Search
Total
17685 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-29575 | 1 Docker | 1 Elixir Alpine Docker Image | 2020-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. Systems using the elixir Linux Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-29564 | 1 Hashicorp | 1 Consul Docker Image | 2020-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-29389 | 1 Docker | 1 Crux Linux Docker Image | 2020-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| The official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user. System using the Crux Linux Docker container deployed by affected versions of the Docker image may allow an attacker to achieve root access with a blank password. | |||||
| CVE-2020-35197 | 1 Docker | 1 Memcached Docker Image | 2020-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user. System using the memcached docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35196 | 1 Docker | 1 Rabbitmq Docker Image | 2020-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user. System using the rabbitmq docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35489 | 1 Rocklobster | 1 Contact Form 7 | 2020-12-22 | 10.0 HIGH | 10.0 CRITICAL |
| The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters. | |||||
| CVE-2020-29579 | 1 Express-gateway | 1 Express-gateway Docker Image | 2020-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access. | |||||
| CVE-2020-29580 | 1 Docker | 1 Storm Docker Image | 2020-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-29581 | 1 Docker | 1 Spiped Alpine Docker Image | 2020-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-20300 | 1 Weiphp | 1 Weiphp | 2020-12-22 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in the wp_where function in WeiPHP 5.0. | |||||
| CVE-2020-35193 | 1 Sonarsource | 1 Sonarqube Docker Image | 2020-12-21 | 10.0 HIGH | 9.8 CRITICAL |
| The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35195 | 1 Docker | 1 Haproxy Docker Image | 2020-12-21 | 10.0 HIGH | 9.8 CRITICAL |
| The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. System using the haproxy docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35545 | 1 Spotweb Project | 1 Spotweb | 2020-12-21 | 7.5 HIGH | 9.8 CRITICAL |
| Time-based SQL injection exists in Spotweb 1.4.9 via the query string. | |||||
| CVE-2020-12519 | 1 Phoenixcontact | 7 Axc F 1152, Axc F 2152, Axc F 2152 Starterkit and 4 more | 2020-12-21 | 10.0 HIGH | 9.8 CRITICAL |
| On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges. | |||||
| CVE-2020-12517 | 1 Phoenixcontact | 7 Axc F 1152, Axc F 2152, Axc F 2152 Starterkit and 4 more | 2020-12-21 | 6.0 MEDIUM | 9.0 CRITICAL |
| On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation). | |||||
| CVE-2020-7203 | 1 Hp | 1 Ilo Amplifier Pack | 2020-12-21 | 7.5 HIGH | 9.8 CRITICAL |
| A potential security vulnerability has been identified in HPE iLO Amplifier Pack server version 1.70. The vulnerability could be exploited to allow remote code execution. | |||||
| CVE-2020-12523 | 1 Phoenixcontact | 18 Fl Mguard Rs4004 Tx\/dtx, Fl Mguard Rs4004 Tx\/dtx Firmware, Fl Mguard Rs4004 Tx\/dtx Vpn and 15 more | 2020-12-21 | 6.4 MEDIUM | 9.1 CRITICAL |
| On Phoenix Contact mGuard Devices versions before 8.8.3 LAN ports get functional after reboot even if they are disabled in the device configuration. For mGuard devices with integrated switch on the LAN side, single switch ports can be disabled by device configuration. After a reboot these ports get functional independent from their configuration setting: Missing Initialization of Resource | |||||
| CVE-2020-26867 | 1 Pcvuesolutions | 1 Pcvue | 2020-12-18 | 7.5 HIGH | 9.8 CRITICAL |
| ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server. | |||||
| CVE-2020-26276 | 1 Fleetdm | 1 Fleet | 2020-12-18 | 6.8 MEDIUM | 9.8 CRITICAL |
| Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet. | |||||
| CVE-2020-35550 | 1 Google | 1 Android | 2020-12-18 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Attackers can bypass Factory Reset Protection (FRP) via StatusBar. The Samsung ID is SVE-2020-17888 (December 2020). | |||||
| CVE-2020-35185 | 1 Docker | 1 Ghost Alpine Docker Image | 2020-12-18 | 10.0 HIGH | 9.8 CRITICAL |
| The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35551 | 1 Google | 1 Android | 2020-12-18 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. They allow attackers to conduct RPMB state-change attacks because an unauthorized RPMB write operation can be replayed, a related issue to CVE-2020-13799. The Samsung ID is SVE-2020-18100 (December 2020). | |||||
| CVE-2020-35189 | 1 Kong | 1 Kong Alpine Docker Image | 2020-12-18 | 10.0 HIGH | 9.8 CRITICAL |
| The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. System using the kong docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35190 | 1 Plone | 1 Plone | 2020-12-18 | 10.0 HIGH | 9.8 CRITICAL |
| The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35191 | 1 Drupal | 1 Drupal Docker Images | 2020-12-18 | 10.0 HIGH | 9.8 CRITICAL |
| The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35192 | 1 Hashicorp | 1 Vault | 2020-12-18 | 10.0 HIGH | 9.8 CRITICAL |
| The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-29663 | 1 Icinga | 1 Icinga | 2020-12-18 | 6.4 MEDIUM | 9.1 CRITICAL |
| Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue is fixed in Icinga 2 v2.11.8 and v2.12.3. | |||||
| CVE-2020-35467 | 1 Docker | 1 Docs | 2020-12-18 | 10.0 HIGH | 9.8 CRITICAL |
