|
208371
|
8.8 |
HIGH
Network
|
vfairs
|
vfairs
|
vFairs 3.3 is affected by Remote Code Execution. Any user logged in to a vFairs virtual conference or event can abuse the functionality to upload a profile picture in order to place a malicious PHP f…
|
CWE-434
Unrestricted Upload of File with Dangerous Type
|
CVE-2020-26678
|
2024-11-21 14:20 |
2021-05-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208372
|
8.8 |
HIGH
Network
|
vfairs
|
vfairs
|
Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the API.
|
CWE-89
SQL Injection
|
CVE-2020-26677
|
2024-11-21 14:20 |
2021-05-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208373
|
8.1 |
HIGH
Adjacent
|
bluetooth
|
mesh_profile
|
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner, to complete authentication without posse…
|
CWE-863
Incorrect Authorization
|
CVE-2020-26560
|
2024-11-21 14:20 |
2021-05-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208374
|
8.8 |
HIGH
Adjacent
|
bluetooth
|
mesh_profile
|
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the AuthValue used given the Provisioner’s …
|
CWE-863
Incorrect Authorization
|
CVE-2020-26559
|
2024-11-21 14:20 |
2021-05-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208375
|
4.2 |
MEDIUM
Adjacent
|
bluetooth fedoraproject debian linux intel
|
bluetooth_core_specification fedora debian_linux linux_kernel ax210_firmware ax201_firmware ax200_firmware ac_9560_firmware ac_9462_firmware ac_9461_firmware ac_9260_fir…
|
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authe…
|
CWE-287
Improper Authentication
|
CVE-2020-26558
|
2024-11-21 14:20 |
2021-05-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208376
|
7.5 |
HIGH
Adjacent
|
bluetooth
|
mesh_profile
|
Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol) to determine the AuthValue via a brute…
|
CWE-287
Improper Authentication
|
CVE-2020-26557
|
2024-11-21 14:20 |
2021-05-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208377
|
7.5 |
HIGH
Adjacent
|
bluetooth
|
mesh_profile bluetooth_core_specification
|
Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning…
|
CWE-307
mproper Restriction of Excessive Authentication Attempts
|
CVE-2020-26556
|
2024-11-21 14:20 |
2021-05-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208378
|
5.4 |
MEDIUM
Adjacent
|
bluetooth fedoraproject intel
|
bluetooth_core_specification fedora ax210_firmware ax201_firmware ax200_firmware ac_9560_firmware ac_9462_firmware ac_9461_firmware ac_9260_firmware ac_8265_firmware ac_…
|
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing witho…
|
CWE-863
Incorrect Authorization
|
CVE-2020-26555
|
2024-11-21 14:20 |
2021-05-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208379
|
5.7 |
MEDIUM
Physics
|
nordicsemi
|
nrf52840_firmware
|
Nordic Semiconductor nRF52840 devices through 2020-10-19 have improper protection against physical side channels. The flash read-out protection (APPROTECT) can be bypassed by injecting a fault during…
|
CWE-203
Information Exposure Through Discrepancy
|
CVE-2020-27211
|
2024-11-21 14:20 |
2021-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208380
|
7.0 |
HIGH
Local
|
st
|
stm32cubel4_firmware
|
STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP) can be degraded from RDP level 2 (no access via debug interface) to level 1 (l…
|
CWE-74
Injection
|
CVE-2020-27212
|
2024-11-21 14:20 |
2021-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|