676

CVE-2020-7662

websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

• https://github.com/ossf-cve-benchmark/CVE-2020-7662

CVE-2020-7661

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.

• https://github.com/spamscanner/url-regex-safe

CVE-2020-7660

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

• https://github.com/ossf-cve-benchmark/CVE-2020-7660

CVE-2020-7656

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

• https://github.com/ossf-cve-benchmark/CVE-2020-7656

CVE-2020-7638

confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload.

• https://github.com/ossf-cve-benchmark/CVE-2020-7638

CVE-2020-7473

In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020, allow unauthenticated attackers to access the documents and folders of ShareFile users. NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-8982 and CVE-2020-8983 but has essentially the same risk.

• https://github.com/DimitriNL/CTX-CVE-2020-7473

CVE-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

• https://github.com/Saferman/CVE-2020-7471

• https://github.com/HxDDD/CVE-PoC

• https://github.com/SNCKER/CVE-2020-7471

• https://github.com/secoba/DjVul_StringAgg

• https://github.com/huzaifakhan771/CVE-2020-7471-Django

• https://github.com/victomteng1997/cve-2020-7471-Time_Blind_SQLi-

• https://github.com/mrlihd/CVE-2020-7471

• https://github.com/Tempuss/CTF_CVE-2020-7471

CVE-2020-7461

In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, dhclient(8) fails to handle certain malformed input related to handling of DHCP option 119 resulting a heap overflow. The heap overflow could in principle be exploited to achieve remote code execution. The affected process runs with reduced privileges in a Capsicum sandbox, limiting the immediate impact of an exploit.

• https://github.com/knqyf263/CVE-2020-7461

• https://github.com/0xkol/freebsd-dhclient-poc

CVE-2020-7388

Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, that information can be learned by exploiting CVE-2020-7387. This issue was fixed in AdxAdmin 93.2.53, which ships with updates for on-premises versions of Sage X3 including Version 9 (components shipped with Syracuse 9.22.7.2 and later), Sage X3 HR & Payroll Version 9 (those components that ship with Syracuse 9.24.1.3), Version 11 (components shipped with Syracuse 11.25.2.6 and later), and Version 12 (components shipped with Syracuse 12.10.2.8 and later) of Sage X3. Other on-premises versions of Sage X3 are unsupported by the vendor.

• https://github.com/ac3lives/sagex3-cve-2020-7388-poc

CVE-2020-7384

Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.

• https://github.com/cocomelonc/vulnexipy

• https://github.com/nikhil1232/CVE-2020-7384

• https://github.com/0xCarsonS/CVE-2020-7384

CVE-2020-7378

CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen value. This issue was resolved in version 5.0-20200904, released September 4, 2020.

• https://github.com/ruthvikvegunta/openCRX-CVE-2020-7378

CVE-2020-7352

The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, static RSA private key, an attacker with this key material and local user permissions can effectively send any operating system command to the service for execution in this elevated context. The service listens for such commands on a locally-bound network port, localhost:9978. A Metasploit module has been published which exploits this vulnerability. This issue affects the 2.0.x branch of the software (2.0.12 and earlier) as well as the 1.2.x branch (1.2.64 and earlier). A fix was issued for the 2.0.x branch of the affected software.

• https://github.com/szerszen199/PS-CVE-2020-7352

CVE-2020-7283

Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to create and edit files via symbolic link manipulation in a location they would otherwise not have access to. This is achieved through running a malicious script or program on the target machine.

• https://github.com/RedyOpsResearchLabs/CVE-2020-7283-McAfee-Total-Protection-MTP-16.0.R26-EoP

CVE-2020-7274

Privilege escalation vulnerability in McTray.exe in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe elevated privileges (by default it runs with the current user's privileges).

• https://github.com/Caj6r/SNP_report_assignement_IT19009278

CVE-2020-7257

Privilege escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to cause the deletion and creation of files they would not normally have permission to through altering the target of symbolic links whilst an anti-virus scan was in progress. This is timing dependent.

• https://github.com/shubham0d/Antivirus-Symlink-Exploit

CVE-2020-7247

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

• https://github.com/FiroSolutions/cve-2020-7247-exploit

• https://github.com/QTranspose/CVE-2020-7247-exploit

• https://github.com/superzerosec/cve-2020-7247

• https://github.com/r0lh/CVE-2020-7247

• https://github.com/f4T1H21/CVE-2020-7247

• https://github.com/presentdaypresenttime/shai_hulud

• https://github.com/SimonSchoeni/CVE-2020-7247-POC

• https://github.com/bytescrappers/CVE-2020-7247

• https://github.com/aurelien-vilminot/ENSIMAG_EXPLOIT_CVE1_3A

CVE-2020-7246

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.

• https://github.com/pswalia2u/CVE-2020-7246

• https://github.com/j0hn30n/CVE-2020-7246

• https://github.com/arafatansari/SecAssignment

CVE-2020-7238

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

• https://github.com/jdordonezn/CVE-2020-72381

CVE-2020-7200

A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. The vulnerability could be exploited to allow remote code execution.

• https://github.com/alexfrancow/CVE-2020-7200

CVE-2020-7115

The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then execute an exploit that would allow to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.

• https://github.com/Retr02332/CVE-2020-7115

CVE-2020-7048

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state (deleting all site content stored in that table), as demonstrated by a wp-admin/admin-post.php?db-reset-tables[]=comments URI.

• https://github.com/ElmouradiAmine/CVE-2020-7048

CVE-2020-6888

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none.

• https://github.com/section-c/CVE-2020-6888

CVE-2020-6861

A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key by sending crafted messages to this app selected on a PIN-entered Ledger connected to a host PC.

• https://github.com/ph4r05/ledger-app-monero-1.42-vuln

CVE-2020-6836

grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may allow attackers to run arbitrary commands on the server.

• https://github.com/ossf-cve-benchmark/CVE-2020-6836

CVE-2020-6650

UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates available. This results in arbitrary code execution on the machine where software is installed.

• https://github.com/RavSS/Eaton-UPS-Companion-Exploit

CVE-2020-6519

Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.

• https://github.com/PerimeterX/CVE-2020-6519

CVE-2020-6516

Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

• https://github.com/CENSUS/whatsapp-mitd-mitm

CVE-2020-6514

Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream.

• https://github.com/hasan-khalil/CVE-2020-6514

CVE-2020-6507

Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• https://github.com/maldev866/ChExp_CVE_2020_6507

CVE-2020-6468

Type confusion in V8 in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• https://github.com/Goyotan/CVE-2020-6468-PoC

• https://github.com/kiks7/CVE-2020-6468-Chrome-Exploit

CVE-2020-6418

Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• https://github.com/ChoKyuWon/CVE-2020-6418

• https://github.com/Goyotan/CVE-2020-6418-PoC

• https://github.com/ulexec/ChromeSHELFLoader

• https://github.com/SivaPriyaRanganatha/CVE-2020-6418

CVE-2020-6364

SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that OS commands can be executed and potentially gain control over the host running the CA Introscope Enterprise Manager,leading to Code Injection. With this, the attacker is able to read and modify all system files and also impact system availability.

• https://github.com/gquere/CVE-2020-6364

CVE-2020-6308

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.

• https://github.com/InitRoot/CVE-2020-6308-PoC

• https://github.com/TheMMMdev/CVE-2020-6308

• https://github.com/freeFV/CVE-2020-6308-mass-exploiter

• https://github.com/MachadoOtto/sap_bo_launchpad-ssrf-timing_attack

CVE-2020-6287

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

• https://github.com/chipik/SAP_RECON

• https://github.com/duc-nt/CVE-2020-6287-exploit

• https://github.com/Onapsis/CVE-2020-6287_RECON-scanner

• https://github.com/murataydemir/CVE-2020-6287

• https://github.com/dylvie/CVE-2020-6287_SAP-NetWeaver-bypass-auth

• https://github.com/ynsmroztas/CVE-2020-6287-Sap-Add-User

• https://github.com/qmakake/SAP_CVE-2020-6287_find_mandate

CVE-2020-6286

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.

• https://github.com/chipik/SAP_RECON

• https://github.com/duc-nt/CVE-2020-6287-exploit

• https://github.com/murataydemir/CVE-2020-6286

CVE-2020-6207

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.

• https://github.com/chipik/SAP_EEM_CVE-2020-6207

CVE-2020-6096

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

• https://github.com/KashaMalaga/cve2020-6096

CVE-2020-5903

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.

