Security Vulnerabilities - CVEs Published In 2020
Improper access control in Citrix XenMobile Server 10.12 before RP3, Citrix XenMobile Server 10.11 before RP6, Citrix XenMobile Server 10.10 RP6 and Citrix XenMobile Server before 10.9 RP5 allows access to privileged functionality.
CVSS Score
9.8
EPSS Score
0.016
Published
2020-08-17
A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.
CVSS Score
5.8
EPSS Score
0.01
Published
2020-08-17
A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in for windows allowed to corrupt memory.
CVSS Score
5.5
EPSS Score
0.004
Published
2020-08-17
An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.
CVSS Score
6.5
EPSS Score
0.017
Published
2020-08-17
A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.
CVSS Score
8.8
EPSS Score
0.044
Published
2020-08-17
FusionCompute 8.0.0 have an insufficient authentication vulnerability. An attacker may exploit the vulnerability to delete some files and cause some services abnormal.
CVSS Score
9.1
EPSS Score
0.008
Published
2020-08-17
All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.
CVSS Score
9.8
EPSS Score
0.019
Published
2020-08-17
HUAWEI Mate 20 smartphones with 9.0.0.205(C00E205R2P1) have a logic error vulnerability. In a special scenario, the system does not properly process. As a result, attackers can perform a series of operations to successfully establish P2P connections that are rejected by the peer end. As a result, the availability of the device is affected.
CVSS Score
4.6
EPSS Score
0.002
Published
2020-08-17
FusionCompute 8.0.0 have a command injection vulnerability. The software does not sufficiently validate certain parameters post from user, successful exploit could allow an authenticated attacker to launch a command injection attack.
CVSS Score
8.8
EPSS Score
0.013
Published
2020-08-17
An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xp_cmdshell stored procedure.
CVSS Score
9.8
EPSS Score
0.034
Published
2020-08-17