Filtered by CWE-668
Filtered by vendor Subscriptions
Total 648 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-13470 1 Gigadevice 4 Gd32f103, Gd32f103 Firmware, Gd32f130 and 1 more 2024-11-21 4.6 Medium
Gigadevice GD32F103 and GD32F130 devices allow physical attackers to extract data via the probing of easily accessible bonding wires and de-obfuscation of the observed data.
CVE-2020-13469 1 Gigadevice 2 Gd32vf103, Gd32vf103 Firmware 2024-11-21 4.6 Medium
The flash memory readout protection in Gigadevice GD32VF103 devices allows physical attackers to extract firmware via the debug interface by utilizing the CPU.
CVE-2020-13343 1 Gitlab 1 Gitlab 2024-11-21 7.5 High
An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Project Template
CVE-2020-13240 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 5.4 Medium
The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.
CVE-2020-12687 1 Serpico Project 1 Serpico 2024-11-21 6.5 Medium
An issue was discovered in Serpico before 1.3.3. The /admin/attacments_backup endpoint can be requested by non-admin authenticated users. This means that an attacker with a user account can retrieve all of the attachments of all users (including administrators) from the database.
CVE-2020-12488 1 Vivo 1 Jovi Smart Scene 2024-11-21 5.5 Medium
The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permission.
CVE-2020-12142 2 Arubanetworks, Silver-peak 44 Nx-1000, Nx-10k, Nx-11k and 41 more 2024-11-21 4.8 Medium
1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.
CVE-2020-12020 1 Baxter 4 Em1200, Em1200 Firmware, Em2400 and 1 more 2024-11-21 6.1 Medium
Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining access to the operating system and editing the application startup script. Successful exploitation of this vulnerability may allow an attacker to alter the startup script as the limited-access user.
CVE-2020-11934 1 Canonical 1 Ubuntu Linux 2024-11-21 5.9 Medium
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.
CVE-2020-11931 2 Canonical, Pulseaudio 2 Ubuntu Linux, Pulseaudio 2024-11-21 3.3 Low
An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;
CVE-2020-11610 1 Cross Domain Local Storage Project 1 Cross Domain Local Storage 2024-11-21 8.8 High
An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.
CVE-2020-11582 4 Apple, Linux, Oracle and 1 more 5 Macos, Linux Kernel, Solaris and 2 more 2024-11-21 8.8 High
An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, launches a TCP server that accepts local connections on a random port. This can be reached by local HTTP clients, because up to 25 invalid lines are ignored, and because DNS rebinding can occur. (This server accepts, for example, a setcookie command that might be relevant to CVE-2020-11581 exploitation.)
CVE-2020-11303 1 Qualcomm 182 Apq8009, Apq8009 Firmware, Apq8053 and 179 more 2024-11-21 8.6 High
Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVE-2020-10867 2 Avast, Microsoft 2 Antivirus, Windows 2024-11-21 9.8 Critical
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to bypass intended access restrictions on tasks from an untrusted process, when Self Defense is enabled.
CVE-2020-10581 1 Invigo 1 Automatic Device Management 2024-11-21 7.5 High
Multiple session validity check issues in several administration functionalities of Invigo Automatic Device Management (ADM) through 5.0 allow remote attackers to read potentially sensitive data hosted by the application.
CVE-2020-10271 4 Aliasrobotics, Enabled-robotics, Mobile-industrial-robotics and 1 more 20 Mir100, Mir1000, Mir1000 Firmware and 17 more 2024-11-21 9.8 Critical
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph to all network interfaces, wireless and wired. This is the result of a bad set up and can be mitigated by appropriately configuring ROS and/or applying custom patches as appropriate. Currently, the ROS computational graph can be accessed fully from the wired exposed ports. In combination with other flaws such as CVE-2020-10269, the computation graph can also be fetched and interacted from wireless networks. This allows a malicious operator to take control of the ROS logic and correspondingly, the complete robot given that MiR's operations are centered around the framework (ROS).
CVE-2020-10238 1 Joomla 1 Joomla\! 2024-11-21 7.5 High
An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading to various potential attack vectors.
CVE-2019-9475 1 Google 1 Android 2024-11-21 5.5 Medium
In /proc/net of the kernel filesystem, there is a possible information leak due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-9496886
CVE-2019-9186 1 Jetbrains 1 Intellij Idea 2024-11-21 N/A
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7.
CVE-2019-9011 1 Pilz 1 Pmc 2024-11-21 5.3 Medium
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.