• https://github.com/ltvthang/CVE-2020-5903

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

• https://github.com/zhzyker/exphub

• https://github.com/jas502n/CVE-2020-5902

• https://github.com/yassineaboukir/CVE-2020-5902

• https://github.com/theLSA/f5-bigip-rce-cve-2020-5902

• https://github.com/aqhmal/CVE-2020-5902-Scanner

• https://github.com/yasserjanah/CVE-2020-5902

• https://github.com/dunderhay/CVE-2020-5902

• https://github.com/f5devcentral/cve-2020-5902-ioc-bigip-checker

• https://github.com/zhzyker/CVE-2020-5902

• https://github.com/PushpenderIndia/CVE-2020-5902-Scanner

• https://github.com/ar0dd/CVE-2020-5902

• https://github.com/west9b/F5-BIG-IP-POC

• https://github.com/lijiaxing1997/CVE-2020-5902-POC-EXP

• https://github.com/Al1ex/CVE-2020-5902

• https://github.com/dwisiswant0/CVE-2020-5902

• https://github.com/nsflabs/CVE-2020-5902

• https://github.com/sv3nbeast/CVE-2020-5902_RCE

• https://github.com/rwincey/CVE-2020-5902-NSE

• https://github.com/rockmelodies/CVE-2020-5902-rce-gui

• https://github.com/GovindPalakkal/EvilRip

• https://github.com/jiansiting/CVE-2020-5902

• https://github.com/MrCl0wnLab/checker-CVE-2020-5902

• https://github.com/d4rk007/F5-Big-IP-CVE-2020-5902-mass-exploiter

• https://github.com/corelight/CVE-2020-5902-F5BigIP

• https://github.com/r0ttenbeef/cve-2020-5902

• https://github.com/34zY/APT-Backpack

• https://github.com/deepsecurity-pe/GoF5-CVE-2020-5902

• https://github.com/cybersecurityworks553/scanner-CVE-2020-5902

• https://github.com/murataydemir/CVE-2020-5902

• https://github.com/z3n70/CVE-2020-5902

• https://github.com/faisalfs10x/F5-BIG-IP-CVE-2020-5902-shodan-scanner

• https://github.com/haisenberg/CVE-2020-5902

• https://github.com/jinnywc/CVE-2020-5902

• https://github.com/0xAbdullah/CVE-2020-5902

• https://github.com/amitlttwo/CVE-2020-5902

• https://github.com/un4gi/CVE-2020-5902

• https://github.com/JSec1337/RCE-CVE-2020-5902

• https://github.com/qlkwej/poc-CVE-2020-5902

• https://github.com/Shu1L/CVE-2020-5902-fofa-scan

• https://github.com/halencarjunior/f5scan

• https://github.com/Zinkuth/F5-BIG-IP-CVE-2020-5902

• https://github.com/renanhsilva/checkvulnCVE20205902

• https://github.com/ltvthang/CVE-2020-5903

• https://github.com/wdlid/CVE-2020-5902-fix

• https://github.com/momika233/cve-2020-5902

• https://github.com/k3nundrum/CVE-2020-5902

• https://github.com/superzerosec/cve-2020-5902

• https://github.com/dnerzker/CVE-2020-5902

• https://github.com/flyopenair/CVE-2020-5902

• https://github.com/ajdumanhug/CVE-2020-5902

• https://github.com/GoodiesHQ/F5-Patch

• https://github.com/qiong-qi/CVE-2020-5902-POC

• https://github.com/TheCyberViking/CVE-2020-5902-Vuln-Checker

• https://github.com/freeFV/CVE-2020-5902-fofa-scan

• https://github.com/Any3ite/CVE-2020-5902-F5BIG

• https://github.com/inho28/CVE-2020-5902-F5-BIGIP

• https://github.com/cristiano-corrado/f5_scanner

• https://github.com/ludy-dev/BIG-IP-F5-TMUI-RCE-Vulnerability

CVE-2020-5844

index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020.

• https://github.com/UNICORDev/exploit-CVE-2020-5844

• https://github.com/TheCyberGeek/CVE-2020-5844

CVE-2020-5842

Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed on the admin/index.php?page=users/manage page.

• https://github.com/prasanthc41m/codoforum

CVE-2020-5839

Symantec Endpoint Detection And Response, prior to 4.4, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data.

• https://github.com/nasbench/CVE-2020-5839

CVE-2020-5837

Symantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log files that are replaced by symbolic links, which can lead to a potential elevation of privilege.

• https://github.com/RedyOpsResearchLabs/SEP-14.2-Arbitrary-Write

CVE-2020-5752

Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.

• https://github.com/yevh/CVE-2020-5752-Druva-inSync-Windows-Client-6.6.3---Local-Privilege-Escalation-PowerShell-

CVE-2020-5504

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.

• https://github.com/xMohamed0/CVE-2020-5504-phpMyAdmin

CVE-2020-5421

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

• https://github.com/pandaMingx/CVE-2020-5421

CVE-2020-5410

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

• https://github.com/sule01u/SBSCAN

• https://github.com/DSO-Lab/defvul

• https://github.com/osamahamad/CVE-2020-5410-POC

• https://github.com/dead5nd/config-demo

• https://github.com/Corgizz/SpringCloud

CVE-2020-5405

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

• https://github.com/DSO-Lab/defvul

CVE-2020-5398

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

• https://github.com/motikan2010/CVE-2020-5398

CVE-2020-5377

Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker could potentially exploit these vulnerabilities by sending a crafted Web API request containing directory traversal character sequences to gain file system access on the compromised management station.

• https://github.com/und3sc0n0c1d0/AFR-in-OMSA

• https://github.com/n3rdh4x0r/CVE-2020-5377

CVE-2020-5272

In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is a reflected XSS on Search page with alias and search parameters. The problem is patched in 1.7.6.5

• https://github.com/Al1ex/WindowsElevation

CVE-2020-5267

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j or escape_javascript methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.

• https://github.com/GUI/legacy-rails-CVE-2020-5267-patch

CVE-2020-5260

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.

• https://github.com/brompwnie/cve-2020-5260

• https://github.com/sv3nbeast/CVE-2020-5260

• https://github.com/Asgavar/CVE-2020-5260

CVE-2020-5258

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

• https://github.com/ossf-cve-benchmark/CVE-2020-5258

CVE-2020-5254

In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited. NetHack 3.6.6 resolves this issue.

• https://github.com/dpmdpm2/CVE-2020-5254

CVE-2020-5251

In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way.

• https://github.com/ossf-cve-benchmark/CVE-2020-5251

CVE-2020-5250

In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.

• https://github.com/drkbcn/lblfixer_cve2020_5250

CVE-2020-5248

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work.

• https://github.com/indevi0us/CVE-2020-5248

• https://github.com/Mkway/CVE-2020-5248

CVE-2020-5245

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.

• https://github.com/LycsHub/CVE-2020-5245

CVE-2020-5236

Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.

• https://github.com/motikan2010/CVE-2020-5236

CVE-2020-5014

IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side requesr forgery attack. IBM X-Force ID: 193247.

• https://github.com/copethomas/datapower-redis-rce-exploit

CVE-2020-4464

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. IBM X-Force ID: 181489.

• https://github.com/silentsignal/WebSphere-WSIF-gadget

• https://github.com/yonggui-li/CVE-2020-4464-and-CVE-2020-4450

CVE-2020-4463

IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484.

• https://github.com/Ibonok/CVE-2020-4463

CVE-2020-4450

IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181231.

• https://github.com/silentsignal/WebSphere-WSIF-gadget

• https://github.com/yonggui-li/CVE-2020-4464-and-CVE-2020-4450

CVE-2020-4276

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. X-Force ID: 175984.

• https://github.com/mekoko/CVE-2020-4276

CVE-2020-4066

In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This has been patched in 0.95.

• https://github.com/ossf-cve-benchmark/CVE-2020-4066

CVE-2020-4059

In mversion before 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This vulnerability is patched by version 2.0.0. Previous releases are deprecated in npm. As a workaround, make sure to escape git commit messages when using the commitMessage option for the update function.

• https://github.com/ossf-cve-benchmark/CVE-2020-4059

CVE-2020-4051

In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.

• https://github.com/ossf-cve-benchmark/CVE-2020-4051

CVE-2020-4040

Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview. This has been fixed in Bolt 3.7.1

• https://github.com/jpvispo/RCE-Exploit-Bolt-3.7.0-CVE-2020-4040-4041

CVE-2020-3992

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

• https://github.com/dgh05t/VMware_ESXI_OpenSLP_PoCs

• https://github.com/HynekPetrak/CVE-2019-5544_CVE-2020-3992

• https://github.com/ceciliaaii/CVE_2020_3992

CVE-2020-3956

VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.

