Security Vulnerabilities - CVEs Published In 2020
An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.
CVSS Score
8.8
EPSS Score
0.011
Published
2020-08-27
An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.
CVSS Score
6.1
EPSS Score
0.008
Published
2020-08-27
A vulnerability in the Protocol Independent Multicast (PIM) feature for IPv6 networks (PIM6) of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper error handling when processing inbound PIM6 packets. An attacker could exploit this vulnerability by sending multiple crafted PIM6 packets to an affected device. A successful exploit could allow the attacker to cause the PIM6 application to leak system memory. Over time, this memory leak could cause the PIM6 application to stop processing legitimate PIM6 traffic, leading to a DoS condition on the affected device.
CVSS Score
7.5
EPSS Score
0.018
Published
2020-08-27
oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.
CVSS Score
3.3
EPSS Score
0.005
Published
2020-08-27
On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software.
CVSS Score
3.5
EPSS Score
0.008
Published
2020-08-27
13enforme CMS 1.0 has SQL Injection via the 'content.php' id parameter.
CVSS Score
9.8
EPSS Score
0.019
Published
2020-08-27
13enforme CMS 1.0 has Cross Site Scripting via the "content.php" id parameter.
CVSS Score
6.1
EPSS Score
0.008
Published
2020-08-27
DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php'
CVSS Score
6.1
EPSS Score
0.005
Published
2020-08-27
Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags.
CVSS Score
5.4
EPSS Score
0.006
Published
2020-08-27
Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags.
CVSS Score
5.4
EPSS Score
0.006
Published
2020-08-27