İçeriğe atla
Noroxi

Yayın tarihine göre

Mart 2020: sömürülen ve yeni ciddi CVE kayıtları

88 kayıt · 20 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

  • CVE-2019-17026
    79Bu hafta

    Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion.

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %46

    mozilla · firefox2 Mar 2020

  • CVE-2020-9547
    45Planlayın

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sq

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    fasterxml · jackson-databind2 Mar 2020

  • CVE-2020-9548
    45Planlayın

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.antero

    KritikCVSS 9,8Kavram kanıtıEPSS %18

    fasterxml · jackson-databind2 Mar 2020

  • CVE-2020-8437
    34İzleyin

    The bencoding parser in BitTorrent uTorrent through 3.5.5 (build 45505) misparses nested bencoded dictionaries, which allows a remote attack

    YüksekCVSS 7,5Kavram kanıtıEPSS %12

    bittorrent · utorrent2 Mar 2020

  • CVE-2020-9757
    61Bu hafta

    The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacont

    KritikCVSS 9,8Kavram kanıtıEPSS %72

    craftcms · craft cms4 Mar 2020

  • CVE-2020-9054
    99Hemen

    ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    zyxel · nas326 firmware4 Mar 2020

  • CVE-2019-20499
    59Planlayın

    D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionalit

    YüksekCVSS 7,8SilahlaştırılmışEPSS %94

    dlink · dwl-2600ap firmware5 Mar 2020

  • CVE-2019-20500
    90Hemen

    D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality i

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %96

    dlink · dwl-2600ap firmware5 Mar 2020

  • CVE-2019-20501
    58Planlayın

    D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in

    YüksekCVSS 7,8Kavram kanıtıEPSS %89

    dlink · dwl-2600ap firmware5 Mar 2020

  • CVE-2020-10173
    58Planlayın

    Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and

    YüksekCVSS 8,8Kavram kanıtıEPSS %77

    comtrend · vr-3033 firmware5 Mar 2020

  • CVE-2020-9402
    42Planlayın

    Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter

    YüksekCVSS 8,8Kavram kanıtıEPSS %22

    djangoproject · django5 Mar 2020

  • CVE-2020-5405
    47Planlayın

    Directory Traversal with spring-cloud-config-server

    OrtaCVSS 6,5Kavram kanıtıEPSS %68

    vmware · spring cloud config5 Mar 2020

  • CVE-2020-10188
    61Bu hafta

    utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, becaus

    KritikCVSS 9,8İstismar yokEPSS %74

    netkit telnet project · netkit telnet6 Mar 2020

  • CVE-2020-10189
    99Hemen

    Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    zohocorp · manageengine desktop central6 Mar 2020

  • CVE-2020-10214
    40Planlayın

    An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices.

    YüksekCVSS 8,8İstismar yokEPSS %18

    dlink · dir-825 firmware6 Mar 2020

  • CVE-2020-10220
    69Bu hafta

    An issue was discovered in rConfig through 3.9.4.

    KritikCVSS 9,8SilahlaştırılmışEPSS %99

    rconfig · rconfig7 Mar 2020

  • CVE-2020-10221
    88Hemen

    lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacte

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %77

    rconfig · rconfig8 Mar 2020

  • CVE-2016-11021
    79Bu hafta

    setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand para

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %68

    dlink · dcs-930l firmware8 Mar 2020

  • CVE-2020-2140
    47Planlayın

    Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a refl

    OrtaCVSS 6,1Kavram kanıtıEPSS %75

    jenkins · audit trail9 Mar 2020

  • CVE-2017-10992
    42Planlayın

    In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS commands in a request t

    KritikCVSS 9,8İstismar yokEPSS %10

    hp · storage essentials10 Mar 2020

  • CVE-2019-19296
    28İzleyin

    A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0).

    OrtaCVSS 6,8İstismar yokEPSS %1

    siemens · sinvr 3 central control server10 Mar 2020

  • CVE-2020-0041
    62Bu hafta

    In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check.

