Vulnerabilities (CVE)

Filtered by NVD-CWE-noinfo
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-35922 1 Mio Project 1 Mio 2021-01-06 2.1 LOW 5.5 MEDIUM
An issue was discovered in the mio crate before 0.7.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
CVE-2019-25007 1 Streebog Project 1 Streebog 2021-01-06 5.0 MEDIUM 7.5 HIGH
An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic.
CVE-2020-35927 1 Thex Project 1 Thex 2021-01-06 2.1 LOW 5.5 MEDIUM
An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex<T> allows cross-thread data races of non-Send types.
CVE-2020-35903 1 Dync Project 1 Dync 2021-01-06 2.1 LOW 5.5 MEDIUM
An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question.
CVE-2020-35915 1 Futures-intrusive Project 1 Futures-intrusive 2021-01-06 2.1 LOW 5.5 MEDIUM
An issue was discovered in the futures-intrusive crate before 0.4.0 for Rust. GenericMutexGuard allows cross-thread data races of non-Sync types.
CVE-2020-35910 1 Lock Api Project 1 Lock Api 2021-01-06 2.1 LOW 5.5 MEDIUM
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedMutexGuard unsoundness.
CVE-2020-35925 1 Magnetic Project 1 Magnetic 2021-01-06 2.1 LOW 5.5 MEDIUM
An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.
CVE-2020-35908 1 Rust-lang 1 Future-utils 2021-01-06 2.1 LOW 5.5 MEDIUM
An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
CVE-2020-3284 1 Cisco 87 A99-rp2-se, A99-rp2-se Firmware, A99-rp2-tr and 84 more 2021-01-05 9.3 HIGH 9.8 CRITICAL
A vulnerability in the enhanced Preboot eXecution Environment (PXE) boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to execute unsigned code during the PXE boot process on an affected device. The PXE boot loader is part of the BIOS and runs over the management interface of hardware platforms that are running Cisco IOS XR Software only. The vulnerability exists because internal commands that are issued when the PXE network boot process is loading a software image are not properly verified. An attacker could exploit this vulnerability by compromising the PXE boot server and replacing a valid software image with a malicious one. Alternatively, the attacker could impersonate the PXE boot server and send a PXE boot reply with a malicious file. A successful exploit could allow the attacker to execute unsigned code on the affected device. Note: To fix this vulnerability, both the Cisco IOS XR Software and the BIOS must be upgraded. The BIOS code is included in Cisco IOS XR Software but might require additional installation steps. For further information, see the Fixed Software section of this advisory.
CVE-2015-5184 1 Redhat 2 Amq, Jboss Enterprise Web Server 2021-01-05 5.0 MEDIUM 7.5 HIGH
Console: CORS headers set to allow all in Red Hat AMQ.
CVE-2015-5183 1 Redhat 3 Amq, Jboss A-mq, Jboss Enterprise Web Server 2021-01-05 5.0 MEDIUM 7.5 HIGH
Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
CVE-2020-15898 1 Arista 49 7050cx3-32s, 7050cx3m-32s, 7050qx-32s and 46 more 2021-01-04 5.0 MEDIUM 5.3 MEDIUM
In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability is only susceptible to exploitation by unidirectional traffic (ex. UDP) and not bidirectional traffic (ex. TCP). This affects: EOS 7170 platforms version 4.21.4.1F and below releases in the 4.21.x train; EOS X-Series versions 4.21.11M and below releases in the 4.21.x train; 4.22.6M and below releases in the 4.22.x train; 4.23.4M and below releases in the 4.23.x train; 4.24.2.1F and below releases in the 4.24.x train.
CVE-2020-35173 1 Amaze File Manager Project 1 Amaze File Manager 2021-01-04 7.5 HIGH 9.8 CRITICAL
The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server (aka services.ftpservice.FTPReceiver.ACTION_START_FTPSERVER and services.ftpservice.FTPReceiver.ACTION_STOP_FTPSERVER).
CVE-2019-15078 1 Xbornid 1 Xbornid 2021-01-04 5.0 MEDIUM 7.5 HIGH
An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token. The name of the constructor has a typo (wrong case: XBornID versus XBORNID) that allows an attacker to change the owner of the contract and obtain cryptocurrency for free.
CVE-2019-15079 1 Eai Project 1 Eai 2021-01-04 5.0 MEDIUM 7.5 HIGH
A typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05, an Ethereum token. This vulnerability could be used by an attacker to acquire EAI tokens for free.
