Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2020

111 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2020-8515
    99Now

    DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code executi

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    draytek · vigor2960 firmwareFeb 1, 2020

  • CVE-2020-7471
    59Plan

    Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter

    CriticalCVSS 9.8Proof of conceptEPSS 65%

    djangoproject · djangoFeb 3, 2020

  • CVE-2013-2621
    27Monitor

    Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websi

    MediumCVSS 6.1Proof of conceptEPSS 10%

    telaen project · telaenFeb 3, 2020

  • CVE-2019-16893
    41Plan

    The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the device via a reboot

    HighCVSS 7.5Proof of conceptEPSS 37%

    tp-link · tp-sg105e firmwareFeb 3, 2020

  • CVE-2020-8597
    45Plan

    eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    point-to-point protocol project · point-to-point protocolFeb 3, 2020

  • CVE-2013-7051
    40Plan

    D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters

    HighCVSS 8.8Proof of conceptEPSS 15%

    dlink · dir-100 firmwareFeb 4, 2020

  • CVE-2013-7052
    46Plan

    D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script

    CriticalCVSS 9.8Proof of conceptEPSS 24%

    dlink · dir-100 firmwareFeb 4, 2020

  • CVE-2013-2678
    37Monitor

    Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive

    HighCVSS 8.1Proof of conceptEPSS 16%

    cisco · linksys e4200 firmwareFeb 4, 2020

  • CVE-2020-8450
    51Plan

    An issue was discovered in Squid before 4.10.

    HighCVSS 7.3No exploitEPSS 71%

    squid-cache · squidFeb 4, 2020

  • CVE-2020-8615
    29Monitor

    A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and

    MediumCVSS 6.5Proof of conceptEPSS 10%

    themeum · tutor lmsFeb 4, 2020

  • CVE-2019-12528
    33Monitor

    An issue was discovered in Squid before 4.10.

    HighCVSS 7.5No exploitEPSS 10%

    squid-cache · squidFeb 4, 2020

  • CVE-2020-6754
    67This week

    dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control.

    CriticalCVSS 9.8No exploitEPSS 94%

    dotcms · dotcmsFeb 5, 2020

  • CVE-2020-3118
    69This week

    Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 11%

    cisco · ios xrFeb 5, 2020

  • CVE-2013-2681
    42Plan

    Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized a

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    cisco · linksys e4200 firmwareFeb 5, 2020

  • CVE-2020-8641
    38Monitor

    Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter.

    HighCVSS 8.8Proof of conceptEPSS 10%

    lotus core cms project · lotus core cmsFeb 5, 2020

  • CVE-2020-8644
    95Now

    PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

    CriticalCVSS 9.8KEVWeaponizedEPSS 86%

    playsms · playsmsFeb 5, 2020

  • CVE-2015-6000
    47Plan

    Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDeta

    HighCVSS 8.8WeaponizedEPSS 40%

    vtiger · vtiger crmFeb 6, 2020

  • CVE-2014-2030
    38Monitor

    Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause

    HighCVSS 8.8Proof of conceptEPSS 11%

    imagemagick · imagemagickFeb 6, 2020

  • CVE-2020-8771
    53Plan

    The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass.

    CriticalCVSS 9.8Proof of conceptEPSS 46%

    wptimecapsule · wp time capsuleFeb 6, 2020

  • CVE-2020-8772
    65This week

    The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php.

    CriticalCVSS 9.8WeaponizedEPSS 88%

    revmakx · infinitewp clientFeb 6, 2020

  • CVE-2020-8657
    97Now

    An issue was discovered in EyesOfNetwork 5.3.

    CriticalCVSS 9.8KEVWeaponizedEPSS 91%

    eyesofnetwork · eyesofnetworkFeb 6, 2020

  • CVE-2013-2683
    25Monitor

    Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers to obtain private I

    MediumCVSS 5.3Proof of conceptEPSS 13%

    cisco · linksys e4200 firmwareFeb 6, 2020

  • CVE-2013-3568
    60This week

    Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for re

    HighCVSS 8.8WeaponizedEPSS 25%

    cisco · linksys wrt110 firmwareFeb 6, 2020

  • CVE-2020-8654
    63This week

    An issue was discovered in EyesOfNetwork 5.3.

    HighCVSS 8.8WeaponizedEPSS 91%

    eyesofnetwork · eyesofnetworkFeb 6, 2020

  • CVE-2020-8655
    79This week

    An issue was discovered in EyesOfNetwork 5.3.