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %3

    google · android10 Mar 2020

  • CVE-2020-0069
    61Bu hafta

    In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization a

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %1

    google · android10 Mar 2020

  • CVE-2020-6207
    98Hemen

    SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    sap · solution manager10 Mar 2020

  • CVE-2020-10181
    73Bu hafta

    goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (admini

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %14

    sumavision · enhanced multimedia router firmware11 Mar 2020

  • CVE-2020-8540
    43Planlayın

    An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated

    KritikCVSS 9,8İstismar yokEPSS %12

    zohocorp · manageengine desktop central11 Mar 2020

  • CVE-2020-1947
    49Planlayın

    In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs

    KritikCVSS 9,8Kavram kanıtıEPSS %33

    apache · shardingsphere11 Mar 2020

  • CVE-2020-10386
    32İzleyin

    admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading

    YüksekCVSS 7,2Kavram kanıtıEPSS %12

    chadhaajay · phpkb12 Mar 2020

  • CVE-2020-0787
    74Bu hafta

    An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic l

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %42

    microsoft · windows 10 150712 Mar 2020

  • CVE-2020-0816
    38İzleyin

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruptio

    YüksekCVSS 8,8İstismar yokEPSS %10

    microsoft · edge12 Mar 2020

  • CVE-2020-0825
    34İzleyin

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engin

    YüksekCVSS 7,5İstismar yokEPSS %13

    microsoft · edge12 Mar 2020

  • CVE-2020-0827
    34İzleyin

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engin

    YüksekCVSS 7,5İstismar yokEPSS %13

    microsoft · edge12 Mar 2020

  • CVE-2020-0851
    35İzleyin

    A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft W

    YüksekCVSS 7,8İstismar yokEPSS %11

    microsoft · office12 Mar 2020

  • CVE-2020-0852
    35İzleyin

    A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft W

    YüksekCVSS 7,8İstismar yokEPSS %11

    microsoft · office12 Mar 2020

  • CVE-2020-0855
    35İzleyin

    A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft W

    YüksekCVSS 7,8İstismar yokEPSS %11

    microsoft · office12 Mar 2020

  • CVE-2020-0872
    41Planlayın

    A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippet

    KritikCVSS 9,6İstismar yokEPSS %10

    microsoft · application inspector12 Mar 2020

  • CVE-2020-0881
    40Planlayın

    A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka

    YüksekCVSS 8,8İstismar yokEPSS %16

    microsoft · windows 1012 Mar 2020

  • CVE-2020-0883
    42Planlayın

    A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka

    YüksekCVSS 8,8İstismar yokEPSS %21

    microsoft · windows 1012 Mar 2020

  • CVE-2020-0892
    35İzleyin

    A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft W

    YüksekCVSS 7,8İstismar yokEPSS %11

    microsoft · office12 Mar 2020

  • CVE-2020-0905
    35İzleyin

    An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution V

    YüksekCVSS 8,0İstismar yokEPSS %10

    microsoft · dynamics 365 business central12 Mar 2020

  • CVE-2020-0796
    100Hemen

    A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain reque

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %99

    microsoft · windows 10 190312 Mar 2020

  • CVE-2020-10541
    42Planlayın

    Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request.

    KritikCVSS 9,8İstismar yokEPSS %10

    zohocorp · manageengine opmanager13 Mar 2020

  • CVE-2020-10567
    45Planlayın

    An issue was discovered in Responsive Filemanager through 9.14.0.

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    tecrail · responsive filemanager14 Mar 2020

  • CVE-2019-19208
    45Planlayın

    Codiad Web IDE through 2.8.4 allows PHP Code injection.

    KritikCVSS 9,8Kavram kanıtıEPSS %19

    codiad · codiad16 Mar 2020

  • CVE-2020-10230
    44Planlayın

    CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php t

    KritikCVSS 9,8Kavram kanıtıEPSS %15

    control-webpanel · webpanel16 Mar 2020

  • CVE-2020-6586
    27İzleyin

    Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page.

