Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2020

119 records · 7 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2013-3619
    60This week

    Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for

    HighCVSS 8.1WeaponizedEPSS 9%

    supermicro · smt x9 firmwareJan 2, 2020

  • CVE-2013-3944
    39Monitor

    Stack-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via

    HighCVSS 7.8No exploitEPSS 27%

    extensis · mrsidJan 2, 2020

  • CVE-2016-1000027
    49Plan

    Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untru

    CriticalCVSS 9.8Proof of conceptEPSS 33%

    vmware · spring frameworkJan 2, 2020

  • CVE-2019-5063
    41Plan

    An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0.

    HighCVSS 8.8No exploitEPSS 21%

    opencv · opencvJan 3, 2020

  • CVE-2019-5064
    38Monitor

    An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0.

    HighCVSS 8.8No exploitEPSS 10%

    opencv · opencvJan 3, 2020

  • CVE-2014-8516
    64This week

    Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a fi

    CriticalCVSS 9.8WeaponizedEPSS 81%

    cloudfastpath · netcharts serverJan 3, 2020

  • CVE-2020-5192
    42Plan

    PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not

    HighCVSS 8.8Proof of conceptEPSS 23%

    phpgurukul · hospital management systemJan 5, 2020

  • CVE-2019-15975
    68This week

    Cisco Data Center Network Manager Authentication Bypass Vulnerabilities

    CriticalCVSS 9.8WeaponizedEPSS 96%

    cisco · data center network managerJan 6, 2020

  • CVE-2019-15976
    67This week

    Cisco Data Center Network Manager Authentication Bypass Vulnerabilities

    CriticalCVSS 9.8Proof of conceptEPSS 92%

    cisco · data center network managerJan 6, 2020

  • CVE-2019-15977
    41Plan

    Cisco Data Center Network Manager Authentication Bypass Vulnerabilities

    HighCVSS 7.5Proof of conceptEPSS 38%

    cisco · data center network managerJan 6, 2020

  • CVE-2019-15978
    39Monitor

    Cisco Data Center Network Manager Command Injection Vulnerabilities

    HighCVSS 7.2Proof of conceptEPSS 37%

    cisco · data center network managerJan 6, 2020

  • CVE-2019-15980
    43Plan

    Cisco Data Center Network Manager Path Traversal Vulnerabilities

    HighCVSS 7.2No exploitEPSS 49%

    cisco · data center network managerJan 6, 2020

  • CVE-2019-15981
    32Monitor

    Cisco Data Center Network Manager Path Traversal Vulnerabilities

    HighCVSS 7.2No exploitEPSS 14%

    cisco · data center network managerJan 6, 2020

  • CVE-2019-15982
    32Monitor

    Cisco Data Center Network Manager Path Traversal Vulnerabilities

    HighCVSS 7.2No exploitEPSS 14%

    cisco · data center network managerJan 6, 2020

  • CVE-2019-15984
    42Plan

    Cisco Data Center Network Manager SQL Injection Vulnerabilities

    HighCVSS 7.2Proof of conceptEPSS 46%

    cisco · data center network managerJan 6, 2020

  • CVE-2020-5514
    49Plan

    Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.

    CriticalCVSS 9.1No exploitEPSS 44%

    gilacms · gila cmsJan 6, 2020

  • CVE-2020-5515
    36Monitor

    Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.

    HighCVSS 7.2Proof of conceptEPSS 26%

    gilacms · gila cmsJan 6, 2020

  • CVE-2019-19509
    56Plan

    An issue was discovered in rConfig 3.9.3.

    HighCVSS 8.8WeaponizedEPSS 71%

    rconfig · rconfigJan 6, 2020

  • CVE-2020-5512
    33Monitor

    Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.

    MediumCVSS 6.8No exploitEPSS 18%

    gilacms · gila cmsJan 6, 2020

  • CVE-2020-5513
    35Monitor

    Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.

    MediumCVSS 6.8No exploitEPSS 25%

    gilacms · gila cmsJan 6, 2020

  • CVE-2015-4553
    52Plan

    A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.

    HighCVSS 8.8Proof of conceptEPSS 56%

    dedecms · dedecmsJan 6, 2020

  • CVE-2014-8673
    43Plan

    Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Plann

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    soplanning · soplanningJan 7, 2020

  • CVE-2020-5307
    44Plan

    PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    phpgurukul · dairy farm shop management systemJan 7, 2020

  • CVE-2019-17147
    39Monitor

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers.

