Filtered by CWE-20
Filtered by vendor Subscriptions
Total 12656 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-9115 1 Huawei 1 Manageone 2024-11-21 7.2 High
ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the plug-in component. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject commands to the target device.
CVE-2020-9110 1 Huawei 2 Taurus-an00b, Taurus-an00b Firmware 2024-11-21 4.6 Medium
Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an information disclosure vulnerability. The device does not sufficiently validate the output of device in certain specific scenario, the attacker can gain information in the victim's smartphone to launch the attack, successful exploit could cause information disclosure.
CVE-2020-9105 1 Huawei 2 Taurus-an00b, Taurus-an00b Firmware 2024-11-21 6.7 Medium
Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an insufficient input validation vulnerability. Due to the input validation logic is incorrect, an attacker can exploit this vulnerability to access and modify the memory of the device by doing a series of operations. Successful exploit may cause the service abnormal.
CVE-2020-9075 1 Huawei 5 Secospace Usg6300, Secospace Usg6300 Firmware, Secospace Usg6600 Firmware and 2 more 2024-11-21 6.5 Medium
Huawei products Secospace USG6300;USG6300E with versions of V500R001C30,V500R001C50,V500R001C60,V500R001C80,V500R005C00,V500R005C10;V600R006C00 have a vulnerability of insufficient input verification. An attacker with limited privilege can exploit this vulnerability to access a specific directory. Successful exploitation of this vulnerability may lead to information leakage.
CVE-2020-9013 1 Arvato 1 Skillpipe 2024-11-21 4.3 Medium
Arvato Skillpipe 3.0 allows attackers to bypass intended print restrictions by deleting <div id="watermark"> from the HTML source code.
CVE-2020-9002 1 Iportalis 1 Iportalis Control Portal 2024-11-21 7.5 High
An issue was discovered in iPortalis iCS 7.1.13.0. An attacker can gain privileges by intercepting a request and changing UserRoleKey=COMPANY_ADMIN to UserRoleKey=DOMAIN_ADMIN (to achieve Domain Administrator access).
CVE-2020-8843 1 Istio 1 Istio 2024-11-21 7.4 High
An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a source equal to ingress. To exploit this vulnerability, someone has to encode a source.uid in this header. This feature is disabled by default in Istio 1.3 and 1.4.
CVE-2020-8815 1 Iktm 1 Bearftp 2024-11-21 7.5 High
Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of service via a Slowloris approach by sending a large volume of small packets.
CVE-2020-8787 1 Salesagility 1 Suitecrm 2024-11-21 7.5 High
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted.
CVE-2020-8756 1 Intel 1 Converged Security And Manageability Engine 2024-11-21 6.7 Medium
Improper input validation in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-8742 1 Intel 146 Cd1c32gk, Cd1c32gk Firmware, Cd1c64gk and 143 more 2024-11-21 6.7 Medium
Improper input validation in the firmware for Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-8734 1 Intel 2 M10jnp2sb, M10jnp2sb Firmware 2024-11-21 6.7 Medium
Improper input validation in the firmware for Intel(R) Server Board M10JNP2SB before version 7.210 may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-8721 1 Intel 153 Compute Module Hns2600bp Firmware, Compute Module Hns2600bpb, Compute Module Hns2600bpb24 and 150 more 2024-11-21 8.2 High
Improper input validation for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-8717 1 Intel 153 Compute Module Hns2600bp Firmware, Compute Module Hns2600bpb, Compute Module Hns2600bpb24 and 150 more 2024-11-21 5.5 Medium
Improper input validation in a subsystem for some Intel Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable denial of service via local access.
CVE-2020-8700 2 Intel, Netapp 546 Bios, Core I3-l13g4, Core I5-l16g7 and 543 more 2024-11-21 6.7 Medium
Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-8688 1 Intel 1 Raid Web Console 3 2024-11-21 7.5 High
Improper input validation in the Intel(R) RAID Web Console 3 for Windows* may allow an unauthenticated user to potentially enable denial of service via network access.
CVE-2020-8669 1 Intel 1 Data Center Manager 2024-11-21 6.5 Medium
Improper input validation in the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable information disclosure via network access.
CVE-2020-8614 1 Askey 2 Ap4000w, Ap4000w Firmware 2024-11-21 9.8 Critical
An issue was discovered on Askey AP4000W TDC_V1.01.003 devices. An attacker can perform Remote Code Execution (RCE) by sending a specially crafted network packer to the bd_svr service listening on TCP port 54188.
CVE-2020-8607 2 Microsoft, Trendmicro 13 Windows, Antivirus Toolkit, Apex One and 10 more 2024-11-21 6.7 Medium
An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
CVE-2020-8568 1 Kubernetes 1 Secrets Store Csi Driver 2024-11-21 5.8 Medium
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.