    HighCVSS 7.8KEVWeaponizedEPSS 60%

    eyesofnetwork · eyesofnetworkFeb 6, 2020

  • CVE-2020-8656
    64This week

    An issue was discovered in EyesOfNetwork 5.3.

    CriticalCVSS 9.8WeaponizedEPSS 84%

    eyesofnetwork · eyesofnetworkFeb 6, 2020

  • CVE-2013-2009
    39Monitor

    WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution

    HighCVSS 8.8Proof of conceptEPSS 12%

    automattic · wp super cacheFeb 7, 2020

  • CVE-2013-3591
    48Plan

    vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability

    HighCVSS 8.8WeaponizedEPSS 43%

    vtiger · vtiger crmFeb 7, 2020

  • CVE-2013-3628
    55Plan

    Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability

    HighCVSS 8.8WeaponizedEPSS 67%

    zabbix · zabbixFeb 7, 2020

  • CVE-2013-3629
    48Plan

    ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution

    HighCVSS 8.8WeaponizedEPSS 43%

    ispconfig · ispconfigFeb 7, 2020

  • CVE-2019-15604
    36Monitor

    Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

    HighCVSS 7.5No exploitEPSS 19%

    nodejs · node.jsFeb 7, 2020

  • CVE-2019-15605
    56Plan

    HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

    CriticalCVSS 9.8Proof of conceptEPSS 57%

    nodejs · node.jsFeb 7, 2020

  • CVE-2019-15606
    45Plan

    Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value compariso

    CriticalCVSS 9.8No exploitEPSS 20%

    nodejs · node.jsFeb 7, 2020

  • CVE-2019-18988
    59Plan

    TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' in

    HighCVSS 7.0KEVWeaponizedEPSS 4%

    teamviewer · teamviewerFeb 7, 2020

  • CVE-2014-5468
    60This week

    A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malic

    HighCVSS 8.8WeaponizedEPSS 52%

    getrailo · railoFeb 7, 2020

  • CVE-2014-5091
    44Plan

    A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a mali

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    status2k · status2kFeb 7, 2020

  • CVE-2019-19356
    68This week

    Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page.

    HighCVSS 7.5KEVWeaponizedEPSS 28%

    netis-systems · wf2419 firmwareFeb 7, 2020

  • CVE-2014-7863
    60This week

    The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 1

    HighCVSS 7.5WeaponizedEPSS 83%

    zohocorp · manageengine applications managerFeb 8, 2020

  • CVE-2014-8739
    66This week

    Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Cre

    CriticalCVSS 9.8WeaponizedEPSS 91%

    creative-solutions · creative contact formFeb 8, 2020

  • CVE-2012-4512
    38Monitor

    The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly

    HighCVSS 8.8Proof of conceptEPSS 11%

    kde · kdeFeb 8, 2020

  • CVE-2020-8840
    47Plan

    FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi

    CriticalCVSS 9.8Proof of conceptEPSS 26%

    fasterxml · jackson-databindFeb 10, 2020

  • CVE-2013-1360
    46Plan

    An Authentication Bypass vulnerability exists in DELL SonicWALL Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0, Analyzer 7.0, Un

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    sonicwall · analyzerFeb 11, 2020

  • CVE-2013-0803
    61This week

    A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arbitrary code.

    CriticalCVSS 9.8WeaponizedEPSS 74%

    polarbear cms project · polarbear cmsFeb 11, 2020

  • CVE-2013-1359
    66This week

    An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Un

    CriticalCVSS 9.8WeaponizedEPSS 89%

    sonicwall · analyzerFeb 11, 2020

  • CVE-2013-3684
    45Plan

    NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    imagely · nextgen galleryFeb 11, 2020

  • CVE-2020-0618
    95Now

    A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Micr

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    microsoft · sql serverFeb 11, 2020

  • CVE-2020-0655
    52Plan

    A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an authenticated at

    HighCVSS 8.0No exploitEPSS 65%

    microsoft · windows 10Feb 11, 2020

  • CVE-2020-0662
    39Monitor

    A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka 'Windows Remote Code Execution Vulnerabi

