|
211231
|
7.8 |
HIGH
Local
|
pi-hole
|
pi-hole
|
An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root …
|
CWE-78
CWE-269
OS Command
Improper Privilege Management
|
CVE-2020-14162
|
2024-11-21 14:02 |
2020-07-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211232
|
9.1 |
CRITICAL
Network
|
abus
|
secvest_hybrid_fumo50110_firmware
|
The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that are exchanged with an alarm panel. This makes it easier to c…
|
CWE-287
Improper Authentication
|
CVE-2020-14158
|
2024-11-21 14:02 |
2020-07-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211233
|
6.7 |
MEDIUM
Local
|
gnu
opensuse
|
grub2
leap
|
There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic ov…
|
CWE-787
CWE-190
Out-of-bounds Write
Integer Overflow or Wraparound
|
CVE-2020-14309
|
2024-11-21 14:02 |
2020-07-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211234
|
6.4 |
MEDIUM
Local
|
gnu
opensuse
|
grub2
leap
|
In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations …
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2020-14308
|
2024-11-21 14:02 |
2020-07-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211235
|
9.9 |
CRITICAL
Network
|
kubevirt
redhat
|
kubevirt
openshift_virtualization
|
A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privilege…
|
NVD-CWE-noinfo
|
CVE-2020-14316
|
2024-11-21 14:02 |
2020-07-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211236
|
7.5 |
HIGH
Network
|
shopware
|
shopware
|
In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.
|
CWE-209
Information Exposure Through an Error Message
|
CVE-2020-13997
|
2024-11-21 14:02 |
2020-07-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211237
|
5.4 |
MEDIUM
Network
|
shopware
|
shopware
|
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be…
|
CWE-79
Cross-site Scripting
|
CVE-2020-13971
|
2024-11-21 14:02 |
2020-07-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211238
|
8.8 |
HIGH
Network
|
shopware
|
shopware
|
Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests …
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2020-13970
|
2024-11-21 14:02 |
2020-07-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211239
|
9.8 |
CRITICAL
Network
|
ruckuswireless
|
unleashed_firmware
|
emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to achieve command injection via a crafted HTTP request. This affects C110, E510, H320, H510, M510, R320, R31…
|
CWE-77
Command Injection
|
CVE-2020-13919
|
2024-11-21 14:02 |
2020-07-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
211240
|
7.5 |
HIGH
Network
|
ruckuswireless
|
unleashed_firmware
|
Incorrect access control in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to leak system information (that can be used for a jailbreak) via an unauthenticated cra…
|
NVD-CWE-noinfo
|
CVE-2020-13918
|
2024-11-21 14:02 |
2020-07-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