• https://github.com/aaronsvk/CVE-2020-3956

CVE-2020-3952

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.

• https://github.com/guardicore/vmware_vcenter_cve_2020_3952

• https://github.com/bb33bb/CVE-2020-3952

• https://github.com/chronoloper/CVE-2020-3952

• https://github.com/Fa1c0n35/vmware_vcenter_cve_2020_3952

• https://github.com/gelim/CVE-2020-3952

• https://github.com/Fa1c0n35/https-github.com-guardicore-vmware_vcenter_cve_2020_3952

CVE-2020-3766

Adobe Genuine Integrity Service versions Version 6.4 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.

• https://github.com/hessandrew/CVE-2020-3766_APSB20-12

CVE-2020-3580

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.

• https://github.com/adarshvs/CVE-2020-3580

• https://github.com/Hudi233/CVE-2020-3580

• https://github.com/catatonicprime/CVE-2020-3580

• https://github.com/cruxN3T/CVE-2020-3580

CVE-2020-3452

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files.

• https://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter

• https://github.com/cygenta/CVE-2020-3452

• https://github.com/3ndG4me/CVE-2020-3452-Exploit

• https://github.com/PR3R00T/CVE-2020-3452-Cisco-Scanner

• https://github.com/0x5ECF4ULT/CVE-2020-3452

• https://github.com/MrCl0wnLab/checker-cve2020-3452

• https://github.com/murataydemir/CVE-2020-3452

• https://github.com/fuzzlove/Cisco-ASA-FTD-Web-Services-Traversal

• https://github.com/grim3/CVE-2020-3452

• https://github.com/foulenzer/CVE-2020-3452

• https://github.com/Loneyers/cve-2020-3452

• https://github.com/XDev05/CVE-2020-3452-PoC

• https://github.com/faisalfs10x/Cisco-CVE-2020-3452-shodan-scanner

• https://github.com/Aviksaikat/CVE-2020-3452

• https://github.com/paran0id34/CVE-2020-3452

• https://github.com/ludy-dev/Cisco-ASA-LFI

• https://github.com/Gh0st0ne/http-vuln-cve2020-3452.nse

• https://github.com/mr-r3b00t/CVE-2020-3452

• https://github.com/sujaygr8/CVE-2020-3452

• https://github.com/Cappricio-Securities/CVE-2020-3452

• https://github.com/iveresk/cve-2020-3452

• https://github.com/toy0756428/CVE_2020_3452_Detect

• https://github.com/Veids/CVE-2020-3452_auto

CVE-2020-3435

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process on an affected device. A successful exploit could allow the attacker to modify VPN profile files. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.

• https://github.com/goichot/CVE-2020-3433

CVE-2020-3434

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process on an affected device. A successful exploit could allow the attacker to stop the AnyConnect process, causing a DoS condition on the device. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.

• https://github.com/goichot/CVE-2020-3433

CVE-2020-3433

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.

• https://github.com/goichot/CVE-2020-3433

CVE-2020-3187

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences. An exploit could allow the attacker to view or delete arbitrary files on the targeted system. When the device is reloaded after exploitation of this vulnerability, any files that were deleted are restored. The attacker can only view and delete files within the web services file system. This file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability can not be used to obtain access to ASA or FTD system files or underlying operating system (OS) files. Reloading the affected device will restore all files within the web services file system.

• https://github.com/alexhyd22/CISCO-SSL-VPN

• https://github.com/CrackerCat/CVE-2020-3187

• https://github.com/1337in/CVE-2020-3187

• https://github.com/sujaygr8/CVE-2020-3187

• https://github.com/Cappricio-Securities/CVE-2020-3187

• https://github.com/sunyyer/CVE-2020-3187-Scanlist

CVE-2020-3161

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.

• https://github.com/abood05972/CVE-2020-3161

CVE-2020-3153

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.

• https://github.com/goichot/CVE-2020-3153

• https://github.com/shubham0d/CVE-2020-3153

• https://github.com/raspberry-pie/CVE-2020-3153

CVE-2020-2978

Vulnerability in the Oracle Database - Enterprise Edition component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having DBA role account privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition. While the vulnerability is in Oracle Database - Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database - Enterprise Edition accessible data. CVSS 3.1 Base Score 4.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N).

• https://github.com/emad-almousa/CVE-2020-2978

CVE-2020-2969

Vulnerability in the Data Pump component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows high privileged attacker having DBA role account privilege with network access via Oracle Net to compromise Data Pump. Successful attacks of this vulnerability can result in takeover of Data Pump. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/emad-almousa/CVE-2020-2969

CVE-2020-2950

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/hktalent/CVE_2020_2546

• https://github.com/tuo4n8/CVE-2020-2950

CVE-2020-2915

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching, CacheStore, Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/hktalent/CVE_2020_2546

CVE-2020-2884

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/hktalent/CVE_2020_2546

CVE-2020-2883

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/zhzyker/exphub

• https://github.com/zhzyker/vulmap

• https://github.com/0xn0ne/weblogicScanner

• https://github.com/Y4er/WebLogic-Shiro-shell

• https://github.com/Y4er/CVE-2020-2883

• https://github.com/hktalent/CVE_2020_2546

• https://github.com/zzwlpx/weblogicPoc

• https://github.com/MagicZer0/Weblogic_CVE-2020-2883_POC

• https://github.com/Al1ex/CVE-2020-2883

• https://github.com/FancyDoesSecurity/CVE-2020-2883

• https://github.com/ZZZWD/CVE-2020-2883

• https://github.com/Qynklee/POC_CVE-2020-2883

CVE-2020-2801

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. Note: The patch for this issue will address the vulnerability only if the WLS instance is using JDK 1.7.0_191 or later, or JDK 1.8.0_181 or later. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/hktalent/CVE_2020_2546

CVE-2020-2798

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/hktalent/CVE_2020_2546

CVE-2020-2733

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/anmolksachan/CVE-2020-2733

CVE-2020-2655

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

• https://github.com/RUB-NDS/CVE-2020-2655-DemoServer

CVE-2020-2555

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/zhzyker/exphub

• https://github.com/zhzyker/vulmap

• https://github.com/0xn0ne/weblogicScanner

• https://github.com/Y4er/CVE-2020-2555

• https://github.com/zzwlpx/weblogicPoc

• https://github.com/feihong-cs/Attacking_Shiro_with_CVE_2020_2555

• https://github.com/wsfengfan/CVE-2020-2555

• https://github.com/Maskhe/cve-2020-2555

• https://github.com/adm1in/CodeTest

• https://github.com/Hu3sky/CVE-2020-2555

• https://github.com/Qynklee/POC_CVE-2020-2555

• https://github.com/Uvemode/CVE-2020-2555

CVE-2020-2551

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/zhzyker/exphub

• https://github.com/0xn0ne/weblogicScanner

• https://github.com/Y4er/CVE-2020-2551

• https://github.com/hktalent/CVE-2020-2551

• https://github.com/zzwlpx/weblogicPoc

• https://github.com/DSO-Lab/defvul

• https://github.com/jas502n/CVE-2020-2551

• https://github.com/Dido1960/Weblogic-CVE-2020-2551-To-Internet

• https://github.com/0xAbbarhSF/CVE-Exploit

• https://github.com/LTiDi2000/CVE-2020-2551

• https://github.com/DaMinGshidashi/CVE-2020-2551

CVE-2020-2546

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Application Container - JavaEE). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• https://github.com/hktalent/CVE_2020_2546

CVE-2020-2509

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later

• https://github.com/jbaines-r7/overkill

CVE-2020-2501

A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)

• https://github.com/Alonzozzz/alonzzzo

CVE-2020-2333

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/section-c/CVE-2020-2333

CVE-2020-2038

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.

• https://github.com/und3sc0n0c1d0/CVE-2020-2038

CVE-2020-2034

An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN-OS 8.0 and PAN-OS 7.1. Prisma Access services are not impacted by this vulnerability.

• https://github.com/blackhatethicalhacking/CVE-2020-2034-POC

CVE-2020-2023

Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.

• https://github.com/ssst0n3/kata-cve-2020-2023-poc

CVE-2020-2021

When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability.

• https://github.com/mr-r3b00t/CVE-2020-2021

CVE-2020-1971

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).

• https://github.com/MBHudson/CVE-2020-1971

• https://github.com/Metztli/debian-openssl-1.1.1i

CVE-2020-1967

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

• https://github.com/irsl/CVE-2020-1967

CVE-2020-1958

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.

• https://github.com/ggolawski/CVE-2020-1958

CVE-2020-1956

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

• https://github.com/b510/CVE-2020-1956

CVE-2020-1948

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.

