Show filters
216 topics marked with the following tags:
Displaying 1-10 of 216
Sort by:
Attacker Value
Moderate

CVE-2020-3158

Disclosure Date: February 20, 2020 (last updated July 24, 2020)
A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account. The vulnerability is due to a system account that has a default and static password and is not under the control of the system administrator. An attacker could exploit this vulnerability by using this default account to connect to the affected system. A successful exploit could allow the attacker to obtain read and write access to system data, including the configuration of an affected device. The attacker would gain access to a sensitive portion of the system, but the attacker would not have full administrative rights to control the device.
Attacker Value
High

CVE-2016-10225

Disclosure Date: March 27, 2017 (last updated April 22, 2021)
The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "rootmydevice" to /proc/sunxi_debug/sunxi_debug.
Attacker Value
Low

CVE-2020-14942

Disclosure Date: June 21, 2020 (last updated June 27, 2020)
Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.
Attacker Value
Moderate

CVE-2020-8644

Disclosure Date: February 05, 2020 (last updated July 30, 2020)
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
Attacker Value
Moderate

CVE-2019-7548

Disclosure Date: February 06, 2019 (last updated June 05, 2020)
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
Attacker Value
Moderate

CVE-2020-10245

Disclosure Date: March 26, 2020 (last updated June 05, 2020)
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
Attacker Value
Moderate

CVE-2018-13382

Disclosure Date: June 04, 2019 (last updated June 03, 2021)
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
Attacker Value
High

CVE-2020-3950

Disclosure Date: March 17, 2020 (last updated July 30, 2020)
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.
Attacker Value
Very High

CVE-2016-1561

Disclosure Date: April 21, 2017 (last updated July 30, 2020)
ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image.
Attacker Value
Moderate

CVE-2019-10692

Disclosure Date: April 02, 2019 (last updated July 30, 2020)
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.