    HighCVSS 8.8No exploitEPSS 13%

    microsoft · windows 10Feb 11, 2020

  • CVE-2020-0668
    40Plan

    An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation o

    HighCVSS 7.8WeaponizedEPSS 25%

    microsoft · windows 10Feb 11, 2020

  • CVE-2020-0674
    86Now

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip

    HighCVSS 7.5KEVWeaponizedEPSS 86%

    microsoft · internet explorerFeb 11, 2020

  • CVE-2020-0681
    33Monitor

    A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De

    HighCVSS 7.5No exploitEPSS 10%

    microsoft · windows 10Feb 11, 2020

  • CVE-2020-0683
    63This week

    An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Ele

    HighCVSS 7.8KEVWeaponizedEPSS 7%

    microsoft · windows 10 1507Feb 11, 2020

  • CVE-2020-0688
    95Now

    A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    microsoft · exchange serverFeb 11, 2020

  • CVE-2020-0708
    35Monitor

    A remote code execution vulnerability exists when the Windows Imaging Library improperly handles memory.To exploit this vulnerability, an at

    HighCVSS 7.8No exploitEPSS 13%

    microsoft · windows 10Feb 11, 2020

  • CVE-2020-0710
    33Monitor

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engin

    HighCVSS 7.5No exploitEPSS 10%

    microsoft · edgeFeb 11, 2020

  • CVE-2020-0711
    33Monitor

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engin

    HighCVSS 7.5No exploitEPSS 10%

    microsoft · edgeFeb 11, 2020

  • CVE-2020-0712
    33Monitor

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engin

    HighCVSS 7.5No exploitEPSS 10%

    microsoft · edgeFeb 11, 2020

  • CVE-2020-0713
    33Monitor

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engin

    HighCVSS 7.5No exploitEPSS 10%

    microsoft · edgeFeb 11, 2020

  • CVE-2020-0729
    44Plan

    A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An atta

    HighCVSS 8.8No exploitEPSS 30%

    microsoft · windows 10Feb 11, 2020

  • CVE-2020-0734
    40Plan

    A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De

    HighCVSS 8.8No exploitEPSS 16%

    microsoft · windows 10Feb 11, 2020

  • CVE-2020-0759
    40Plan

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    HighCVSS 8.8No exploitEPSS 15%

    microsoft · excelFeb 11, 2020

  • CVE-2020-0767
    35Monitor

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engin

    HighCVSS 7.5No exploitEPSS 17%

    microsoft · edgeFeb 11, 2020

  • CVE-2014-2595
    44Plan

    Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    barracuda · web application firewallFeb 11, 2020

  • CVE-2014-9390
    62This week

    Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before

    CriticalCVSS 9.8WeaponizedEPSS 75%

    mercurial · mercurialFeb 11, 2020

  • CVE-2013-2010
    61This week

    WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 73%

    automattic · wp super cacheFeb 12, 2020

  • CVE-2013-2097
    40Plan

    ZPanel through 10.1.0 has Remote Command Execution

    HighCVSS 7.8WeaponizedEPSS 26%

    zpanel project · zpanelFeb 12, 2020

  • CVE-2013-6236
    42Plan

    IZON IP 2.0.2: hard-coded password vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    izoncam · izon ip firmwareFeb 12, 2020

  • CVE-2020-7046
    45Plan

    lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated

    HighCVSS 7.5No exploitEPSS 51%

    dovecot · dovecotFeb 12, 2020

  • CVE-2020-8947
    35Monitor

    functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the ind

    HighCVSS 7.2Proof of conceptEPSS 22%

    artica · pandora fmsFeb 12, 2020

  • CVE-2011-4908
    60This week

    TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.

    CriticalCVSS 9.8WeaponizedEPSS 55%

    tiny · tinybrowserFeb 12, 2020

  • CVE-2020-7209
    69This week

    LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.

    CriticalCVSS 9.8WeaponizedEPSS 98%

    hp · linuxkiFeb 12, 2020

  • CVE-2020-3757
    38Monitor

    Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type c

    HighCVSS 8.8No exploitEPSS 10%

    adobe · flash playerFeb 13, 2020

  • CVE-2014-4170
    43Plan

    A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.ph

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    freereprintables · articlefrFeb 13, 2020

  • CVE-2015-6589
    39Monitor

    Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 be

    HighCVSS 8.8Proof of conceptEPSS 13%

    kaseya · virtual system administratorFeb 13, 2020

  • CVE-2020-8844
    38Monitor

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114.