• https://github.com/DSO-Lab/defvul

• https://github.com/ctlyz123/CVE-2020-1948

• https://github.com/L0kiii/Dubbo-deserialization

• https://github.com/txrw/Dubbo-CVE-2020-1948

• https://github.com/M3g4Byt3/cve-2020-1948-poc

CVE-2020-1947

In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security flaws of RCE.

• https://github.com/jas502n/CVE-2020-1947

• https://github.com/wsfengfan/CVE-2020-1947

• https://github.com/StarkChristmas/CVE-2020-1947

• https://github.com/shadowsock5/ShardingSphere_CVE-2020-1947

CVE-2020-1938

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

• https://github.com/zhzyker/exphub

• https://github.com/LandGrey/ClassHound

• https://github.com/hypn0s/AJPy

• https://github.com/00theway/Ghostcat-CNVD-2020-10487

• https://github.com/bkfish/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner

• https://github.com/tpt11fb/AttackTomcat

• https://github.com/lizhianyuguangming/TomcatScanPro

• https://github.com/nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC

• https://github.com/sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read

• https://github.com/xindongzhuaizhuai/CVE-2020-1938

• https://github.com/laolisafe/CVE-2020-1938

• https://github.com/woaiqiukui/CVE-2020-1938TomcatAjpScanner

• https://github.com/fairyming/CVE-2020-1938

• https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat

• https://github.com/dacade/CVE-2020-1938

• https://github.com/doggycheng/CNVD-2020-10487

• https://github.com/fatal0/tomcat-cve-2020-1938-check

• https://github.com/w4fz5uck5/CVE-2020-1938-Clean-Version

• https://github.com/Just1ceP4rtn3r/CVE-2020-1938-Tool

• https://github.com/YounesTasra-R4z3rSw0rd/CVE-2020-1938

• https://github.com/delsadan/CNVD-2020-10487-Bulk-verification

• https://github.com/sgdream/CVE-2020-1938

• https://github.com/h7hac9/CVE-2020-1938

• https://github.com/Warelock/cve-2020-1938

• https://github.com/Neko-chanQwQ/CVE-2020-1938

• https://github.com/streghstreek/CVE-2020-1938

• https://github.com/einzbernnn/CVE-2020-1938Scan

• https://github.com/jptr218/ghostcat

• https://github.com/shaunmclernon/ghostcat-verification

• https://github.com/whatboxapp/GhostCat-LFI-exp

• https://github.com/Umesh2807/Ghostcat

• https://github.com/aib0litt/poc-CVE-2020-1938

• https://github.com/b1cat/CVE_2020_1938_ajp_poc

• https://github.com/haerin7427/CVE_2020_1938

• https://github.com/WHtig3r/CVE-2020-1938

• https://github.com/I-Runtime-Error/CVE-2020-1938

• https://github.com/acodervic/CVE-2020-1938-MSF-MODULE

• https://github.com/MateoSec/ghostcatch

CVE-2020-1937

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.

• https://github.com/shanika04/apache_kylin

CVE-2020-1764

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.

• https://github.com/jpts/cve-2020-1764-poc

CVE-2020-1611

A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. This issue affects: Juniper Networks Junos Space versions prior to 19.4R1.

• https://github.com/Ibonok/CVE-2020-1611

CVE-2020-1493

An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users. To exploit this vulnerability, an attacker would have to attach a file as a link to an email. The email could then be shared with individuals that should not have access to the files, ignoring the default organizational setting. The security update addresses the vulnerability by correcting how Outlook handles file attachment links.

• https://github.com/0neb1n/CVE-2020-1493

CVE-2020-1481

A remote code execution vulnerability exists in the ESLint extension for Visual Studio Code when it validates source code after opening a project, aka 'Visual Studio Code ESLint Extention Remote Code Execution Vulnerability'.

• https://github.com/Rival420/CVE-2020-14181

CVE-2020-1472

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

• https://github.com/SecuraBV/CVE-2020-1472

• https://github.com/dirkjanm/CVE-2020-1472

• https://github.com/risksense/zerologon

• https://github.com/VoidSec/CVE-2020-1472

• https://github.com/bb00/zer0dump

• https://github.com/mstxq17/cve-2020-1472

• https://github.com/Rvn0xsy/ZeroLogon

• https://github.com/k8gege/CVE-2020-1472-EXP

• https://github.com/zeronetworks/zerologon

• https://github.com/cube0x0/CVE-2020-1472

• https://github.com/Privia-Security/ADZero

• https://github.com/sho-luv/zerologon

• https://github.com/B34MR/zeroscan

• https://github.com/WiIs0n/Zerologon_CVE-2020-1472

• https://github.com/sv3nbeast/CVE-2020-1472

• https://github.com/thatonesecguy/zerologon-CVE-2020-1472

• https://github.com/YossiSassi/ZeroLogon-Exploitation-Check

• https://github.com/CPO-EH/CVE-2020-1472_ZeroLogonChecker

• https://github.com/striveben/CVE-2020-1472

• https://github.com/CanciuCostin/CVE-2020-1472

• https://github.com/0xcccc666/cve-2020-1472_Tool-collection

• https://github.com/0xkami/CVE-2020-1472

• https://github.com/NAXG/CVE-2020-1472

• https://github.com/shanfenglan/cve-2020-1472

• https://github.com/Akash7350/CVE-2020-1472

• https://github.com/rhymeswithmogul/Set-ZerologonMitigation

• https://github.com/whoami-chmod777/Zerologon-Attack-CVE-2020-1472-POC

• https://github.com/murataydemir/CVE-2020-1472

• https://github.com/Udyz/Zerologon

• https://github.com/jiushill/CVE-2020-1472

• https://github.com/Sajuwithgithub/CVE2020-1472

• https://github.com/npocmak/CVE-2020-1472

• https://github.com/b1ack0wl/CVE-2020-1472

• https://github.com/mingchen-script/CVE-2020-1472-visualizer

• https://github.com/RicYaben/CVE-2020-1472-LAB

• https://github.com/midpipps/CVE-2020-1472-Easy

• https://github.com/Fa1c0n35/SecuraBV-CVE-2020-1472

• https://github.com/McKinnonIT/zabbix-template-CVE-2020-1472

• https://github.com/guglia001/MassZeroLogon

• https://github.com/wrathfulDiety/zerologon

• https://github.com/hell-moon/ZeroLogon-Exploit

• https://github.com/Anonymous-Family/Zero-day-scanning

• https://github.com/carlos55ml/zerologon

• https://github.com/Whippet0/CVE-2020-1472

• https://github.com/Anonymous-Family/CVE-2020-1472

• https://github.com/grupooruss/CVE-2020-1472

• https://github.com/hectorgie/CVE-2020-1472

• https://github.com/itssmikefm/CVE-2020-1472

• https://github.com/Fa1c0n35/CVE-2020-1472

• https://github.com/victim10wq3/CVE-2020-1472

• https://github.com/puckiestyle/CVE-2020-1472

• https://github.com/Ken-Abruzzi/cve-2020-1472

• https://github.com/dr4g0n23/CVE-2020-1472

• https://github.com/t31m0/CVE-2020-1472

• https://github.com/mos165/CVE-20200-1472

• https://github.com/SaharAttackit/CVE-2020-1472

• https://github.com/Tobey123/CVE-2020-1472-visualizer

• https://github.com/JolynNgSC/Zerologon_CVE-2020-1472

• https://github.com/Fa1c0n35/CVE-2020-1472-02-

• https://github.com/TheJoyOfHacking/dirkjanm-CVE-2020-1472

• https://github.com/blackh00d/zerologon-poc

• https://github.com/johnpathe/zerologon-cve-2020-1472-notes

• https://github.com/TheJoyOfHacking/SecuraBV-CVE-2020-1472

• https://github.com/technion/ZeroLogonAssess

• https://github.com/logg-1/0logon

• https://github.com/likeww/MassZeroLogon

• https://github.com/maikelnight/zerologon

• https://github.com/JayP232/The_big_Zero

• https://github.com/c3rrberu5/ZeroLogon-to-Shell

CVE-2020-1362

An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletService Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1344, CVE-2020-1369.

• https://github.com/Al1ex/WindowsElevation

• https://github.com/Q4n/CVE-2020-1362

CVE-2020-1350

A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.