CVE-2019-13164 1 Qemu 1 Qemu 2021-01-04 4.6 MEDIUM 7.8 HIGH
qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
CVE-2019-18641 1 Sparkdevnetwork 1 Rock Rms 2021-01-04 7.5 HIGH 9.8 CRITICAL
Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller.
CVE-2019-15080 1 Morph Project 1 Morph 2021-01-04 5.0 MEDIUM 7.5 HIGH
An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract (which is inherited by MORPH Token) allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for free and can perform a DoS attack.
CVE-2020-28925 1 Boltcms 1 Bolt 2021-01-04 5.0 MEDIUM 5.3 MEDIUM
Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Your PHP for Better Security" guidance.
CVE-2020-35803 1 Netgear 30 Ac2100, Ac2100 Firmware, Ac2400 and 27 more 2021-01-04 2.1 LOW 4.4 MEDIUM
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.46, R6080 before 1.0.0.46, R6120 before 1.0.0.72, R6220 before 1.1.0.100, R6230 before 1.1.0.100, R6260 before 1.1.0.76, R6700v2 before 1.2.0.74, R6800 before 1.2.0.74, R6900v2 before 1.2.0.74, R7450 before 1.2.0.74, AC2100 before 1.2.0.74, AC2400 before 1.2.0.74, and AC2600 before 1.2.0.74.
CVE-2020-29594 1 Rocket.chat 1 Rocket.chat 2021-01-04 7.5 HIGH 9.8 CRITICAL
Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.
CVE-2020-35800 1 Netgear 254 Ac2100, Ac2100 Firmware, Ac2400 and 251 more 2021-01-04 9.7 HIGH 9.4 CRITICAL
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects AC2100 before 1.2.0.72, AC2400 before 1.2.0.72, AC2600 before 1.2.0.72, CBK40 before 2.5.0.10, CBR40 before 2.5.0.10, D6000 before 1.0.0.80, D6220 before 1.0.0.60, D6400 before 1.0.0.94, D7000v2 before 1.0.0.62, D7800 before 1.0.3.48, D8500 before 1.0.3.50, DC112A before 1.0.0.48, DGN2200v4 before 1.0.0.114, DM200 before 1.0.0.66, EAX20 before 1.0.0.36, EAX80 before 1.0.1.62, EX2700 before 1.0.1.58, EX3110 before 1.0.1.68, EX3700 before 1.0.0.84, EX3800 before 1.0.0.84, EX3920 before 1.0.0.84, EX6000 before 1.0.0.44, EX6100v2 before 1.0.1.94, EX6110 before 1.0.1.68, EX6120 before 1.0.0.54, EX6130 before 1.0.0.36, EX6150v1 before 1.0.0.46, EX6150v2 before 1.0.1.94, EX6200v1 before 1.0.3.94, EX6250 before 1.0.0.128, EX6400 before 1.0.2.152, EX6400v2 before 1.0.0.128, EX6410 before 1.0.0.128, EX6920 before 1.0.0.54, EX7000 before 1.0.1.90, EX7300 before 1.0.2.152, EX7300v2 before 1.0.0.128, EX7320 before 1.0.0.128, EX7500 before 1.0.0.68, EX7700 before 1.0.0.210, EX8000 before 1.0.1.224, MK62 before 1.0.5.102, MR60 before 1.0.5.102, MS60 before 1.0.5.102, R6120 before 1.0.0.70, R6220 before 1.1.0.100, R6230 before 1.1.0.100, R6250 before 1.0.4.42, R6260 before 1.1.0.76, R6300v2 before 1.0.4.42, R6330 before 1.1.0.76, R6350 before 1.1.0.76, R6400v1 before 1.0.1.62, R6400v2 before 1.0.4.98, R6700v1 before 1.0.2.16, R6700v2 before 1.2.0.72, R6700v3 before 1.0.4.98, R6800 before 1.2.0.72, R6800 before 1.2.0.72, R6850 before 1.1.0.76, R6900 before 1.0.2.16, R6900P before 1.3.2.124, R6900v2 before 1.2.0.72, R7000 before 1.0.11.106, R7000P before 1.3.2.124, R7100LG before 1.0.0.56, R7200 before 1.2.0.72, R7350 before 1.2.0.72, R7400 before 1.2.0.72, R7450 before 1.2.0.72, R7500v2 before 1.0.3.48, R7800 before 1.0.2.74, R7850 before 1.0.5.60, R7900 before 1.0.4.26, R7900P before 1.4.1.62, R7960P before 1.4.1.62, R8000 before 1.0.4.58, R8000P before 1.4.1.62, R8300 before 1.0.2.134, R8500 before 1.0.2.134, R8900 before 1.0.5.24, R9000 before 1.0.5.24, RAX120 before 1.0.1.136, RAX15 before 1.0.1.64, RAX20 before 1.0.1.64, RAX200 before 1.0.5.24, RAX35 before 1.0.3.80, RAX40 before 1.0.3.80, RAX45 before 1.0.2.64, RAX50 before 1.0.2.64, RAX75 before 1.0.3.102, RAX80 before 1.0.3.102, RBK12 before 2.6.1.44, RBR10 before 2.6.1.44, RBS10 before 2.6.1.44, RBK20 before 2.6.1.38, RBR20 before 2.6.1.36, RBS20 before 2.6.1.38, RBK40 before 2.6.1.38, RBR40 before 2.6.1.38, RBS40 before 2.6.1.38, RBK50 before 2.6.1.40, RBR50 before 2.6.1.40, RBS50 before 2.6.1.40, RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK842 before 3.2.16.6, RBR840 before 3.2.16.6, RBS840 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, RBS850 before 3.2.16.6, RBS40V before 2.5.1.6, RBS40V-200 before 1.0.0.46, RBS50Y before 2.6.1.40, RBW30 before 2.5.0.4, RS400 before 1.5.0.48, WN2500RPv2 before 1.0.1.56, WN3000RPv3 before 1.0.2.86, WN3500RPv1 before 1.0.0.28, WNDR3400v3 before 1.0.1.32, WNR1000v3 before 1.0.2.78, WNR2000v2 before 1.2.0.12, XR300 before 1.0.3.50, XR450 before 2.3.2.66, XR500 before 2.3.2.66, and XR700 before 1.0.1.34.
CVE-2020-6565 4 Apple, Fedoraproject, Google and 1 more 4 Iphone Os, Fedora, Chrome and 1 more 2021-01-02 4.3 MEDIUM 6.5 MEDIUM
Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVE-2020-6560 3 Fedoraproject, Google, Opensuse 4 Fedora, Chrome, Backports Sle and 1 more 2021-01-02 4.3 MEDIUM 6.5 MEDIUM
Insufficient policy enforcement in autofill in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2020-35693 2 Google, Samsung 8 Android, Galaxy A3, Galaxy Note 4 and 5 more 2020-12-31 5.4 MEDIUM 8.8 HIGH
On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) device to pair silently with a vulnerable target device, without any user interaction, when the target device's Bluetooth is on, and it is running an app that offers a connectable BLE advertisement. An example of such an app could be a Bluetooth-based contact tracing app, such as Australia's COVIDSafe app, Singapore's TraceTogether app, or France's TousAntiCovid (formerly StopCovid). As part of the pairing process, two pieces (among others) of personally identifiable information are exchanged: the Identity Address of the Bluetooth adapter of the target device, and its associated Identity Resolving Key (IRK). Either one of these identifiers can be used to perform re-identification of the target device for long term tracking. The list of affected devices includes (but is not limited to): Galaxy Note 5, Galaxy S6 Edge, Galaxy A3, Tab A (2017), J2 Pro (2018), Galaxy Note 4, and Galaxy S5.
CVE-2020-35781 1 Netgear 2 Nms300, Nms300 Firmware 2020-12-30 4.0 MEDIUM 6.5 MEDIUM
NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.
CVE-2020-35780 1 Netgear 2 Nms300, Nms300 Firmware 2020-12-30 4.0 MEDIUM 6.5 MEDIUM
NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.
CVE-2020-35779 1 Netgear 2 Nms300, Nms300 Firmware 2020-12-30 7.8 HIGH 8.6 HIGH
NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.
CVE-2020-9223 1 Huawei 8 Honor 20 Pro, Honor 20 Pro Firmware, Princeton-al10d and 5 more 2020-12-30 5.0 MEDIUM 7.5 HIGH
There is a denial of service vulnerability in some Huawei smartphones. Due to the improper processing of received abnormal messages, remote attackers may exploit this vulnerability to cause a denial of service (DoS) on the specific module.
CVE-2020-29194 1 Panasonic 2 Wv-s2231l, Wv-s2231l Firmware 2020-12-30 5.0 MEDIUM 7.5 HIGH
Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel (which will require a physical reset to restore administrative control) via Randomnum=99AC8CEC6E845B28&mode=1 in a POST request to the cgi-bin/set_factory URI.
CVE-2020-28281 1 Set-object-value Project 1 Set-object-value 2020-12-30 7.5 HIGH 9.8 CRITICAL
Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2020-28280 1 Predefine Project 1 Predefine 2020-12-30 7.5 HIGH 9.8 CRITICAL
Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2020-28279 1 Flattenizer Project 1 Flattenizer 2020-12-30 7.5 HIGH 9.8 CRITICAL
Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2020-28278 1 Shvl Project 1 Shvl 2020-12-30 7.5 HIGH 9.8 CRITICAL
Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2020-28277 1 Dset Project 1 Dset 2020-12-30 7.5 HIGH 9.8 CRITICAL
Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
CVE-2020-28276 1 Deep-set Project 1 Deep-set 2020-12-30 7.5 HIGH 9.8 CRITICAL
Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
CVE-2020-28094 1 Tendacn 2 Ac1200, Ac1200 Firmware 2020-12-30 5.0 MEDIUM 7.5 HIGH
On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, the default settings for the router speed test contain links to download malware named elive or CNKI E-Learning.
CVE-2020-28093 1 Tendacn 2 Ac1200, Ac1200 Firmware 2020-12-30 6.5 MEDIUM 7.2 HIGH
On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, admin, support, user, and nobody have a password of 1234.
CVE-2020-35711 1 Arc-swap Project 1 Arc-swap 2020-12-30 5.0 MEDIUM 7.5 HIGH
An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling references being returned by the map.
CVE-2020-26034 1 Zammad 1 Zammad 2020-12-30 4.0 MEDIUM 4.3 MEDIUM
An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The application responds differently depending on whether the input supplied was recognized as associated with a valid user.
CVE-2020-28096 1 Foscammall 2 Foscam X1, Foscam X1 Firmware 2020-12-30 7.2 HIGH 6.8 MEDIUM
FOSCAM FHD X1 1.14.2.4 devices allow attackers (with physical UART access) to login via the ipc.fos~ password.
CVE-2020-35610 1 Joomla 1 Joomla\! 2020-12-30 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Joomla! 2.5.0 through 3.9.22. The autosuggestion feature of com_finder did not respect the access level of the corresponding terms.
CVE-2018-7580 1 Philips 2 Hue, Hue Firmware 2020-12-29 5.0 MEDIUM 7.5 HIGH
Philips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will freeze Philips Hue's hub and it will stop responding. The "hub" will stop operating and be frozen until the flood stops. During the flood, the user won't be able to turn on/off the lights, and all of the hub's functionality will be unresponsive. The cloud service also won't work with the hub.
CVE-2020-35388 1 Rockoa 1 Xinhu 2020-12-29 5.0 MEDIUM 7.5 HIGH
rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true.
CVE-2020-29159 1 Zammad 1 Zammad 2020-12-29 4.0 MEDIUM 4.9 MEDIUM
An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a privileged Role, if configured by an admin. This behvaior was unintended.
CVE-2020-35716 1 Linksys 2 Re6500, Re6500 Firmware 2020-12-28 7.8 HIGH 7.5 HIGH
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to cause a persistent denial of service (segmentation fault) via a long /goform/langSwitch langSelectionOnly parameter.
CVE-2020-27721 1 F5 2 Big-ip Domain Name System, Big-ip Global Traffic Manager 2020-12-28 4.3 MEDIUM 7.5 HIGH
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.1, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, in a BIG-IP DNS / BIG-IP LTM GSLB deployment, under certain circumstances, the BIG-IP DNS system may stop using a BIG-IP LTM virtual server for DNS response.
CVE-2020-27720 1 F5 2 Big-ip Carrier-grade Nat, Big-ip Local Traffic Manager 2020-12-28 4.3 MEDIUM 7.5 HIGH
On BIG-IP LTM/CGNAT version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when processing NAT66 traffic with Port Block Allocation (PBA) mode and SP-DAG enabled, and dag-ipv6-prefix-len configured with a value less than the default of 128, an undisclosed traffic pattern may cause the Traffic Management Microkernel (TMM) to restart.
CVE-2020-27715 1 F5 11 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 8 more 2020-12-28 7.8 HIGH 7.5 HIGH
On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via port 443 can cause high (~100%) CPU utilization by the httpd daemon.
CVE-2020-27714 1 F5 1 Big-ip Advanced Firewall Manager 2020-12-28 4.3 MEDIUM 7.5 HIGH
On the BIG-IP AFM version 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when a Protocol Inspection Profile is attached to a FastL4 virtual server with the protocol field configured to either Other or All Protocols, the TMM may experience a restart if the profile processes non-TCP traffic.