|
198641
|
4.8 |
MEDIUM
Network
|
cxuu
|
cxuucms
|
CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add.
|
CWE-79
Cross-site Scripting
|
CVE-2020-35346
|
2024-11-21 14:27 |
2020-12-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198642
|
7.5 |
HIGH
Network
|
rockoa
|
xinhu
|
rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true.
|
NVD-CWE-noinfo
|
CVE-2020-35388
|
2024-11-21 14:27 |
2020-12-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198643
|
9.8 |
CRITICAL
Network
|
tp-link
|
wa901nd_firmware
archer_c5_firmware
archer_c7_firmware
mr3420_firmware
mr6400_firmware
wa701nd_firmware
wa801nd_firmware
wdr3500_firmware
wdr3600_firmware
we843n_firmware
A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201…
|
NVD-CWE-noinfo
|
CVE-2020-35575
|
2024-11-21 14:27 |
2020-12-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
|
198644
|
7.5 |
HIGH
Network
|
linksys
|
re6500_firmware
|
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to cause a persistent denial of service (segmentation fault) via a long /goform/langSwitch langSelectionOnly parameter.
|
NVD-CWE-noinfo
|
CVE-2020-35716
|
2024-11-21 14:27 |
2020-12-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198645
|
8.8 |
HIGH
Network
|
linksys
|
re6500_firmware
|
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the upload_settings.cgi page.
|
CWE-78
OS Command
|
CVE-2020-35715
|
2024-11-21 14:27 |
2020-12-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198646
|
8.8 |
HIGH
Network
|
linksys
|
re6500_firmware
|
Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program.
|
CWE-78
OS Command
|
CVE-2020-35714
|
2024-11-21 14:27 |
2020-12-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198647
|
9.8 |
CRITICAL
Network
|
linksys
|
re6500_firmware
|
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.
|
CWE-78
OS Command
|
CVE-2020-35713
|
2024-11-21 14:27 |
2020-12-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198648
|
9.8 |
CRITICAL
Network
|
esri
|
arcgis_server
|
Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2020-35712
|
2024-11-21 14:27 |
2020-12-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198649
|
7.5 |
HIGH
Network
|
arc-swap_project
|
arc-swap
|
An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of …
|
NVD-CWE-noinfo
|
CVE-2020-35711
|
2024-11-21 14:27 |
2020-12-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
198650
|
5.3 |
MEDIUM
Network
|
parallels
|
remote_application_server
|
Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the…
|
CWE-200
Information Exposure
|
CVE-2020-35710
|
2024-11-21 14:27 |
2020-12-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
