Filtered by CWE-306
Filtered by vendor Subscriptions
Total 1344 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-35191 1 Drupal 1 Drupal Docker Images 2024-11-21 9.8 Critical
The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVE-2020-35190 1 Plone 1 Plone 2024-11-21 9.8 Critical
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVE-2020-35189 1 Kong 1 Kong Alpine Docker Image 2024-11-21 9.8 Critical
The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. System using the kong docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVE-2020-35187 1 Influxdata 1 Telegraf 2024-11-21 9.8 Critical
The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. System using the telegraf docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVE-2020-35186 1 Docker 1 Adminer 2024-11-21 9.8 Critical
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVE-2020-35185 1 Docker 1 Ghost Alpine Docker Image 2024-11-21 9.8 Critical
The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVE-2020-35184 1 Docker 1 Composer Docker Image 2024-11-21 9.8 Critical
The official composer docker images before 1.8.3 contain a blank password for a root user. System using the composer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
CVE-2020-2076 1 Sick 1 Package Analytics 2024-11-21 9.8 Critical
SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write files without authentication.
CVE-2020-29551 1 Urve 1 Urve 2024-11-21 9.1 Critical
An issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown the system. Among others, the following files and scripts are also accessible: _internal/pc/abort.php, _internal/pc/restart.php, _internal/pc/vpro.php, _internal/pc/wake.php, _internal/error_u201409.txt, _internal/runcmd.php, _internal/getConfiguration.php, ews/autoload.php, ews/del.php, ews/mod.php, ews/sync.php, utils/backup/backup_server.php, utils/backup/restore_server.php, MyScreens/timeline.config, kreator.html5/test.php, and addedlogs.txt.
CVE-2020-29389 1 Docker 1 Crux Linux Docker Image 2024-11-21 9.8 Critical
The official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user. System using the Crux Linux Docker container deployed by affected versions of the Docker image may allow an attacker to achieve root access with a blank password.
CVE-2020-29379 1 Vsolcn 4 V1600d-mini, V1600d-mini Firmware, V1600d4l and 1 more 2024-11-21 5.5 Medium
An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access.
CVE-2020-29311 1 Ubilling 1 Ubilling 2024-11-21 9.8 Critical
Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and being triggered by another part of the software.
CVE-2020-29165 1 Rainbowfishsoftware 1 Pacsone Server 2024-11-21 9.8 Critical
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remotely gaining administrator privileges.
CVE-2020-29138 1 Sagemcom 2 F\@st 3486 Router, F\@st 3486 Router Firmware 2024-11-21 5.3 Medium
Incorrect Access Control in the configuration backup path in SAGEMCOM F@ST3486 NET DOCSIS 3.0, software NET_4.109.0, allows remote unauthenticated users to download the router configuration file via the /backupsettings.conf URI, when any valid session is running.
CVE-2020-29058 1 Cdatatec 56 72408a, 72408a Firmware, 9008a and 53 more 2024-11-21 9.8 Critical
An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. Attackers can discover cleartext web-server credentials via certain /opt/lighttpd/web/cgi/ requests.
CVE-2020-28946 1 Plummac 2 Ik-401, Ik-401 Firmware 2024-11-21 7.5 High
An improper webserver configuration on Plum IK-401 devices with firmware before 1.02 allows an attacker (with network access to the device) to obtain the configuration file, including hashed credential data. Successful exploitation could allow access to hashed credential data with a single unauthenticated GET request.
CVE-2020-28937 1 Openclinic Project 1 Openclinic 2024-11-21 7.5 High
OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's medical test results, possibly resulting in disclosure of Protected Health Information (PHI) stored in the application, via a direct request for the /tests/ URI.
CVE-2020-28929 1 Epson 2 Eps Tse Server 8, Eps Tse Server 8 Firmware 2024-11-21 9.8 Critical
Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to remotely retrieve administrative hashed credentials via the maintenance/troubleshoot.php?download=1 URI.
CVE-2020-28899 1 Zyxel 6 Lte4506-m606, Lte4506-m606 Firmware, Lte7460-m608 and 3 more 2024-11-21 9.1 Critical
The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does not require authentication, which allows remote unauthenticated attackers (via crafted JSON action data to /cgi-bin/gui.cgi) to use all features provided by the router. Examples: change the router password, retrieve the Wi-Fi passphrase, send an SMS message, or modify the IP forwarding to access the internal network.
CVE-2020-27986 1 Sonarsource 1 Sonarqube 2024-11-21 7.5 High
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.