    HighCVSS 8.8Proof of conceptEPSS 13%

    tp-link · tl-wr841n firmwareJan 7, 2020

  • CVE-2019-20361
    65This week

    There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the data

    CriticalCVSS 9.8WeaponizedEPSS 85%

    icegram · email subscribers \& newslettersJan 8, 2020

  • CVE-2019-19494
    60This week

    Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary

    HighCVSS 8.8WeaponizedEPSS 23%

    sagemcom · f\@st 3890 firmwareJan 9, 2020

  • CVE-2019-20224
    50Plan

    netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell

    HighCVSS 8.8Proof of conceptEPSS 49%

    artica · pandora fmsJan 9, 2020

  • CVE-2019-20372
    25Monitor

    NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to

    MediumCVSS 5.3Proof of conceptEPSS 14%

    f5 · nginxJan 9, 2020

  • CVE-2012-3807
    48Plan

    Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.

    CriticalCVSS 9.8Proof of conceptEPSS 31%

    samsung · kiesJan 9, 2020

  • CVE-2020-5504
    47Plan

    In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page.

    HighCVSS 8.8Proof of conceptEPSS 39%

    phpmyadmin · phpmyadminJan 9, 2020

  • CVE-2020-6756
    42Plan

    languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    rasilient · pixelstor 5000 firmwareJan 9, 2020

  • CVE-2014-5081
    42Plan

    sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    sphider · sphiderJan 10, 2020

  • CVE-2012-4284
    60This week

    A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHe

    CriticalCVSS 9.8WeaponizedEPSS 69%

    sparklabs · viscosityJan 10, 2020

  • CVE-2019-13767
    40Plan

    Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to

    HighCVSS 8.8No exploitEPSS 15%

    google · chromeJan 10, 2020

  • CVE-2014-6038
    60This week

    Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability.

    HighCVSS 7.5WeaponizedEPSS 72%

    zohocorp · manageengine eventlog analyzerJan 13, 2020

  • CVE-2014-6039
    60This week

    ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability.

    HighCVSS 7.5WeaponizedEPSS 68%

    zohocorp · manageengine eventlog analyzerJan 13, 2020

  • CVE-2013-6225
    47Plan

    LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 26%

    livezilla · livezillaJan 13, 2020

  • CVE-2015-3159
    31Monitor

    The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process env

    HighCVSS 7.8No exploitEPSS 0%

    redhat · automatic bug reporting toolJan 14, 2020

  • CVE-2020-5505
    52Plan

    Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"applic

    CriticalCVSS 9.8No exploitEPSS 44%

    vaaip · freelancyJan 14, 2020

  • CVE-2020-0601
    89Now

    A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attac

    HighCVSS 8.1KEVWeaponizedEPSS 89%

    microsoft · windows 10 1507Jan 14, 2020

  • CVE-2020-0603
    41Plan

    A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who su

    HighCVSS 8.8No exploitEPSS 21%

    microsoft · asp.net coreJan 14, 2020

  • CVE-2020-0605
    40Plan

    A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who s

    HighCVSS 8.8No exploitEPSS 17%

    microsoft · .net frameworkJan 14, 2020

  • CVE-2020-0606
    40Plan

    A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who s

    HighCVSS 8.8No exploitEPSS 17%

    microsoft · .net frameworkJan 14, 2020

  • CVE-2020-0609
    62This week

    A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the

    CriticalCVSS 9.8Proof of conceptEPSS 77%

    microsoft · windows server 2012Jan 14, 2020

  • CVE-2020-0610
    59Plan

    A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the

    CriticalCVSS 9.8Proof of conceptEPSS 67%

    microsoft · windows server 2012Jan 14, 2020

  • CVE-2020-0638
    62This week

    An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an at

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    microsoft · windows 10 1709Jan 14, 2020

  • CVE-2020-0646
    99Now

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    microsoft · .net frameworkJan 14, 2020

  • CVE-2020-0650
    36Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    HighCVSS 7.8No exploitEPSS 17%

    microsoft · excelJan 14, 2020

  • CVE-2020-0651
    36Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    HighCVSS 7.8No exploitEPSS 17%

    microsoft · excelJan 14, 2020

  • CVE-2020-0652
    36Monitor

    A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka

    HighCVSS 7.8No exploitEPSS 17%

    microsoft · excelJan 14, 2020

  • CVE-2020-0653
    37Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    HighCVSS 7.8No exploitEPSS 20%

    microsoft · office 365 proplusJan 14, 2020

  • CVE-2015-7874
    43Plan

    Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nick

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    portapps · kitty portableJan 15, 2020

  • CVE-2020-2096
    52Plan

    Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerabi

    MediumCVSS 6.1Proof of conceptEPSS 92%

    jenkins · gitlab hookJan 15, 2020

  • CVE-2019-16469
    35Monitor

    Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability.

