Security Vulnerabilities - CVEs Published In 2020
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
CVSS Score
7.5
EPSS Score
0.022
Published
2020-09-30
BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link.
CVSS Score
8.8
EPSS Score
0.015
Published
2020-09-30
An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php
CVSS Score
9.8
EPSS Score
0.028
Published
2020-09-30
An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php
CVSS Score
9.8
EPSS Score
0.012
Published
2020-09-30
An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php
CVSS Score
6.1
EPSS Score
0.007
Published
2020-09-30
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
CVSS Score
6.5
EPSS Score
0.023
Published
2020-09-30
md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial of service (e.g., assertion failure) via a malformed Markdown document.
CVSS Score
7.5
EPSS Score
0.014
Published
2020-09-30
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the knximport component via an advanced attack vector, allowing logged in attackers to discover arbitrary information.
CVSS Score
4.3
EPSS Score
0.007
Published
2020-09-30
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with resultant SSRF) in the com_mb24proxy module, allowing attackers to steal session information from logged-in users with a crafted link.
CVSS Score
6.5
EPSS Score
0.005
Published
2020-09-30
An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the persistent state of a private framework.
CVSS Score
5.7
EPSS Score
0.003
Published
2020-09-30