Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-28 02:57Z
2020-10-28
2020-10-28 18:15Z
MED

CVE-2018-19953 — Qnap Qts: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-19953in the wild

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109. CVSSv3.1 6.1 (MEDIUM) · EPSS 98th percentile

CWECWE 79CWECWE 80VNDQnapTYPVulnerabilitySTAitw exploited
6.1
CVSS v3.1
88
Edit Score
2020-10-28
2020-10-28 18:15Z
CRIT

CVE-2018-19949 — Qnap Qts: If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-19949in the wild

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109. CVSSv3.1 9.8 (CRITICAL) · EPSS 98th percentile

CWECWE 77CWECWE 20CWECWE 78VNDQnapTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2020-10-28
2020-10-28 18:15Z
HIGH

CVE-2018-19943 — Qnap Qts: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-19943in the wild

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later CVSSv3.1 8.0 (HIGH) · EPSS 97th percentile

CWECWE 79CWECWE 80VNDQnapTYPVulnerabilitySTAitw exploited
8.0
CVSS v3.1
95
Edit Score
2020-10-23
2020-10-23 15:15Z
CRIT

CVE-2020-25466 — Crmeb Crmeb: A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-25466

A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 86th percentile

CWECWE 918VNDSsrfVNDCrmebTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-10-22
2020-10-22 03:16Z
CRIT

CVE-2020-27619 — Python Python: In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-27619

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile

VNDOracleVNDFedoraprojectTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-10-21
2020-10-21 19:15Z
MED

CVE-2020-3580 — Cisco Secure_firewall_threat_defense: Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3580in the wild

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit thes CVSSv3.1 6.1 (MEDIUM) · EPSS 100th percentile

CWECWE 79VNDCiscoTYPVulnerabilitySTAitw exploited
6.1
CVSS v3.1
100
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3572 — Cisco Adaptive_security_appliance: A vulnerability in the SSL/TLS session handler of Cisco Adaptive Security Appliance (ASA) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3572

A vulnerability in the SSL/TLS session handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a memory leak when closing SSL/TLS connections in a specific state. An attacker could exploit this vulnerability by establishing several SSL/TLS sessions and ensuring they are closed unde CVSSv3.1 8.6 (HIGH) · EPSS 76th percentile

CWECWE 400CWECWE 401VNDCiscoTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3571 — Cisco Secure_firewall_threat_defense: A vulnerability in the ICMP ingress packet processing of Cisco Firepower Threat Defense (FTD)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3571

A vulnerability in the ICMP ingress packet processing of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 4110 appliances could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incomplete input validation upon receiving ICMP packets. An attacker could exploit this vulnerability by sending a high number of crafted ICMP or ICMPv6 packets to an affected device. A successful CVSSv3.1 8.6 (HIGH) · EPSS 69th percentile

CWECWE 20CWECWE 400VNDCiscoVNDIcmpTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3563 — Cisco Secure_firewall_threat_defense: A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3563

A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to inefficient memory management. An attacker could exploit this vulnerability by sending a large number of TCP packets to a specific port on an affected device. A successful exploit could allow the attacker to exhaust system memory, w CVSSv3.1 8.6 (HIGH) · EPSS 70th percentile

CWECWE 400VNDCiscoTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3562 — Cisco Secure_firewall_threat_defense: A vulnerability in the SSL/TLS inspection of Cisco Firepower Threat Defense (FTD) Software for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3562

A vulnerability in the SSL/TLS inspection of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series firewalls could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation for certain fields of specific SSL/TLS messages. An attacker could exploit this vulnerability by sending a malformed SSL/TLS message through an affected device. A successful exp CVSSv3.1 8.6 (HIGH) · EPSS 77th percentile

CWECWE 119VNDCiscoTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3550 — Cisco Secure_firewall_management_center: A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3550

A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to perform directory traversal and access directories outside the restricted path. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by using a relative path in specific sfmgr commands. An exploit could allow the attacker to read or write arb CVSSv3.1 8.1 (HIGH) · EPSS 81th percentile

CWECWE 22VNDCiscoTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3549 — Cisco Secure_firewall_management_center: A vulnerability in the sftunnel functionality of Cisco Firepower Management Center (FMC) Software and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3549

A vulnerability in the sftunnel functionality of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to obtain the device registration hash. The vulnerability is due to insufficient sftunnel negotiation protection during initial device registration. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting a specific flow of the sftunnel communicat CVSSv3.1 8.1 (HIGH) · EPSS 58th percentile

CWECWE 326VNDCiscoTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3533 — Cisco Secure_firewall_threat_defense: A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3533

