| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2020-26174 | 6.5 | tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. However, this restriction is enforced in the browser (client-side) and can be circumvented. Thi | 2020-12-21 18:47:00 | 2020-12-18 10:15:00 |
| CVE-2020-12519 | 10.0 | On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges. | 2020-12-21 18:34:00 | 2020-12-17 23:15:00 |
| CVE-2020-12518 | 5.0 | On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks. | 2020-12-21 18:30:00 | 2020-12-17 23:15:00 |
| CVE-2020-12521 | 6.1 | On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack. An attacker can cause failure of system services or a complete reboot. | 2020-12-21 18:28:00 | 2020-12-17 23:15:00 |
| CVE-2020-27639 | 4.8 | The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an im | 2020-12-21 17:23:00 | 2020-12-18 08:15:00 |
| CVE-2020-12517 | 6.0 | On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation). | 2020-12-21 17:07:00 | 2020-12-17 23:15:00 |
| CVE-2020-26176 | 4.0 | An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /api/document/<DocumentID>/attachments API endpoint. Knowing a document ID, an attacker can list all the attachments of a workitem, i | 2020-12-21 16:56:00 | 2020-12-18 10:15:00 |
| CVE-2020-25620 | 4.6 | An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user accounts named support@n-able.com and nableadmin@n-able.com. These allow logins to the N-Central Administrative Console (NAC) and/or th | 2020-12-21 16:24:00 | 2020-12-16 15:15:00 |
| CVE-2020-25619 | 3.6 | An issue was discovered in SolarWinds N-Central 12.3.0.670. The SSH component does not restrict the Communication Channel to Intended Endpoints. An attacker can leverage an SSH feature (port forwarding with a temporary key pair) to access network ser | 2020-12-21 16:20:00 | 2020-12-16 14:15:00 |
| CVE-2020-25618 | 9.0 | An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root (i.e., the use of root privileges is not limit | 2020-12-21 16:16:00 | 2020-12-16 14:15:00 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39518
Zapisa po stranici: