Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-28 03:45Z
2020-09-30
2020-09-30 18:15Z
HIGH

CVE-2019-20920 — Handlebarsjs Handlebars: before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-20920

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS). CVSSv3.1 8.1 (HIGH) · EPSS 88th percentile

CWECWE 94VNDHandlebarsjsVNDHandlebarsTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2020-09-30
2020-09-30 18:15Z
HIGH

CVE-2018-5354 — Anixis Password_reset_client: The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-5354

The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, CVSSv3.1 8.8 (HIGH) · EPSS 84th percentile

CWECWE 290VNDAnixisTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2020-09-30
2020-09-30 18:15Z
CRIT

CVE-2018-5353 — Zohocorp Manageengine_adselfservice_plus: The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-5353

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploit CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile

CWECWE 290VNDZohoVNDZohocorpTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-09-22
2020-09-22 18:15Z
HIGH

CVE-2020-25514 — Simple_library_management_system_project Simple_library_management_system: Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-25514

Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php. CVSSv3.1 8.4 (HIGH) · EPSS 46th percentile

CWECWE 89VNDSourcecodesterVNDSimple Library Management System ProjectTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2020-09-19
2020-09-19 04:15Z
MED

CVE-2020-5421 — Vmware Spring_framework: In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-5421

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter. CVSSv3.1 6.5 (MEDIUM) · EPSS 96th percentile

VNDVmwareVNDOracleTYPVulnerability
6.5
CVSS v3.1
86
Edit Score
2020-09-17
2020-09-17 19:15Z
HIGH

CVE-2020-24750 — Fasterxml Jackson-databind: 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-24750

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration. CVSSv3.1 8.1 (HIGH) · EPSS 94th percentile

CWECWE 502VNDOracleVNDFasterxmlTYPVulnerability
8.1
CVSS v3.1
93
Edit Score
2020-09-15
2020-09-15 14:15Z
HIGH

CVE-2020-23451 — Spiceworks Spiceworks: Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-23451

Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function. CVSSv3.1 8.8 (HIGH) · EPSS 44th percentile

CWECWE 352VNDSpiceworksTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2020-09-14
2020-09-14 19:15Z
CRIT

CVE-2020-25576 — Rust-random Rand: An issue was discovered in the rand_core crate before 0.4.2 for Rust.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-25576

An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints. CVSSv3.1 9.8 (CRITICAL) · EPSS 73th percentile

CWECWE 704VNDRust RandomTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2020-09-09
2020-09-09 19:15Z
CRIT

CVE-2020-15786 — Siemens Simatic_hmi_basic_panels_2nd_generation_firmware: This could allow a remote attacker to discover user passwords and obtain access to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-15786

A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions <= V16), SIMATIC HMI Mobile Panels (All versions <= V16), SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently block excessive authentication attempts. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server v CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile

CWECWE 307VNDSiemensTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2020-09-04
2020-09-04 03:15Z
HIGH

CVE-2020-3478 — Cisco Enterprise_nfv_infrastructure_software: A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3478

A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to overwrite certain files that should be restricted on an affected device. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by uploading a file using the REST API. A successful exploit could allow an attacker to overwrite and upload files, which could degrade CVSSv3.1 8.1 (HIGH) · EPSS 66th percentile

CWECWE 20VNDCiscoVNDRestTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2020-09-03
2020-09-03 18:15Z
CRIT

CVE-2020-24193 — Daily_tracker_system_project Daily_tracker_system: A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-24193

A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication bypass with SQL injection via the email parameter. CVSSv3.1 9.8 (CRITICAL) · EPSS 84th percentile

CWECWE 89VNDDaily Tracker System ProjectTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-09-01
2020-09-01 15:15Z
HIGH

CVE-2019-5645 — Rapid7 Metasploit: By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-5645

By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on the Metasploit server. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile

CWECWE 400VNDRapid7VNDHttpTYPVulnerability
7.5
CVSS v3.1
100
Edit Score
2020-08-26
2020-08-26 14:15Z
CRIT

