Topics

Sort by:
Attacker Value
High

CVE-2020-1571

Disclosure Date: August 17, 2020 (last updated August 28, 2020)
An elevation of privilege vulnerability exists in Windows Setup in the way it handles permissions.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows Setup Elevation of Privilege Vulnerability'.
Attack Vector: Local Privileges: Low User Interaction: None
1
Attacker Value
High

Authentication bypass vulnerability in Cisco’s IOS XE REST API

Disclosure Date: August 28, 2019 (last updated February 13, 2020)
This is an authentication bypass vulnerability in Cisco's IOS XE series OS. While it can target a large swath of Cisco's switches and routers, it requires the Cisco REST API Container for IOS to be turned on, as it is not on by default.
2
Attacker Value
High

CVE-2017-1000353

Disclosure Date: January 29, 2018 (last updated June 05, 2020)
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
Attack Vector: Network Privileges: None User Interaction: None
1
Attacker Value
High

CVE-2020-3495

Disclosure Date: September 04, 2020 (last updated September 10, 2020)
Cisco Jabber is vulnerable to Cross Site Scripting (XSS) through XHTML-IM messages. The application does not properly sanitize incoming HTML messages and instead passes them through a flawed XSS filter.
2
Attacker Value
Moderate

CVE-2020-2040

Disclosure Date: September 09, 2020 (last updated September 16, 2020)
A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.
Attack Vector: Network Privileges: None User Interaction: None
1
Attacker Value
Very High

CVE-2020-2037

Disclosure Date: September 09, 2020 (last updated September 16, 2020)
An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.
Attack Vector: Network Privileges: High User Interaction: None
1
Attacker Value
Very High

CVE-2020-2038

Disclosure Date: September 09, 2020 (last updated September 16, 2020)
An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.
Attack Vector: Network Privileges: High User Interaction: None
1
Attacker Value
Very High

CVE-2009-0545 — ZeroShell Remote Code Execution

Disclosure Date: February 12, 2009 (last updated September 10, 2020)
cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
1
Attacker Value
High

CVE-2020-9850

Disclosure Date: June 09, 2020 (last updated July 27, 2020)
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A remote attacker may be able to cause arbitrary code execution.
Attack Vector: Network Privileges: None User Interaction: None
1
Attacker Value
Very High

CVE-2020-2034 — PAN-OS: OS command injection vulnerability in GlobalProtect por…

Disclosure Date: July 08, 2020 (last updated July 24, 2020)
An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN-OS 8.0 and PAN-OS 7.1. Prisma Access services are not impacted by this vulnerability.
Attack Vector: Network Privileges: None User Interaction: None
2