Security Vulnerabilities - CVEs Published In 2020
Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory.
CVSS Score
6.8
EPSS Score
0.258
Published
2020-08-21
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.
CVSS Score
9.1
EPSS Score
0.013
Published
2020-08-21
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.
CVSS Score
6.5
EPSS Score
0.01
Published
2020-08-21
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.
CVSS Score
9.1
EPSS Score
0.263
Published
2020-08-21
The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying.
CVSS Score
8.1
EPSS Score
0.007
Published
2020-08-21
Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
CVSS Score
6.5
EPSS Score
0.016
Published
2020-08-21
An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shell.
CVSS Score
7.3
EPSS Score
0.004
Published
2020-08-21
An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values.
CVSS Score
4.1
EPSS Score
0.011
Published
2020-08-21
A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution.
CVSS Score
6.3
EPSS Score
0.004
Published
2020-08-21
A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code execution
CVSS Score
6.3
EPSS Score
0.004
Published
2020-08-21