• https://github.com/ZephrFish/CVE-2020-1350_HoneyPoC

• https://github.com/maxpl0it/CVE-2020-1350-DoS

• https://github.com/psc4re/NSE-scripts

• https://github.com/tinkersec/cve-2020-1350

• https://github.com/captainGeech42/CVE-2020-1350

• https://github.com/T13nn3s/CVE-2020-1350

• https://github.com/connormcgarr/CVE-2020-1350

• https://github.com/corelight/SIGRed

• https://github.com/zoomerxsec/Fake_CVE-2020-1350

• https://github.com/mr-r3b00t/CVE-2020-1350

• https://github.com/Plazmaz/CVE-2020-1350-poc

• https://github.com/simeononsecurity/CVE-2020-1350-Fix

• https://github.com/graph-inc/CVE-2020-1350

• https://github.com/jmaddington/dRMM-CVE-2020-1350-response

• https://github.com/CVEmaster/CVE-2020-1350

• https://github.com/ejlevin99/CVE---2020---1350

• https://github.com/gdwnet/cve-2020-1350

CVE-2020-1349

A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka 'Microsoft Outlook Remote Code Execution Vulnerability'.

• https://github.com/0neb1n/CVE-2020-1349

CVE-2020-1337

An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.

• https://github.com/Al1ex/WindowsElevation

• https://github.com/sailay1996/cve-2020-1337-poc

• https://github.com/math1as/CVE-2020-1337-exploit

• https://github.com/neofito/CVE-2020-1337

• https://github.com/VoidSec/CVE-2020-1337

• https://github.com/ZTK-009/cve-2020-1337-poc

CVE-2020-1313

An elevation of privilege vulnerability exists when the Windows Update Orchestrator Service improperly handles file operations, aka 'Windows Update Orchestrator Service Elevation of Privilege Vulnerability'.

• https://github.com/irsl/CVE-2020-1313

CVE-2020-1301

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests, aka 'Windows SMB Remote Code Execution Vulnerability'.

• https://github.com/shubham0d/CVE-2020-1301

CVE-2020-1283

A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.

• https://github.com/RedyOpsResearchLabs/CVE-2020-1283_Windows-Denial-of-Service-Vulnerability

CVE-2020-1206

An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Information Disclosure Vulnerability'.

• https://github.com/jamf/CVE-2020-1206-POC

• https://github.com/jamf/SMBGhost-SMBleed-scanner

• https://github.com/datntsec/CVE-2020-1206

• https://github.com/Info-Security-Solution-Kolkata/CVE-2020-1206-Exploit

• https://github.com/Info-Security-Solution-Kolkata/Smbleed-CVE-2020-1206-Exploit

CVE-2020-1066

An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level.To exploit the vulnerability, an attacker would first have to access the local machine, and then run a malicious program.The update addresses the vulnerability by correcting how .NET Framework activates COM objects., aka '.NET Framework Elevation of Privilege Vulnerability'.

• https://github.com/Al1ex/WindowsElevation

• https://github.com/cbwang505/CVE-2020-1066-EXP

• https://github.com/xyddnljydd/cve-2020-1066

CVE-2020-1054

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1143.

• https://github.com/Al1ex/WindowsElevation

• https://github.com/0xeb-bp/cve-2020-1054

• https://github.com/KaLendsi/CVE-2020-1054

• https://github.com/Iamgublin/CVE-2020-1054

• https://github.com/Graham382/CVE-2020-1054

CVE-2020-1048

An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Print Spooler Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1070.

• https://github.com/neofito/CVE-2020-1337

• https://github.com/shubham0d/CVE-2020-1048

• https://github.com/VoidSec/CVE-2020-1337

• https://github.com/zveriu/CVE-2009-0229-PoC

• https://github.com/Ken-Abruzzi/CVE-2020-1048

• https://github.com/Y3A/cve-2020-1048

CVE-2020-1034

<p>An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.</p> <p>To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.</p> <p>The security update addresses the vulnerability by ensuring the Windows Kernel properly handles objects in memory.</p>

• https://github.com/yardenshafir/CVE-2020-1034

• https://github.com/GeorgiiFirsov/CVE-2020-1034

CVE-2020-1020

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0938.

• https://github.com/KaLendsi/CVE-2020-1020

• https://github.com/CrackerCat/CVE-2020-1020-Exploit

CVE-2020-1015

An elevation of privilege vulnerability exists in the way that the User-Mode Power Service (UMPS) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0934, CVE-2020-0983, CVE-2020-1009, CVE-2020-1011.

• https://github.com/0xeb-bp/cve-2020-1015

CVE-2020-0976

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0972, CVE-2020-0975, CVE-2020-0977.

• https://github.com/ericzhong2010/GUI-Check-CVE-2020-0976

CVE-2020-0910

A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'.

• https://github.com/kfmgang/CVE-2020-0910

CVE-2020-0890

<p>A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate specific malicious data from a user on a guest operating system.</p> <p>To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application.</p> <p>The security update addresses the vulnerability by resolving the conditions where Hyper-V would fail to handle these requests.</p>

• https://github.com/gerhart01/hyperv_local_dos_poc

• https://github.com/MarcelloTinocor/gerhart01

• https://github.com/skasanagottu57gmailv/gerhart01

CVE-2020-0887

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0788, CVE-2020-0877.

• https://github.com/vinhthp1712/CVE-2020-0887

CVE-2020-0883

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0881.