    HighCVSS 7.8No exploitEPSS 23%

    foxitsoftware · readerFeb 14, 2020

  • CVE-2020-8845
    37Monitor

    This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114.

    HighCVSS 7.8No exploitEPSS 19%

    foxitsoftware · readerFeb 14, 2020

  • CVE-2020-8846
    37Monitor

    This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114.

    HighCVSS 7.8No exploitEPSS 19%

    foxitsoftware · readerFeb 14, 2020

  • CVE-2020-8856
    37Monitor

    This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25608.

    HighCVSS 7.8No exploitEPSS 19%

    foxitsoftware · readerFeb 14, 2020

  • CVE-2013-4211
    60This week

    A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remo

    CriticalCVSS 9.8WeaponizedEPSS 70%

    openx · openxFeb 14, 2020

  • CVE-2020-8518
    61This week

    Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.

    CriticalCVSS 9.8WeaponizedEPSS 71%

    horde · groupwareFeb 17, 2020

  • CVE-2015-6922
    64This week

    Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not pro

    CriticalCVSS 9.8WeaponizedEPSS 82%

    kaseya · virtual system administratorFeb 17, 2020

  • CVE-2014-7236
    60This week

    Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the de

    CriticalCVSS 9.1WeaponizedEPSS 55%

    twiki · twikiFeb 17, 2020

  • CVE-2020-8010
    60This week

    CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the r

    CriticalCVSS 9.8WeaponizedEPSS 50%

    broadcom · unified infrastructure managementFeb 18, 2020

  • CVE-2020-8012
    62This week

    CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (c

    CriticalCVSS 9.8WeaponizedEPSS 77%

    broadcom · unified infrastructure managementFeb 18, 2020

  • CVE-2013-2679
    30Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inj

    MediumCVSS 6.1Proof of conceptEPSS 19%

    belkin · linksys e4200 firmwareFeb 18, 2020

  • CVE-2020-7796
    94Now

    Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    synacor · zimbra collaboration suiteFeb 18, 2020

  • CVE-2014-9609
    25Monitor

    Directory traversal vulnerability in webadmin/reporter/view_server_log.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before

    MediumCVSS 5.3Proof of conceptEPSS 12%

    netsweeper · netsweeperFeb 19, 2020

  • CVE-2014-9614
    60This week

    The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attac

    CriticalCVSS 9.8Proof of conceptEPSS 68%

    netsweeper · netsweeperFeb 19, 2020

  • CVE-2020-3153
    64This week

    Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

    MediumCVSS 6.5KEVWeaponizedEPSS 28%

    cisco · anyconnect secure mobility clientFeb 19, 2020

  • CVE-2012-5362
    34Monitor

    The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighb

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · windows 7Feb 20, 2020

  • CVE-2012-5364
    34Monitor

    The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · windows 7Feb 20, 2020

  • CVE-2020-9273
    39Monitor

    In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel.

    HighCVSS 8.8Proof of conceptEPSS 12%

    proftpd · proftpdFeb 20, 2020

  • CVE-2014-4650
    46Plan

    The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which al

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    python · pythonFeb 20, 2020

  • CVE-2014-4019
    34Monitor

    ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, whi

    HighCVSS 7.5Proof of conceptEPSS 12%

    zte · zxv10 w300 firmwareFeb 20, 2020

  • CVE-2020-9283
    36Monitor

    golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto

    HighCVSS 7.5Proof of conceptEPSS 20%

    golang · package sshFeb 20, 2020

  • CVE-2020-9015
    60This week

    Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow a

    CriticalCVSS 9.8WeaponizedEPSS 16%

    arista · dcs-7050qx-32s-r firmwareFeb 20, 2020

  • CVE-2020-8862
    39Monitor

    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC0

    HighCVSS 8.8No exploitEPSS 13%

    dlink · dap-2610 firmwareFeb 21, 2020

  • CVE-2020-8813
    57Plan

    graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest

    HighCVSS 8.8Proof of conceptEPSS 73%

    cacti · cactiFeb 21, 2020

  • CVE-2020-4210
    44Plan

    IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system.

    CriticalCVSS 9.8No exploitEPSS 15%

    ibm · spectrum protectFeb 24, 2020

  • CVE-2020-4211
    60This week

    IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system.

    CriticalCVSS 9.8No exploitEPSS 71%

    ibm · spectrum protectFeb 24, 2020