    OrtaCVSS 5,4İstismar yokEPSS %19

    nagios · nagios16 Mar 2020

  • CVE-2020-5844
    37İzleyin

    index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious P

    YüksekCVSS 7,2Kavram kanıtıEPSS %30

    artica · pandora fms16 Mar 2020

  • CVE-2020-5847
    98Hemen

    Unraid through 6.8.0 allows Remote Code Execution.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %95

    unraid · unraid16 Mar 2020

  • CVE-2020-5849
    88Hemen

    Unraid 6.8.0 allows authentication bypass.

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %93

    unraid · unraid16 Mar 2020

  • CVE-2020-3950
    63Bu hafta

    VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior b

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %7

    vmware · fusion17 Mar 2020

  • CVE-2020-8467
    68Bu hafta

    A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to e

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %10

    trendmicro · apex one17 Mar 2020

  • CVE-2020-8468
    67Bu hafta

    Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation esc

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %6

    trendmicro · apex one17 Mar 2020

  • CVE-2020-8598
    43Planlayın

    Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file t

    KritikCVSS 9,8İstismar yokEPSS %13

    trendmicro · apex one17 Mar 2020

  • CVE-2020-8599
    73Bu hafta

    Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary dat

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %11

    trendmicro · apex one17 Mar 2020

  • CVE-2019-16012
    48Planlayın

    Cisco SD-WAN Solution vManage SQL Injection Vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %54

    cisco · sd-wan firmware19 Mar 2020

  • CVE-2019-16072
    47Planlayın

    An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to exec

    KritikCVSS 9,8Kavram kanıtıEPSS %25

    netsas · enigma network management solution19 Mar 2020

  • CVE-2020-9425
    36İzleyin

    An issue was discovered in includes/head.inc.php in rConfig before 3.9.4.

    YüksekCVSS 7,5Kavram kanıtıEPSS %19

    rconfig · rconfig20 Mar 2020

  • CVE-2020-7961
    99Hemen

    Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web ser

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    liferay · liferay portal20 Mar 2020

  • CVE-2020-8878
    38İzleyin

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916.

    YüksekCVSS 8,8İstismar yokEPSS %11

    foxitsoftware · foxit studio photo20 Mar 2020

  • CVE-2020-8880
    38İzleyin

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916.

    YüksekCVSS 8,8İstismar yokEPSS %11

    foxitsoftware · foxit studio photo20 Mar 2020

  • CVE-2020-8881
    38İzleyin

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916.

    YüksekCVSS 8,8İstismar yokEPSS %11

    foxitsoftware · foxit studio photo20 Mar 2020

  • CVE-2020-8882
    38İzleyin

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916.

    YüksekCVSS 8,8İstismar yokEPSS %11

    foxitsoftware · foxit studio photo20 Mar 2020

  • CVE-2020-10808
    58Planlayın

    Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint.

    YüksekCVSS 8,8SilahlaştırılmışEPSS %77

    vestacp · vesta control panel22 Mar 2020

  • CVE-2020-10819
    40Planlayın

    Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.

    OrtaCVSS 4,8İstismar yokEPSS %71

    nagios · nagios xi22 Mar 2020

  • CVE-2020-10820
    25İzleyin

    Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.

    OrtaCVSS 4,8İstismar yokEPSS %19

    nagios · nagios xi22 Mar 2020

  • CVE-2020-10821
    40Planlayın

    Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.