• https://github.com/syadg123/CVE-2020-0883

• https://github.com/thelostworldFree/CVE-2020-0883

CVE-2020-0796

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

• https://github.com/danigargu/CVE-2020-0796

• https://github.com/ly4k/SMBGhost

• https://github.com/Al1ex/WindowsElevation

• https://github.com/jamf/CVE-2020-0796-RCE-POC

• https://github.com/eerykitty/CVE-2020-0796-PoC

• https://github.com/Barriuso/SMBGhost_AutomateExploitation

• https://github.com/jamf/CVE-2020-0796-LPE-POC

• https://github.com/psc4re/NSE-scripts

• https://github.com/tg12/PoC_CVEs

• https://github.com/Rvn0xsy/CVE_2020_0796_CNA

• https://github.com/rsmudge/CVE-2020-0796-BOF

• https://github.com/jiansiting/CVE-2020-0796

• https://github.com/claroty/CVE2020-0796

• https://github.com/ioncodes/SMBGhost

• https://github.com/k8gege/PyLadon

• https://github.com/jamf/SMBGhost-SMBleed-scanner

• https://github.com/khulnasoft-lab/awesome-security

• https://github.com/eastmountyxz/CVE-2020-0796-SMB

• https://github.com/T13nn3s/CVE-2020-0796

• https://github.com/maxpl0it/Unauthenticated-CVE-2020-0796-PoC

• https://github.com/Almorabea/SMBGhost-LPE-Metasploit-Module

• https://github.com/0x25bit/CVE-2020-0796-PoC

• https://github.com/gabimarti/SMBScanner

• https://github.com/f1tz/CVE-2020-0796-LPE-EXP

• https://github.com/Aurum2008/CVE2020-0796

• https://github.com/GuoKerS/aioScan_CVE-2020-0796

• https://github.com/ButrintKomoni/cve-2020-0796

• https://github.com/dickens88/cve-2020-0796-scanner

• https://github.com/joaozietolie/CVE-2020-0796-Checker

• https://github.com/w1ld3r/SMBGhost_Scanner

• https://github.com/thelostworldFree/CVE-2020-0796

• https://github.com/jiansiting/CVE-2020-0796-Scanner

• https://github.com/technion/DisableSMBCompression

• https://github.com/0xeb-bp/cve-2020-0796

• https://github.com/Ajomix/CVE-2020-0796

• https://github.com/vysecurity/CVE-2020-0796

• https://github.com/tango-j/CVE-2020-0796

• https://github.com/wneessen/SMBCompScan

• https://github.com/orangmuda/CVE-2020-0796

• https://github.com/sujitawake/smbghost

• https://github.com/RonnieNiu/CVE-2020_0796-exp

• https://github.com/exp-sky/CVE-2020-0796

• https://github.com/TinToSer/cve2020-0796

• https://github.com/codewithpradhan/SMBGhost-CVE-2020-0796-

• https://github.com/TinToSer/CVE-2020-0796-LPE

• https://github.com/syadg123/CVE-2020-0796

• https://github.com/laolisafe/CVE-2020-0796

• https://github.com/MasterSploit/LPE---CVE-2020-0796

• https://github.com/Anonimo501/SMBGhost_CVE-2020-0796_checker

• https://github.com/testbugonly/Defence

• https://github.com/julixsalas/CVE-2020-0796

• https://github.com/LabDookhtegan/CVE-2020-0796-EXP

• https://github.com/ran-sama/CVE-2020-0796

• https://github.com/netscylla/SMBGhost

• https://github.com/cory-zajicek/CVE-2020-0796-DoS

• https://github.com/awareseven/eternalghosttest

• https://github.com/SEHandler/CVE-2020-0796

• https://github.com/datntsec/CVE-2020-0796

• https://github.com/arzuozkan/CVE-2020-0796

• https://github.com/OldDream666/cve-2020-0796

• https://github.com/1stPeak/CVE-2020-0796-Scanner

• https://github.com/F6JO/CVE-2020-0796-Batch-scanning

• https://github.com/AdamSonov/smbGhostCVE-2020-0796

• https://github.com/Dhoomralochana/Scanners-for-CVE-2020-0796-Testing

• https://github.com/BinaryShadow94/SMBv3.1.1-scan---CVE-2020-0796

• https://github.com/hillu/nmap-nse-smb2-enhancement

• https://github.com/Ken-Abruzzi/cve_2020_0796

• https://github.com/xax007/CVE-2020-0796-Scanner

• https://github.com/UraSecTeam/smbee

• https://github.com/kernelkill/cve2020-0796

• https://github.com/ysyyrps123/CVE-2020-0796

• https://github.com/bacth0san96/SMBGhostScanner

• https://github.com/ysyyrps123/CVE-2020-0796-exp

• https://github.com/AaronCaiii/CVE-2020-0796-POC

• https://github.com/abdullah098/CVE_2020_0796

• https://github.com/section-c/CVE-2020-0796

• https://github.com/TweatherQ/CVE-2020-0796

• https://github.com/kn6869610/CVE-2020-0796

• https://github.com/wsfengfan/CVE-2020-0796

• https://github.com/halsten/CVE-2020-0796

• https://github.com/Opensitoo/cve-2020-0796

• https://github.com/krizzz07/CVE-2020-0796

• https://github.com/hungdnvp/POC-CVE-2020-0796

• https://github.com/lisinan988/CVE-2020-0796-exp

• https://github.com/tripledd/cve-2020-0796-vuln

• https://github.com/intelliroot-tech/cve-2020-0796-Scanner

• https://github.com/Murasame-nc/CVE-2020-0796-LPE-POC

• https://github.com/vsai94/ECE9069_SMBGhost_Exploit_CVE-2020-0796-

• https://github.com/1060275195/SMBGhost

• https://github.com/z3ena/Exploiting-and-Mitigating-CVE-2020-0796-SMBGhost-and-Print-Spooler-Vulnerabilities

• https://github.com/Almorabea/SMBGhost-WorkaroundApplier

CVE-2020-0787

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.

• https://github.com/cbwang505/CVE-2020-0787-EXP-ALL-WINDOWS-VERSION

• https://github.com/Al1ex/WindowsElevation

• https://github.com/khulnasoft-lab/awesome-security

• https://github.com/yanghaoi/CVE-2020-0787

• https://github.com/MasterSploit/CVE-2020-0787

• https://github.com/MasterSploit/CVE-2020-0787-BitsArbitraryFileMove-master

CVE-2020-0754

An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0753.

• https://github.com/afang5472/CVE-2020-0753-and-CVE-2020-0754

• https://github.com/VikasVarshney/CVE-2020-0753-and-CVE-2020-0754

CVE-2020-0753

An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0754.

• https://github.com/afang5472/CVE-2020-0753-and-CVE-2020-0754

• https://github.com/VikasVarshney/CVE-2020-0753-and-CVE-2020-0754

CVE-2020-0728

An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Installer Service Information Disclosure Vulnerability'.

• https://github.com/irsl/CVE-2020-0728

CVE-2020-0688

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.

• https://github.com/zcgonvh/CVE-2020-0688

• https://github.com/Ridter/cve-2020-0688

• https://github.com/random-robbie/cve-2020-0688

• https://github.com/Yt1g3r/CVE-2020-0688_EXP

• https://github.com/Jumbo-WJB/CVE-2020-0688

• https://github.com/onSec-fr/CVE-2020-0688-Scanner

• https://github.com/w4fz5uck5/cve-2020-0688-webshell-upload-technique

• https://github.com/MrTiz/CVE-2020-0688

• https://github.com/W01fh4cker/CVE-2020-0688-GUI

• https://github.com/ravinacademy/CVE-2020-0688

• https://github.com/youncyb/CVE-2020-0688

• https://github.com/zyn3rgy/ecp_slap

• https://github.com/cert-lv/CVE-2020-0688

• https://github.com/justin-p/PSForgot2kEyXCHANGE

• https://github.com/murataydemir/CVE-2020-0688

• https://github.com/ktpdpro/CVE-2020-0688

• https://github.com/righter83/CVE-2020-0688

• https://github.com/mahyarx/Exploit_CVE-2020-0688

• https://github.com/SLSteff/CVE-2020-0688-Scanner

• https://github.com/1337-llama/CVE-2020-0688-Python3

• https://github.com/chudamax/CVE-2020-0688-Exchange2010

• https://github.com/truongtn/cve-2020-0688

• https://github.com/Ken-Abruzzi/cve_2020_0688

• https://github.com/7heKnight/CVE-2020-0688

• https://github.com/ann0906/proxylogon

CVE-2020-0683

An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.

• https://github.com/Al1ex/WindowsElevation

• https://github.com/padovah4ck/CVE-2020-0683

CVE-2020-0674

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, CVE-2020-0767.

• https://github.com/maxpl0it/CVE-2020-0674-Exploit

• https://github.com/forrest-orr/DoubleStar

• https://github.com/forrest-orr/Exploits

• https://github.com/Neko-chanQwQ/CVE-2020-0674-PoC

• https://github.com/Ken-Abruzzi/CVE-2020-0674

• https://github.com/Micky-Thongam/Internet-Explorer-UAF

CVE-2020-0668

An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0669, CVE-2020-0670, CVE-2020-0671, CVE-2020-0672.

• https://github.com/Al1ex/WindowsElevation

• https://github.com/RedCursorSecurityConsulting/CVE-2020-0668

• https://github.com/ycdxsb/CVE-2020-0668

• https://github.com/Nan3r/CVE-2020-0668

• https://github.com/tussjump/cve_2020_0668

• https://github.com/modulexcite/SysTracingPoc

• https://github.com/bypazs/CVE-2020-0668.exe

• https://github.com/0xSs0rZ/Windows_Exploit

CVE-2020-0624

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0642.

• https://github.com/james0x40/CVE-2020-0624

CVE-2020-0618

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

• https://github.com/euphrat1ca/CVE-2020-0618

• https://github.com/wortell/cve-2020-0618

• https://github.com/itstarsec/CVE-2020-0618

CVE-2020-0610

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0609.

• https://github.com/ly4k/BlueGate

• https://github.com/ioncodes/BlueGate

• https://github.com/MalwareTech/RDGScanner

• https://github.com/ruppde/rdg_scanner_cve-2020-0609

CVE-2020-0609

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0610.

• https://github.com/ly4k/BlueGate

• https://github.com/ioncodes/BlueGate

• https://github.com/MalwareTech/RDGScanner

• https://github.com/ruppde/rdg_scanner_cve-2020-0609

• https://github.com/Archi73ct/CVE-2020-0609

CVE-2020-0601

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

• https://github.com/ly4k/CurveBall

• https://github.com/kudelskisecurity/chainoffools

• https://github.com/gentilkiwi/curveball

• https://github.com/saleemrashid/badecparams

• https://github.com/0xxon/cve-2020-0601

• https://github.com/eastmountyxz/CVE-2020-0601-EXP

• https://github.com/ioncodes/Curveball

• https://github.com/david4599/CurveballCertTool

• https://github.com/0xxon/cve-2020-0601-plugin

• https://github.com/RrUZi/Awesome-CVE-2020-0601

• https://github.com/IIICTECH/-CVE-2020-0601-ECC---EXPLOIT

• https://github.com/nissan-sudo/CVE-2020-0601

• https://github.com/YoannDqr/CVE-2020-0601

• https://github.com/talbeerysec/CurveBallDetection

• https://github.com/gremwell/cve-2020-0601_poc

• https://github.com/BlueTeamSteve/CVE-2020-0601

• https://github.com/yanghaoi/CVE-2020-0601

• https://github.com/amlweems/gringotts

• https://github.com/SherlockSec/CVE-2020-0601

• https://github.com/Hans-MartinHannibalLauridsen/CurveBall

• https://github.com/cimashiro/-Awesome-CVE-2020-0601-

• https://github.com/eastmountyxz/CVE-2018-20250-WinRAR

• https://github.com/0xxon/cve-2020-0601-utils

• https://github.com/MarkusZehnle/CVE-2020-0601

• https://github.com/ShayNehmad/twoplustwo

• https://github.com/apodlosky/PoC_CurveBall

• https://github.com/JPurrier/CVE-2020-0601

• https://github.com/modubyk/CVE_2020_0601

• https://github.com/Ash112121/CVE-2020-0601

• https://github.com/thimelp/cve-2020-0601-Perl

• https://github.com/exploitblizzard/CVE-2020-0601-spoofkey

• https://github.com/JoelBts/CVE-2020-0601_PoC

• https://github.com/okanulkr/CurveBall-CVE-2020-0601-PoC

• https://github.com/Doug-Moody/Windows10_Cumulative_Updates_PowerShell

• https://github.com/tyj956413282/curveball-plus

• https://github.com/dlee35/curveball_lua

• https://github.com/bsides-rijeka/meetup-2-curveball

CVE-2020-0568

Race condition in the Intel(R) Driver and Support Assistant before version 20.1.5 may allow an authenticated user to potentially enable denial of service via local access.