    HighCVSS 7.5Proof of conceptEPSS 17%

    adobe · experience managerJan 15, 2020

  • CVE-2020-2551
    97Now

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components).

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    oracle · weblogic serverJan 15, 2020

  • CVE-2020-2555
    98Now

    Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation).

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    oracle · access managerJan 15, 2020

  • CVE-2020-7048
    43Plan

    The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the databas

    CriticalCVSS 9.1Proof of conceptEPSS 22%

    webfactoryltd · wp database resetJan 16, 2020

  • CVE-2019-15742
    40Plan

    A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application.

    HighCVSS 7.8WeaponizedEPSS 4%

    plantronics · plantronics hubJan 16, 2020

  • CVE-2019-17361
    44Plan

    In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection.

    CriticalCVSS 9.8No exploitEPSS 15%

    saltstack · saltJan 16, 2020

  • CVE-2020-5398
    57Plan

    RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

    HighCVSS 7.5Proof of conceptEPSS 88%

    vmware · spring frameworkJan 17, 2020

  • CVE-2014-5007
    50Plan

    Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Serv

    CriticalCVSS 9.8Proof of conceptEPSS 37%

    zohocorp · manageengine desktop centralJan 17, 2020

  • CVE-2020-7237
    46Plan

    Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_a

    HighCVSS 8.8No exploitEPSS 37%

    cacti · cactiJan 20, 2020

  • CVE-2020-7246
    60This week

    A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier.

    HighCVSS 8.8WeaponizedEPSS 83%

    qdpm · qdpmJan 21, 2020

  • CVE-2019-17357
    36Monitor

    Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when

    MediumCVSS 6.5No exploitEPSS 34%

    cacti · cactiJan 21, 2020

  • CVE-2019-18426
    82Now

    A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-s

    HighCVSS 8.2KEVWeaponizedEPSS 67%

    whatsapp · whatsappJan 21, 2020

  • CVE-2013-6785
    40Plan

    Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary

    MediumCVSS 4.3WeaponizedEPSS 4%

    supermicro · intelligent platform management interfaceJan 23, 2020

  • CVE-2019-19838
    46Plan

    emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribu

    CriticalCVSS 9.8No exploitEPSS 24%

    ruckuswireless · unleashedJan 23, 2020

  • CVE-2012-6083
    34Monitor

    Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.

    HighCVSS 7.5Proof of conceptEPSS 11%

    freeciv · freecivJan 23, 2020

  • CVE-2019-16516
    27Monitor

    An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.

    MediumCVSS 5.3Proof of conceptEPSS 19%

    connectwise · controlJan 23, 2020

  • CVE-2013-1592
    46Plan

    A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Mes

    CriticalCVSS 9.8Proof of conceptEPSS 24%

    sap · netweaverJan 23, 2020

  • CVE-2012-6649
    44Plan

    WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    devfarm · wp gpx mapsJan 23, 2020

  • CVE-2012-6663
    60This week

    General Electric D20ME devices are not properly configured and reveal plaintext passwords.

    HighCVSS 7.5WeaponizedEPSS 9%

    ge · d20me firmwareJan 23, 2020

  • CVE-2019-17570
    54Plan

    An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrp

    CriticalCVSS 9.8Proof of conceptEPSS 49%

    apache · xml-rpcJan 23, 2020

  • CVE-2013-1595
    51Plan

    A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization heade

    CriticalCVSS 9.8Proof of conceptEPSS 41%

    vivotek · pt7135 firmwareJan 24, 2020

  • CVE-2013-1596
    24Monitor

    An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554

    MediumCVSS 5.3Proof of conceptEPSS 10%

    vivotek · pt7135 firmwareJan 24, 2020

  • CVE-2019-19363
    40Plan

    An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege es

    HighCVSS 7.8WeaponizedEPSS 4%

    ricoh · generic pcl5 driverJan 24, 2020

  • CVE-2013-1597
    30Monitor

    A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET request, which could let