    OrtaCVSS 4,8İstismar yokEPSS %71

    nagios · nagios xi22 Mar 2020

  • CVE-2020-5722
    94Hemen

    The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %84

    grandstream · ucm6200 firmware23 Mar 2020

  • CVE-2020-8863
    58Planlayın

    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-

    YüksekCVSS 8,8İstismar yokEPSS %76

    dlink · dir-878 firmware23 Mar 2020

  • CVE-2020-8864
    59Planlayın

    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-

    YüksekCVSS 8,8İstismar yokEPSS %80

    dlink · dir-878 firmware23 Mar 2020

  • CVE-2020-10879
    64Bu hafta

    rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is pas

    KritikCVSS 9,8Kavram kanıtıEPSS %83

    rconfig · rconfig23 Mar 2020

  • CVE-2020-10931
    38İzleyin

    Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try

    YüksekCVSS 7,5İstismar yokEPSS %28

    memcached · memcached24 Mar 2020

  • CVE-2020-9375
    38İzleyin

    TP-Link Archer C50 V3 devices before Build 200318 Rel.

    YüksekCVSS 7,5Kavram kanıtıEPSS %26

    tp-link · archer c5025 Mar 2020

  • CVE-2020-1957
    46Planlayın

    Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication

    KritikCVSS 9,8İstismar yokEPSS %23

    apache · shiro25 Mar 2020

  • CVE-2020-10882
    47Planlayın

    This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver:

    YüksekCVSS 8,8SilahlaştırılmışEPSS %41

    tp-link · ac1750 firmware25 Mar 2020

  • CVE-2020-10883
    33İzleyin

    This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750

    YüksekCVSS 7,8SilahlaştırılmışEPSS %5

    tp-link · ac1750 firmware25 Mar 2020

  • CVE-2020-10884
    42Planlayın

    This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190

    YüksekCVSS 8,8SilahlaştırılmışEPSS %21

    tp-link · ac1750 firmware25 Mar 2020

  • CVE-2020-10963
    32İzleyin

    FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_imag

    YüksekCVSS 7,2Kavram kanıtıEPSS %14

    frozennode · laravel-administrator25 Mar 2020

  • CVE-2020-10826
    51Planlayın

    /cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injecti

    KritikCVSS 9,8İstismar yokEPSS %39

    draytek · vigor300b firmware26 Mar 2020

  • CVE-2020-10827
    45Planlayın

    A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve

    KritikCVSS 9,8İstismar yokEPSS %20

    draytek · vigor300b firmware26 Mar 2020

  • CVE-2020-10828
    45Planlayın

    A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve

    KritikCVSS 9,8İstismar yokEPSS %20

    draytek · vigor300b firmware26 Mar 2020

  • CVE-2020-9467
    28İzleyin

    Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.

    OrtaCVSS 5,4Kavram kanıtıEPSS %23

    piwigo · piwigo26 Mar 2020

  • CVE-2020-8509
    33İzleyin

    Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive informat

    YüksekCVSS 7,5İstismar yokEPSS %10

    zohocorp · manageengine desktop central30 Mar 2020

  • CVE-2020-5723
    41Planlayın

    The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database.

    KritikCVSS 9,8SilahlaştırılmışEPSS %5

    grandstream · ucm6202 firmware30 Mar 2020

  • CVE-2020-5724
    34İzleyin

    The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint.

    YüksekCVSS 7,5SilahlaştırılmışEPSS %12

    grandstream · ucm6202 firmware30 Mar 2020

  • CVE-2020-11105
    40Planlayın

    An issue was discovered in USC iLab cereal through 1.3.0.

    KritikCVSS 9,8İstismar yokEPSS %2

    usc · cereal30 Mar 2020

  • CVE-2020-5284
    30İzleyin

    Directory Traversal in Next.js versions below 9.3.2

    OrtaCVSS 4,3Kavram kanıtıEPSS %44

    zeit · next.js30 Mar 2020

  • CVE-2020-4241
    55Planlayın

    IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary comm

    YüksekCVSS 8,8İstismar yokEPSS %66

    ibm · spectrum protect plus31 Mar 2020

  • CVE-2020-5291
    31İzleyin

    Privilege escalation in setuid mode via user namespaces in Bubblewrap

    YüksekCVSS 7,8İstismar yokEPSS %0

    projectatomic · bubblewrap31 Mar 2020