|
196361
|
9.8 |
CRITICAL
Network
|
iteris
|
vantage_velocity_firmware
|
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (User bluetooth, password bluetooth; User eclipse, password ec…
|
CWE-521
Weak Password Requirements
|
CVE-2020-9023
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196362
|
6.1 |
MEDIUM
Network
|
cambiumnetworks
|
xh2-120_firmware xr2436_firmware xr520_firmware xr620_firmware
|
An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS.
|
CWE-79
Cross-site Scripting
|
CVE-2020-9022
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196363
|
9.8 |
CRITICAL
Network
|
postoaktraffic
|
awam_bluetooth_field_device_firmware
|
Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to injections of operating system commands through timeconfig.p…
|
CWE-78
OS Command
|
CVE-2020-9021
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196364
|
9.8 |
CRITICAL
Network
|
iteris
|
vantage_velocity_firmware
|
Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field.
|
CWE-78
OS Command
|
CVE-2020-9020
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196365
|
7.5 |
HIGH
Network
|
microchip
|
syncserver_s100_firmware syncserver_s200_firmware syncserver_s250_firmware syncserver_s300_firmware syncserver_s350_firmware
|
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to unauthenticated creation, modification, or elimination of us…
|
NVD-CWE-noinfo
|
CVE-2020-9034
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196366
|
5.4 |
MEDIUM
Network
|
dolibarr
|
dolibarr_erp\/crm
|
Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.
|
CWE-79
Cross-site Scripting
|
CVE-2020-9016
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196367
|
4.3 |
MEDIUM
Network
|
arvato
|
skillpipe
|
Arvato Skillpipe 3.0 allows attackers to bypass intended print restrictions by deleting <div id="watermark"> from the HTML source code.
|
CWE-20
Improper Input Validation
|
CVE-2020-9013
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196368
|
6.1 |
MEDIUM
Network
|
gluu
|
gluu_server
|
A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parame…
|
CWE-79
Cross-site Scripting
|
CVE-2020-9012
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196369
|
5.4 |
MEDIUM
Network
|
codologic
|
codoforum
|
Codoforum 4.8.8 allows self-XSS via the title of a new topic.
|
CWE-79
Cross-site Scripting
|
CVE-2020-9007
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
196370
|
8.8 |
HIGH
Adjacent
|
abbott
|
freestyle_libre_firmware
|
Older generation Abbott FreeStyle Libre sensors allow remote attackers within close proximity to enable write access to memory via a specific NFC unlock command. NOTE: The vulnerability is not presen…
|
CWE-787
Out-of-bounds Write
|
CVE-2020-8997
|
2024-11-21 14:39 |
2020-02-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|