|
198831
|
6.5 |
MEDIUM
Network
|
microchip
|
syncserver_s100_firmware
syncserver_s200_firmware
syncserver_s250_firmware
syncserver_s300_firmware
syncserver_s350_firmware
|
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName parameter to messagelog.php.
|
CWE-22
Path Traversal
|
CVE-2020-9029
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198832
|
6.1 |
MEDIUM
Network
|
microchip
|
syncserver_s100_firmware
syncserver_s200_firmware
syncserver_s250_firmware
syncserver_s300_firmware
syncserver_s350_firmware
|
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenan…
|
CWE-79
Cross-site Scripting
|
CVE-2020-9028
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198833
|
9.8 |
CRITICAL
Network
|
eltex-co
|
ntp-2_firmware
ntp-rg-1402g_firmware
|
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected.
|
CWE-78
OS Command
|
CVE-2020-9027
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198834
|
9.8 |
CRITICAL
Network
|
eltex-co
|
ntp-2_firmware
ntp-rg-1402g_firmware
|
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected.
|
CWE-78
OS Command
|
CVE-2020-9026
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198835
|
6.1 |
MEDIUM
Network
|
iteris
|
vantage_velocity_firmware
|
Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script.
|
CWE-79
Cross-site Scripting
|
CVE-2020-9025
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198836
|
9.8 |
CRITICAL
Network
|
iteris
|
vantage_velocity_firmware
|
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadperl.sh (executed as root at boot time)…
|
CWE-732
Incorrect Permission Assignment for Critical Resource
|
CVE-2020-9024
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198837
|
9.8 |
CRITICAL
Network
|
iteris
|
vantage_velocity_firmware
|
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (User bluetooth, password bluetooth; User eclipse, password ec…
|
CWE-521
Weak Password Requirements
|
CVE-2020-9023
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198838
|
6.1 |
MEDIUM
Network
|
cambiumnetworks
|
xh2-120_firmware
xr2436_firmware
xr520_firmware
xr620_firmware
|
An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS.
|
CWE-79
Cross-site Scripting
|
CVE-2020-9022
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198839
|
9.8 |
CRITICAL
Network
|
postoaktraffic
|
awam_bluetooth_field_device_firmware
|
Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to injections of operating system commands through timeconfig.p…
|
CWE-78
OS Command
|
CVE-2020-9021
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198840
|
9.8 |
CRITICAL
Network
|
iteris
|
vantage_velocity_firmware
|
Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field.
|
CWE-78
OS Command
|
CVE-2020-9020
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
