|
210031
|
7.5 |
HIGH
Network
|
etherpad
|
etherpad
|
Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting random pad import endpoints with empty data would flatten all pads due to lack of ra…
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2020-22785
|
2024-11-21 14:13 |
2021-04-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210032
|
7.5 |
HIGH
Network
|
etherpad
|
ueberdb
|
In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing acce…
|
CWE-697
Incorrect Comparison
|
CVE-2020-22784
|
2024-11-21 14:13 |
2021-04-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210033
|
6.5 |
MEDIUM
Network
|
etherpad
|
etherpad
|
Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad.
|
CWE-312
Cleartext Storage of Sensitive Information
|
CVE-2020-22783
|
2024-11-21 14:13 |
2021-04-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210034
|
7.5 |
HIGH
Network
|
etherpad
|
etherpad
|
Etherpad < 1.8.3 is affected by a denial of service in the import functionality. Upload of binary file to the import endpoint would crash the instance.
|
NVD-CWE-noinfo
|
CVE-2020-22782
|
2024-11-21 14:13 |
2021-04-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210035
|
7.5 |
HIGH
Network
|
etherpad
|
etherpad
|
In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denial of service (crash the instance).
|
CWE-89
SQL Injection
|
CVE-2020-22781
|
2024-11-21 14:13 |
2021-04-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210036
|
9.8 |
CRITICAL
Network
|
homeautomation_project
|
homeautomation
|
HomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP address using the X-Forwarded-For header with the local (loopback) IP address value allowing remote co…
|
CWE-290
Authentication Bypass by Spoofing
|
CVE-2020-22001
|
2024-11-21 14:13 |
2021-04-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210037
|
8.0 |
HIGH
Network
|
homeautomation_project
|
homeautomation
|
HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell comm…
|
CWE-352 CWE-78
Origin Validation Error OS Command
|
CVE-2020-22000
|
2024-11-21 14:13 |
2021-04-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210038
|
7.5 |
HIGH
Network
|
realtek
|
rtl8723de_firmware
|
An issue was discovered in Realtek rtl8723de BLE Stack <= 4.1 that allows remote attackers to cause a Denial of Service via the interval field to the CONNECT_REQ message.
|
CWE-476
NULL Pointer Dereference
|
CVE-2020-23539
|
2024-11-21 14:13 |
2021-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210039
|
9.8 |
CRITICAL
Network
|
zzcms
|
zzcms
|
zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attacks such as CSRF.
|
CWE-352
Origin Validation Error
|
CVE-2020-23426
|
2024-11-21 14:13 |
2021-04-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210040
|
7.5 |
HIGH
Network
|
unionpayintl
|
union_pay
|
Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile a…
|
CWE-347
Improper Verification of Cryptographic Signature
|
CVE-2020-23533
|
2024-11-21 14:13 |
2021-04-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|