• https://github.com/hessandrew/CVE-2020-0568_INTEL-SA-00344

CVE-2020-0557

Insecure inherited permissions in Intel(R) PROSet/Wireless WiFi products before version 21.70 on Windows 10 may allow an authenticated user to potentially enable escalation of privilege via local access.

• https://github.com/hessandrew/CVE-2020-0557_INTEL-SA-00338

CVE-2020-0551

Load value injection in some Intel(R) Processors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. The list of affected products is provided in intel-sa-00334: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00334.html

• https://github.com/bitdefender/lvi-lfb-attack-poc

CVE-2020-0471

In reassemble_and_dispatch of packet_fragmenter.cc, there is a possible way to inject packets into an encrypted Bluetooth connection due to improper input validation. This could lead to remote escalation of privilege between two Bluetooth devices by a proximal attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, Android-11; Android ID: A-169327567.

• https://github.com/nanopathi/system_bt_AOSP10_r33_CVE-2020-0471

CVE-2020-0463

In sdp_server_handle_client_req of sdp_server.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure from the bluetooth server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.0 Android-8.1 Android-9Android ID: A-169342531

• https://github.com/nanopathi/system_bt_AOSP10_r33_CVE-2020-0463

CVE-2020-0458

In SPDIFEncoder::writeBurstBufferBytes and related methods of SPDIFEncoder.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-8.0 Android-8.1Android ID: A-160265164

• https://github.com/nanopathi/system_media_AOSP10_r33_CVE-2020-0458

CVE-2020-0453

In updateNotification of BeamTransferManager.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-8.0 Android-8.1Android ID: A-159060474

• https://github.com/pazhanivel07/Nfc_CVE-2020-0453

• https://github.com/nanopathi/Packages_apps_Nfc_CVE-2020-0453

• https://github.com/Trinadh465/packages_apps_Nfc_AOSP10_r33_CVE-2020-0453

CVE-2020-0452

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-159625731

• https://github.com/ShaikUsaf/external_libexif_AOSP10_CVE-2020-0452

CVE-2020-0451

In sbrDecoder_AssignQmfChannels2SbrChannels of sbrdecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9 Android-8.0 Android-8.1Android ID: A-158762825

• https://github.com/nanopathi/external_aac_AOSP10_r33_CVE-2020-0451

CVE-2020-0443

In LocaleList of LocaleList.java, there is a possible forced reboot due to an uncaught exception. This could lead to local denial of service requiring factory reset to restore with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-152410253

• https://github.com/Supersonic/CVE-2020-0443

CVE-2020-0439

In generatePackageInfo of PackageManagerService.java, there is a possible permissions bypass due to an incorrect permission check. This could lead to local escalation of privilege that allows instant apps access to permissions not allowed for instant apps, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-140256621

• https://github.com/Satheesh575555/frameworks_base_AOSP10_r33_CVE-2020-0439

CVE-2020-0423

In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-161151868References: N/A

• https://github.com/sparrow-labz/CVE-2020-0423

CVE-2020-0421

In appendFormatV of String8.cpp, there is a possible out of bounds write due to incorrect error handling. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-161894517

• https://github.com/nanopathi/system_core_AOSP10_r33_CVE-2020-0421

CVE-2020-0418

In getPermissionInfosForGroup of Utils.java, there is a logic error. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-153879813

• https://github.com/fernandodruszcz/CVE-2020-0418

• https://github.com/Trinadh465/packages_apps_PackageInstaller_AOSP10_r33_CVE-2020-0418

CVE-2020-0416

In multiple settings screens, there are possible tapjacking attacks due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.0 Android-8.1Android ID: A-155288585

• https://github.com/Satheesh575555/packages_apps_Settings_AOSP10_r33_CVE-2020-0416

• https://github.com/ShaikUsaf/packages_apps_settings_AOSP10_r33_CVE-2020-0416

CVE-2020-0413

In gatt_process_read_by_type_rsp of gatt_cl.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure in the Bluetooth server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-158778659

• https://github.com/Satheesh575555/system_bt_AOSP10_r33_CVE-2020-0413

CVE-2020-0409

In create of FileMap.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-8.0 Android-8.1 Android-9Android ID: A-156997193

• https://github.com/nanopathi/system_core_AOSP10_r33_CVE-2020-0409

CVE-2020-0401

In setInstallerPackageName of PackageManagerService.java, there is a missing permission check. This could lead to local escalation of privilege and granting spurious permissions with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-150857253

• https://github.com/nanopathi/framework_base_AOSP10_r33_CVE-2020-0401

• https://github.com/Satheesh575555/frameworks_base_AOSP10_r33_CVE-2020-0401

CVE-2020-0394

In onCreate of BluetoothPairingDialog.java, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege and untrusted devices accessing contact lists with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-155648639

• https://github.com/pazhanivel07/Settings_10-r33_CVE-2020-0394

• https://github.com/pazhanivel07/Settings_10-r33_CVE-2020-0394_02

• https://github.com/ShaikUsaf/packages_apps_settings_AOSP10_r33_CVE-2020-0394

CVE-2020-0392

In getLayerDebugInfo of SurfaceFlinger.cpp, there is a possible code execution due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11Android ID: A-150226608

• https://github.com/Satheesh575555/frameworks_native_AOSP10_r33_CVE-2020-0392

CVE-2020-0391

In applyPolicy of PackageManagerService.java, there is possible arbitrary command execution as System due to an unenforced protected-broadcast. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11Android ID: A-158570769

• https://github.com/nanopathi/framework_base_AOSP10_r33_CVE-2020-0391

CVE-2020-0381

In Parse_wave of eas_mdls.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote information disclosure in a highly constrained process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-150159669

• https://github.com/Trinadh465/external_sonivox_AOSP10_r33_CVE-2020-0381

CVE-2020-0380

In allocExcessBits of bitalloc.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-146398979

• https://github.com/ShaikUsaf/system_bt_AOSP10_r33_CVE-2020-0380

CVE-2020-0377

In gatt_process_read_by_type_rsp of gatt_cl.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure in the Bluetooth server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-158833854

• https://github.com/Satheesh575555/system_bt_AOSP10_r33_CVE-2020-0377

CVE-2020-0245

In DecodeFrameCombinedMode of combined_decode.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-152496149

• https://github.com/nanopathi/packages_apps_Nfc_cve-2020_02453

• https://github.com/Satheesh575555/frameworks_av_AOSP10_r33_CVE-2020-0245

CVE-2020-0243

In clearPropValue of MediaAnalyticsItem.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the media server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-8.0 Android-8.1Android ID: A-151644303

• https://github.com/pazhanivel07/frameworks_av-CVE-2020-0242_CVE-2020-0243

CVE-2020-0242

In reset of NuPlayerDriver.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the media server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-151643722

• https://github.com/pazhanivel07/frameworks_av-CVE-2020-0242_CVE-2020-0243

• https://github.com/pazhanivel07/frameworks_av-10-r33_CVE-2020-0242

CVE-2020-0241

In NuPlayerStreamListener of NuPlayerStreamListener.cpp, there is possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-151456667

• https://github.com/nanopathi/frameworks_av_AOSP10_r33_CVE-2020-0241

CVE-2020-0240

In NewFixedDoubleArray of factory.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-150706594

• https://github.com/ShaikUsaf/external_v8_AOSP10_r33_CVE-2020-0240

CVE-2020-0227

In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing background data usage or launching from the background, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-129476618

• https://github.com/nanopathi/framework_base_AOSP10_r33_CVE-2020-0227

CVE-2020-0226

In createWithSurfaceParent of Client.cpp, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege in the graphics server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-150226994

