Security Vulnerabilities - CVEs Published In 2020
All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.
CVSS Score
9.8
EPSS Score
0.019
Published
2020-08-17
Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access.
CVSS Score
8.8
EPSS Score
0.053
Published
2020-08-17
IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to. IBM X-Force ID: 186678.
CVSS Score
6.8
EPSS Score
0.016
Published
2020-08-17
php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.
CVSS Score
6.5
EPSS Score
0.01
Published
2020-08-16
SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec.
CVSS Score
9.8
EPSS Score
0.021
Published
2020-08-16
Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000.
CVSS Score
7.5
EPSS Score
0.009
Published
2020-08-14
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by impersonating the server.
CVSS Score
5.9
EPSS Score
0.007
Published
2020-08-14
A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database.
CVSS Score
9.8
EPSS Score
0.012
Published
2020-08-14
In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.
CVSS Score
5.3
EPSS Score
0.008
Published
2020-08-14
In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.
CVSS Score
9.8
EPSS Score
0.042
Published
2020-08-14