    MediumCVSS 6.5Proof of conceptEPSS 14%

    vivotek · pt7135 firmwareJan 24, 2020

  • CVE-2013-1598
    41Plan

    A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary

    HighCVSS 8.8Proof of conceptEPSS 20%

    vivotek · pt7135 firmwareJan 24, 2020

  • CVE-2019-1349
    45Plan

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E

    HighCVSS 8.8No exploitEPSS 34%

    microsoft · visual studio 2017Jan 24, 2020

  • CVE-2019-1350
    43Plan

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E

    HighCVSS 8.8No exploitEPSS 25%

    microsoft · visual studio 2017Jan 24, 2020

  • CVE-2019-1352
    42Plan

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E

    HighCVSS 8.8No exploitEPSS 24%

    microsoft · visual studio 2017Jan 24, 2020

  • CVE-2019-1354
    42Plan

    A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E

    HighCVSS 8.8No exploitEPSS 22%

    microsoft · visual studio 2017Jan 24, 2020

  • CVE-2020-7980
    64This week

    Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.c

    CriticalCVSS 9.8Proof of conceptEPSS 82%

    intelliantech · aptus webJan 25, 2020

  • CVE-2012-1495
    63This week

    install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.

    CriticalCVSS 9.8WeaponizedEPSS 79%

    webcalendar project · webcalendarJan 27, 2020

  • CVE-2019-19825
    48Plan

    On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/

    CriticalCVSS 9.8Proof of conceptEPSS 29%

    totolink · a3002ru firmwareJan 27, 2020

  • CVE-2020-7949
    32Monitor

    schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming se

    HighCVSS 7.8Proof of conceptEPSS 4%

    valvesoftware · dota 2Jan 27, 2020

  • CVE-2013-7390
    61This week

    Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remot

    CriticalCVSS 9.8WeaponizedEPSS 74%

    zohocorp · manageengine desktop centralJan 27, 2020

  • CVE-2014-8741
    62This week

    Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers

    CriticalCVSS 9.8WeaponizedEPSS 77%

    lexmark · markvision enterpriseJan 27, 2020

  • CVE-2019-19824
    43Plan

    On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the b

    HighCVSS 8.8Proof of conceptEPSS 25%

    totolink · a3002ru firmwareJan 27, 2020

  • CVE-2013-2474
    33Monitor

    Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter.

    HighCVSS 7.5Proof of conceptEPSS 10%

    aws-dms · aws xmsJan 27, 2020

  • CVE-2020-7799
    34Monitor

    An issue was discovered in FusionAuth before 1.11.0.

    HighCVSS 7.2Proof of conceptEPSS 19%

    fusionauth · fusionauthJan 28, 2020

  • CVE-2013-2571
    44Plan

    Iris 3.8 before build 1548, as used in Xpient point of sale (POS) systems, allows remote attackers to execute arbitrary commands via a craft

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    hcomm · xpient irisJan 28, 2020

  • CVE-2012-6610
    40Plan

    Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demon

    HighCVSS 8.8WeaponizedEPSS 10%

    polycom · hdx video end pointsJan 28, 2020

  • CVE-2013-4863
    39Monitor

    The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute arbitrary Lua code vi

    HighCVSS 8.8Proof of conceptEPSS 12%

    micasaverde · veralite firmwareJan 28, 2020

  • CVE-2013-1599
    51Plan

    A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/

    CriticalCVSS 9.8Proof of conceptEPSS 40%

    dlink · dcs-3411 firmwareJan 28, 2020

  • CVE-2013-2748
    43Plan

    Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    belkin · wemo switch firmwareJan 28, 2020

  • CVE-2013-1600
    27Monitor

    An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2

    MediumCVSS 5.3Proof of conceptEPSS 18%

    dlink · dcs-2102 firmwareJan 28, 2020

  • CVE-2013-1601
    25Monitor

    An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video strea

    MediumCVSS 5.3Proof of conceptEPSS 12%

    dlink · dcs-3411 firmwareJan 28, 2020

  • CVE-2013-3214
    64This week

    vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.

    CriticalCVSS 9.8WeaponizedEPSS 84%

    vtiger · vtiger crmJan 28, 2020

  • CVE-2020-8417
    39Monitor

    The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.

    HighCVSS 8.8Proof of conceptEPSS 11%

    codesnippets · code snippetsJan 28, 2020