• https://github.com/Trinadh465/frameworks_native_CVE-2020-0226

• https://github.com/ShaikUsaf/frameworks_native_AOSP10_r33_ShaikUsaf-frameworks_native_AOSP10_r33_CVE-2020-0226

CVE-2020-0225

In a2dp_vendor_ldac_decoder_decode_packet of a2dp_vendor_ldac_decoder.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-142546668

• https://github.com/nanopathi/system_bt_AOSP10_r33_CVE-2020-0225

CVE-2020-0219

In onCreate of SliceDeepLinkSpringBoard.java there is a possible insecure Intent. This could lead to local elevation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-122836081

• https://github.com/pazhanivel07/Settings_10-r33_CVE-CVE-2020-0219

• https://github.com/Satheesh575555/packages_apps_Settings_AOSP10_r33_CVE-2020-0219

• https://github.com/Trinadh465/packages_apps_Settings_AOSP10_r33_CVE-2020-0219_CVE-2020-0188_old

• https://github.com/Trinadh465/packages_apps_Settings_AOSP10_r33_CVE-2020-0219_CVE-2020-0188_old-one

CVE-2020-0218

In loadSoundModel and related functions of SoundTriggerHwService.cpp, there is possible out of bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-136005905

• https://github.com/pazhanivel07/frameworks_av-CVE-2020-0218

CVE-2020-0215

In onCreate of ConfirmConnectActivity.java, there is a possible leak of Bluetooth information due to a permissions bypass. This could lead to local escalation of privilege that exposes a pairing Bluetooth MAC address with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9 Android-10 Android-11 Android-8.0 Android-8.1 Android ID: A-140417248

• https://github.com/Trinadh465/packages_apps_Nfc_AOSP10_r33_CVE-2020-0215

CVE-2020-0209

In multiple functions of AccountManager.java, there is a possible permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145206842

• https://github.com/pazhanivel07/frameworks_base_CVE-2020-0209

CVE-2020-0203

In freeIsolatedUidLocked of ProcessList.java, there is a possible UID reuse due to improper cleanup. This could lead to local escalation of privilege between constrained processes with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146313311

• https://github.com/Trinadh465/frameworks_base_AOSP10_r33_CVE-2020-0203

CVE-2020-0201

In showSecurityFields of WifiConfigController.java there is a possible credential leak due to a confused deputy. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-143601727

• https://github.com/uthrasri/Packages_app_settings_CVE-2020-0201

• https://github.com/Trinadh465/packages_apps_Settings_CVE-2020-0201

CVE-2020-0198

In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941

• https://github.com/Trinadh465/external_libexif_AOSP10_r33_CVE-2020-0198

CVE-2020-0188

In onCreatePermissionRequest of SettingsSliceProvider.java, there is a possible permissions bypass due to a PendingIntent error. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147355897

• https://github.com/Satheesh575555/packages_apps_Settings_AOSP10_r33_CVE-2020-0188

• https://github.com/ShaikUsaf/ShaikUsaf-packages_apps_settings_AOSP10_r33_CVE-2020-0188

• https://github.com/Trinadh465/packages_apps_Settings_AOSP10_r33_CVE-2020-0188_CVE-0219

• https://github.com/Trinadh465/packages_apps_Settings_AOSP10_r33_CVE-2020-0219_CVE-2020-0188_old

• https://github.com/Trinadh465/packages_apps_Settings_AOSP10_r33_CVE-2020-0219_CVE-2020-0188_old-one

CVE-2020-0183

In handleMessage of BluetoothManagerService, there is an incomplete reset. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-110181479

• https://github.com/nanopathi/packages_apps_Bluetooth_AOSP10_r33_CVE-2020-0183

• https://github.com/hshivhare67/platform_packages_apps_bluetooth_AOSP10_r33_CVE-2020-0183

CVE-2020-0181

In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076

• https://github.com/Trinadh465/external_libexif_AOSP10_r33_CVE-2020-0181

CVE-2020-0160

In setSyncSampleParams of SampleTable.cpp, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-124771364

• https://github.com/nanopathi/frameworks_av_AOSP10_r33_CVE-2020-0160

CVE-2020-0155

In phNxpNciHal_send_ese_hal_cmd of phNxpNciHal_ext.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-139736386

• https://github.com/Trinadh465/hardware_nxp_nfc_AOSP10_r33_CVE-2020-0155

CVE-2020-0138

In get_element_attr_rsp of btif_rc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if bluetoothtbd were used, which it isn't in typical Android platforms, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-142878416

• https://github.com/Satheesh575555/system_bt_AOSP10_r33-CVE-2020-0138

CVE-2020-0137

In setIPv6AddrGenMode of NetworkManagementService.java, there is a possible bypass of networking permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141920289

• https://github.com/nanopathi/framework_base_AOSP10_r33_CVE-2020-0137

• https://github.com/ShaikUsaf/frameworks_base_AOSP10_r33_CVE-2020-0137

CVE-2020-0136

In multiple locations of Parcel.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-120078455

• https://github.com/Satheesh575555/libhwbinder_AOSP10_r33_CVE-2020-0136

CVE-2020-0121

In updateUidProcState of AppOpsService.java, there is a possible permission bypass due to a logic error. This could lead to local information disclosure of location data with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-148180766

• https://github.com/mooneee/CVE-2020-0121

CVE-2020-0114

In onCreateSliceProvider of KeyguardSliceProvider.java, there is a possible confused deputy due to a PendingIntent error. This could lead to local escalation of privilege that allows actions performed as the System UI, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147606347

• https://github.com/tea9/CVE-2020-0114-systemui

CVE-2020-0113

In sendCaptureResult of Camera3OutputUtils.cpp, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-9Android ID: A-150944913

• https://github.com/XDo0/ServiceCheater

CVE-2020-0108

In postNotification of ServiceRecord.java, there is a possible bypass of foreground process restrictions due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-8.1 Android-9Android ID: A-140108616

• https://github.com/CrackerCat/ServiceCheater

• https://github.com/XDo0/ServiceCheater

CVE-2020-0096

In startActivities of ActivityStartController.java, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9Android ID: A-145669109

• https://github.com/tea9/CVE-2020-0096-StrandHogg2

• https://github.com/liuyun201990/StrandHogg2

• https://github.com/nahid0x1/CVE-2020-0096-strandhogg-exploit-p0c

• https://github.com/wyu0hop/CVE-2020-0096

CVE-2020-0082

In ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary intent due to unsafe deserialization. This could lead to local escalation of privilege to system_server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-140417434

• https://github.com/0x742/CVE-2020-0082-ExternalVibration

CVE-2020-0069

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754

• https://github.com/R0rt1z2/AutomatedRoot

• https://github.com/quarkslab/CVE-2020-0069_poc

• https://github.com/TheRealJunior/mtk-su-reverse-cve-2020-0069

• https://github.com/0xf15h/mtk_su

• https://github.com/yanglingxi1993/CVE-2020-0069

CVE-2020-0041

In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145988638References: Upstream kernel

• https://github.com/bluefrostsecurity/CVE-2020-0041

• https://github.com/j4nn/CVE-2020-0041

• https://github.com/jcalabres/root-exploit-pixel3

• https://github.com/vaginessa/CVE-2020-0041-Pixel-3a

• https://github.com/koharin/CVE-2020-0041

CVE-2020-0023

In setPhonebookAccessPermission of AdapterService.java, there is a possible disclosure of user contacts over bluetooth due to a missing permission check. This could lead to local information disclosure if a malicious app enables contacts over a bluetooth connection, with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145130871

• https://github.com/362902755/CVE-2020-0023

CVE-2020-0022

In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715

• https://github.com/leommxj/cve-2020-0022

• https://github.com/Polo35/CVE-2020-0022

• https://github.com/k3vinlusec/Bluefrag_CVE-2020-0022

• https://github.com/themmokhtar/CVE-2020-0022

• https://github.com/lsw29475/CVE-2020-0022

• https://github.com/5k1l/cve-2020-0022

• https://github.com/devdanqtuan/poc-for-cve-2020-0022

CVE-2020-0014

It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-128674520

• https://github.com/tea9/CVE-2020-0014-Toast

• https://github.com/ASIFASSU/CVE-2020-0014

CVE-2020-0002

In ih264d_init_decoder of ih264d_api.c, there is a possible out of bounds write due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-142602711

• https://github.com/fengjixuchui/CVEAC-2020-0002

CVE-2020-0001

In getProcessRecordLocked of ActivityManagerService.java isolated apps are not handled correctly. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-140055304

• https://github.com/Zachinio/CVE-2020-0001