A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly. The vulnerability is due to a lack of sufficient memory management protections under heavy SNMP polling loads. An attacker could exploit this vulnerability by sending a high rate of SNMP requests to the SNMP daemon through the management inte CVSSv3.1 8.6 (HIGH) · EPSS 76th percentile

CWECWE 400VNDCiscoVNDSimpleTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3529 — Cisco Adaptive_security_appliance: A vulnerability in the SSL VPN negotiation process for Cisco Adaptive Security Appliance (ASA)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3529

A vulnerability in the SSL VPN negotiation process for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to inefficient direct memory access (DMA) memory management during the negotiation phase of an SSL VPN connection. An attacker could exploit this vulnerability by CVSSv3.1 8.6 (HIGH) · EPSS 77th percentile

CWECWE 400VNDCiscoVNDSslTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3528 — Cisco Adaptive_security_appliance: A vulnerability in the OSPF Version 2 (OSPFv2) implementation of Cisco Adaptive Security Appliance

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3528

A vulnerability in the OSPF Version 2 (OSPFv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation when the affected software processes certain OSPFv2 packets with Link-Local Signaling (LLS) data. An attacker could exploit CVSSv3.1 8.6 (HIGH) · EPSS 71th percentile

CWECWE 400VNDCiscoVNDOspfTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3514 — Cisco Secure_firewall_management_center: A vulnerability in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3514

A vulnerability in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their Cisco FTD instance and execute commands with root privileges in the host namespace. The attacker must have valid credentials on the device.The vulnerability exists because a configuration file that is used at container startup has insufficient protections. An attacker could exploit this vulnerability by m CVSSv3.1 8.2 (HIGH) · EPSS 30th percentile

CWECWE 216VNDCiscoTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3436 — Cisco Adaptive_security_appliance: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3436

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to upload arbitrary-sized files to specific folders on an affected device, which could lead to an unexpected device reload. The vulnerability exists because the affected software does not efficiently handle the writing of large files to specific folders on the local file system. An attacker c CVSSv3.1 8.6 (HIGH) · EPSS 78th percentile

CWECWE 434VNDCiscoTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3373 — Cisco Secure_firewall_threat_defense: A vulnerability in the IP fragment-handling implementation of Cisco Adaptive Security Appliance (ASA) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3373

A vulnerability in the IP fragment-handling implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. This memory leak could prevent traffic from being processed through the device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper error handling when specific failures occur during IP frag CVSSv3.1 8.6 (HIGH) · EPSS 78th percentile

CWECWE 400CWECWE 401VNDCiscoTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2020-10-21
2020-10-21 19:15Z
HIGH

CVE-2020-3304 — Cisco Adaptive_security_appliance: A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3304

A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit coul CVSSv3.1 8.6 (HIGH) · EPSS 89th percentile

CWECWE 20CWECWE 400VNDCiscoTYPVulnerability
8.6
CVSS v3.1
94
Edit Score
2020-10-20
2020-10-20 17:15Z
CRIT

CVE-2020-3992 — Vmware Cloud_foundation: OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3992in the wild

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 416VNDVmwareVNDOpenslpTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2020-10-12
2020-10-12 14:15Z
CRIT

CVE-2020-26867 — Arcinformatique Pcvue: ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-26867

ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server. CVSSv3.1 9.8 (CRITICAL) · EPSS 88th percentile

CWECWE 502VNDArcinformatiqueVNDArcTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-10-12
2020-10-12 14:15Z
MED

CVE-2020-13943 — Apache Tomcat: This could lead to users seeing responses for unexpected resources.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-13943

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. CVSSv3.1 4.3 (MEDIUM) · EPSS 99th percentile

VNDApacheTYPVulnerability
4.3
CVSS v3.1
88
Edit Score
2020-10-06
2020-10-06 13:15Z
CRIT

CVE-1999-0199 — Gnu Glibc: manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about

NVD (auto-promoted CVEs)·nvd.nist.govCVE-1999-0199

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999. CVSSv3.1 9.8 (CRITICAL) · EPSS 83th percentile

CWECWE 252VNDGnuTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-10-01
2020-10-01 19:15Z
HIGH

CVE-2020-15670 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-15670

Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80. CVSSv3.1 8.8 (HIGH) · EPSS 62th percentile

CWECWE 416CWECWE 362CWECWE 617VNDMozillaTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2020-09-30
2020-09-30 18:15Z
HIGH

CVE-2019-20920 — Handlebarsjs Handlebars: before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-20920

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS). CVSSv3.1 8.1 (HIGH) · EPSS 88th percentile

CWECWE 94VNDHandlebarsjsVNDHandlebarsTYPVulnerability
8.1
CVSS v3.1
91
Edit Score