Security Vulnerabilities - CVEs Published In 2020
Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system information due to insufficient output sanitization.
CVSS Score
5.3
EPSS Score
0.009
Published
2020-09-25
Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials due to improper input validation.
CVSS Score
7.2
EPSS Score
0.011
Published
2020-09-25
Mitel MiCloud Management Portal before 6.1 SP5 could allow an unauthenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session.
CVSS Score
9.6
EPSS Score
0.017
Published
2020-09-25
Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to retrieve sensitive information due to insufficient access control.
CVSS Score
5.3
EPSS Score
0.009
Published
2020-09-25
Pexip Infinity before 24.1 has Improper Input Validation, leading to temporary denial of service via SIP.
CVSS Score
5.3
EPSS Score
0.01
Published
2020-09-25
A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed.
CVSS Score
8.8
EPSS Score
0.032
Published
2020-09-25
The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session.
CVSS Score
7.1
EPSS Score
0.004
Published
2020-09-25
bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying VMCS_HOST_RIP.
CVSS Score
8.2
EPSS Score
0.006
Published
2020-09-25
The Framer Preview application 12 for Android exposes com.framer.viewer.FramerViewActivity to other applications. By calling the intent with the action set to android.intent.action.VIEW, any other application is able to load any website/web content into the application's context, which is shown as a full-screen overlay to the user.
CVSS Score
5.5
EPSS Score
0.005
Published
2020-09-25
CVE-2020-25223
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
Known exploited
CVSS Score
9.8
EPSS Score
0.968
Published
2020-09-25