| The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the Docker Docs container may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-17467 | 1 Fnet Project | 1 Fnet | 2020-12-18 | 6.4 MEDIUM | 9.1 CRITICAL |
| An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in _fnet_llmnr_poll in fnet_llmnr.c during a response to a malicious request of the DNS class IN. | |||||
| CVE-2018-16792 | 1 Solarwinds | 1 Sftp\/scp Server | 2020-12-18 | 6.4 MEDIUM | 9.1 CRITICAL |
| SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate data. | |||||
| CVE-2020-26201 | 1 Singtel | 2 Askey Ap5100w-d171, Askey Ap5100w-d171 Firmware | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. This allows an attacker to gain unauthorized access as an admin or root user to the device Operating System via Telnet or SSH. | |||||
| CVE-2020-35468 | 1 Appbase | 1 Streams | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams container may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35469 | 1 Softwareag | 1 Terracotta Server Oss | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed using affected versions of the Terracotta Server OSS container may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35466 | 1 Blackfire | 1 Blackfire | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| The Blackfire Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the Blackfire container may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35465 | 1 Fullarmor | 1 Hapi File Share Mount | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| The FullArmor HAPI File Share Mount Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the FullArmor HAPI File Share Mount container may allow the remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35464 | 1 Weave | 1 Cloud Agent | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the Weave Cloud Agent container may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35462 | 1 Coscale Agent Project | 1 Coscale Agent | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the CoScale agent container may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35186 | 1 Docker | 1 Adminer | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35187 | 1 Influxdata | 1 Telegraf | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. System using the telegraf docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2020-35463 | 1 Instana | 1 Dynamic Apm | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. Systems deployed using affected versions of the Instana Dynamic APM container may allow a remote attacker to achieve root access with a blank password. | |||||
| CVE-2019-14482 | 1 Adremsoft | 1 Netcrunch | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is used across different customers' installations when no other SSL certificate is installed, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation. | |||||
| CVE-2020-4747 | 1 Ibm | 1 Connect\ | 2020-12-17 | 7.5 HIGH | 9.8 CRITICAL |
| IBM Connect:Direct for UNIX 6.1.0, 6.0.0, 4.3.0, and 4.2.0 can allow a local or remote user to obtain an authenticated CLI session due to improper authentication methods. IBM X-Force ID: 188516. | |||||
| CVE-2020-29659 | 1 Flexense | 1 Dupscout | 2020-12-17 | 10.0 HIGH | 9.8 CRITICAL |
| A buffer overflow in the web server of Flexense DupScout Enterprise 10.0.18 allows a remote anonymous attacker to execute code as SYSTEM by overflowing the sid parameter via a GET /settings&sid= attack. | |||||
| CVE-2020-14244 | 1 Hcltech | 1 Domino | 2020-12-16 | 10.0 HIGH | 9.8 CRITICAL |
| A vulnerability in the MIME message handling of the Domino server (versions 9 and 10) could potentially be exploited by an unauthenticated attacker resulting in a stack buffer overflow. This could allow a remote attacker to crash the server or inject code into the system which would execute with the privileges of the server. | |||||
| CVE-2020-25228 | 1 Siemens | 2 Logo\! 8 Bm, Logo\! 8 Bm Firmware | 2020-12-16 | 10.0 HIGH | 9.8 CRITICAL |
| A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). A service available on port 10005/tcp of the affected devices could allow complete access to all services without authorization. An attacker could gain full control over an affected device, if he has access to this service. The system manual recommends to protect access to this port. | |||||
| CVE-2020-17529 | 1 Apache | 1 Nuttx | 2020-12-16 | 6.8 MEDIUM | 9.8 CRITICAL |
| Out-of-bounds Write vulnerability in TCP Stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying and invalid fragmentation offset value specified in the IP header. This is only impacts builds with both CONFIG_EXPERIMENTAL and CONFIG_NET_TCP_REASSEMBLY build flags enabled. | |||||
| CVE-2020-17528 | 1 Apache | 1 Nuttx | 2020-12-16 | 6.4 MEDIUM | 9.1 CRITICAL |
| Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying arbitrary urgent data pointer offsets within TCP packets including beyond the length of the packet. | |||||
| CVE-2020-8257 | 1 Citrix | 1 Gateway Plug-in | 2020-12-16 | 7.5 HIGH | 9.8 CRITICAL |
| Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, lead to privilege escalation attacks | |||||
| CVE-2020-28442 | 1 Js-data | 1 Js-data | 2020-12-16 | 7.5 HIGH | 9.8 CRITICAL |
| All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function. | |||||
| CVE-2018-11746 | 1 Puppet | 1 Discovery | 2020-12-16 | 5.0 MEDIUM | 9.8 CRITICAL |
| In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery. | |||||