Security Vulnerabilities - CVEs Published In 2020
An issue was discovered on Nescomed Multipara Monitor M1000 devices. The internal storage of the underlying Linux system stores data in cleartext, without integrity protection against tampering.
CVSS Score
7.5
EPSS Score
0.008
Published
2020-08-26
HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..
CVSS Score
8.2
EPSS Score
0.015
Published
2020-08-26
HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.
CVSS Score
8.2
EPSS Score
0.028
Published
2020-08-26
In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow current best coding practices and may overwrite arbitrary files.
CVSS Score
7.1
EPSS Score
0.003
Published
2020-08-26
Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1.
CVSS Score
9.8
EPSS Score
0.023
Published
2020-08-26
HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.
CVSS Score
9.6
EPSS Score
0.04
Published
2020-08-26
Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser.
CVSS Score
5.4
EPSS Score
0.005
Published
2020-08-26
Umanni RH 1.0 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page.
CVSS Score
9.8
EPSS Score
0.016
Published
2020-08-26
Umanni RH 1.0 has a user enumeration vulnerability. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
CVSS Score
5.3
EPSS Score
0.009
Published
2020-08-26
Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database.
CVSS Score
7.5
EPSS Score
0.02
Published
2020-08-26