CVE-2020-14498 — Hms-networks Ecatcher: HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-14498

HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. CVSSv3.1 9.6 (CRITICAL) · EPSS 86th percentile

CWECWE 787CWECWE 121VNDHmsVNDHms NetworksTYPVulnerability
9.6
CVSS v3.1
99
Edit Score
2020-08-25
2020-08-25 18:15Z
HIGH

CVE-2020-24616 — Fasterxml Jackson-databind: 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-24616

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP). CVSSv3.1 8.1 (HIGH) · EPSS 95th percentile

CWECWE 502VNDNetappVNDFasterxmlTYPVulnerability
8.1
CVSS v3.1
93
Edit Score
2020-08-19
2020-08-19 14:15Z
HIGH

CVE-2020-9715 — Adobe Acrobat_dc: Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-9715in the wild

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution . CVSSv3.1 7.8 (HIGH) · EPSS 99th percentile

CWECWE 416VNDAdobeTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
100
Edit Score
2020-08-17
2020-08-17 18:15Z
HIGH

CVE-2020-3433 — Cisco Anyconnect_secure_mobility_client: A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3433in the wild

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafte CVSSv3.1 7.8 (HIGH) · EPSS 95th percentile

CWECWE 427VNDCiscoTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
92
Edit Score
2020-07-31
2020-07-31 20:15Z
HIGH

CVE-2020-15871 — Sonatype Nexus_repository_manager: Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-15871

Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution. CVSSv3.1 8.8 (HIGH) · EPSS 82th percentile

VNDSonatypeTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2020-07-24
2020-07-24 23:15Z
CRIT

CVE-2020-12812 — Fortinet Fortios: An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-12812in the wild

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile

CWECWE 287CWECWE 178VNDFortinetVNDSslTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2020-07-24
2020-07-24 14:15Z
HIGH

CVE-2020-15778 — Openbsd Openssh: scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-15778

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows." CVSSv3.1 7.4 (HIGH) · EPSS 96th percentile

CWECWE 78VNDOpensshVNDNetappTYPVulnerability
7.4
CVSS v3.1
91
Edit Score
2020-07-22
2020-07-22 20:15Z
HIGH

CVE-2020-3452 — Cisco Adaptive_security_appliance_software: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3452in the wild

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile

CWECWE 22CWECWE 20VNDCiscoTYPVulnerabilitySTAitw exploited
7.5
CVSS v3.1
100
Edit Score
2020-07-17
2020-07-17 03:15Z
CRIT

CVE-2020-15801 — Python Python: In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-15801

In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected. CVSSv3.1 9.8 (CRITICAL) · EPSS 89th percentile

CWECWE 426VNDNetappTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-07-14
2020-07-14 15:15Z
HIGH

CVE-2020-13935 — Apache Tomcat: Multiple requests with invalid payload lengths could lead to a denial of service.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-13935

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile

CWECWE 835VNDApacheVNDWebsocketTYPVulnerability
7.5
CVSS v3.1
100
Edit Score
2020-07-14
2020-07-14 15:15Z
HIGH

CVE-2020-13934 — Apache Tomcat: If a sufficient number of such requests were made, an OutOfMemoryException could occur leading

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-13934

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile

CWECWE 476CWECWE 401VNDApacheTYPVulnerability
7.5
CVSS v3.1
100
Edit Score
2020-07-14
2020-07-14 13:15Z
HIGH

CVE-2020-15711 — Misp-project Misp: In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-15711

In MISP before 2.4.129, setting a favourite homepage was not CSRF protected. CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile

CWECWE 352VNDMispVNDMisp ProjectTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2020-07-08
2020-07-08 14:15Z
HIGH

CVE-2020-3973 — Arista Velocloud_orchestrator: The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-3973

The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged. CVSSv3.1 8.8 (HIGH) · EPSS 63th percentile

CWECWE 89VNDAristaVNDVelocloudTYPVulnerability
8.8
CVSS v3.1
94
Edit Score