Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-28 05:58Z
2020-04-20
2020-04-20 19:15Z
HIGH

CVE-2020-11753 — Sonatype Nexus_repository_manager: An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-11753

An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable). CVSSv3.1 8.8 (HIGH) · EPSS 76th percentile

CWECWE 863VNDSonatypeTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2020-04-09
2020-04-09 03:15Z
CRIT

CVE-2020-11656 — Sqlite Sqlite: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-11656

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement. CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile

CWECWE 416VNDOracleVNDSqliteVNDNetappTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-04-07
2020-04-07 23:15Z
HIGH

CVE-2020-11620 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-11620

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly). CVSSv3.1 8.1 (HIGH) · EPSS 93th percentile

CWECWE 502VNDNetappVNDFasterxmlTYPVulnerability
8.1
CVSS v3.1
92
Edit Score
2020-04-07
2020-04-07 23:15Z
HIGH

CVE-2020-11619 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-11619

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop). CVSSv3.1 8.1 (HIGH) · EPSS 80th percentile

CWECWE 502VNDNetappVNDFasterxmlTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2020-04-01
2020-04-01 22:15Z
HIGH

CVE-2020-6096 — Gnu Glibc: Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-6096

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furth CVSSv3.1 8.1 (HIGH) · EPSS 92th percentile

CWECWE 681CWECWE 191CWECWE 195VNDGnuVNDFedoraprojectTYPVulnerability
8.1
CVSS v3.1
92
Edit Score
2020-03-31
2020-03-31 05:15Z
HIGH

CVE-2020-11113 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-11113

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa). CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile

CWECWE 502VNDOracleVNDNetappVNDFasterxmlTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
2020-03-31
2020-03-31 05:15Z
HIGH

CVE-2020-11112 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-11112

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy). CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile

CWECWE 502VNDOracleVNDNetappVNDFasterxmlTYPVulnerability
8.8
CVSS v3.1
96
Edit Score
728 × 90 / responsive · programmatic ad slot
2020-03-31
2020-03-31 05:15Z
HIGH

CVE-2020-11111 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-11111

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms). CVSSv3.1 8.8 (HIGH) · EPSS 88th percentile

CWECWE 502VNDOracleVNDNetappVNDFasterxmlTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2020-03-26
2020-03-26 21:20Z
HIGH

impacket 0.9.21

Impacket releases·github.com

Impacket 0.9.21 release adds significant offensive capabilities including keytab file support, gMSA password dumping, LAPS password extraction, Kerberos delegation enumeration, and enhanced NTLM relay attacks with SID-based escalation. New tools like ticketConverter.py, findDelegation.py, and addcomputer.py expand post-exploitation and lateral movement options.

SRFNetworkTACTA0006TACTA0007SRFIdentityTACTA0008VNDImpacketTYPToolSTGDiscovery
78
Edit Score
2020-03-26
2020-03-26 13:15Z
HIGH

CVE-2020-10969 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-10969

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane. CVSSv3.1 8.8 (HIGH) · EPSS 88th percentile

CWECWE 502VNDOracleVNDNetappVNDFasterxmlTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2020-03-26
2020-03-26 13:15Z
HIGH

CVE-2020-10968 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-10968

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy). CVSSv3.1 8.8 (HIGH) · EPSS 89th percentile

CWECWE 502VNDOracleVNDNetappVNDFasterxmlTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2020-03-24
2020-03-24 21:15Z
CRIT

CVE-2020-6072 — Videolabs Libmicrodns: When parsing compressed labels in mDNS messages, the rr_decode function's return value is not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-6072

An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the rr_decode function's return value is not checked, leading to a double free that could be exploited to execute arbitrary code. An attacker can send an mDNS message to trigger this vulnerability. CVSSv3.1 9.8 (CRITICAL) · EPSS 90th percentile

CWECWE 415VNDVideolabsTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-03-18
2020-03-18 22:15Z
HIGH

CVE-2020-10673 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-10673

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus). CVSSv3.1 8.8 (HIGH) · EPSS 94th percentile

CWECWE 502VNDOracleVNDNetappVNDFasterxmlTYPVulnerability
8.8
CVSS v3.1
96
Edit Score
2020-03-18
2020-03-18 22:15Z
HIGH

CVE-2020-10672 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-10672

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms). CVSSv3.1 8.8 (HIGH) · EPSS 87th percentile

CWECWE 502VNDOracleVNDNetappVNDFasterxmlTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2020-03-16
2020-03-16 16:15Z
CRIT

CVE-2020-6990 — Rockwellautomation Micrologix_1400_a_firmware: Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-6990

Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic key utilized to help protect the account password is hard coded into the RSLogix 500 binary file. An attacker could identify cryptographic keys and use it for further cryptographic attacks that could ultimately lead to a remote attacker gaining unauthorized access to the controll CVSSv3.1 9.8 (CRITICAL) · EPSS 34th percentile

CWECWE 798CWECWE 321VNDRockwellautomationVNDRockwellTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2020-03-12
2020-03-12 19:15Z
HIGH

CVE-2020-10531 — Icu-project International_components_for_unicode: An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-10531

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. CVSSv3.1 8.8 (HIGH) · EPSS 85th percentile

CWECWE 787CWECWE 190VNDIcu ProjectVNDInternationalTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2020-03-12
2020-03-12 16:15Z
CRIT

CVE-2020-0796 — Microsoft Windows_10_1903: A remote code execution vulnerability exists in the way that the Microsoft Server Message

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-0796in the wild

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'. CVSSv3.1 10.0 (CRITICAL) · EPSS 100th percentile

CWECWE 119VNDMicrosoftTYPVulnerabilitySTAitw exploited
10.0
CVSS v3.1
100
Edit Score
2020-03-12
2020-03-12 16:15Z
HIGH

CVE-2020-0787 — Microsoft Windows_10_1507: An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS)

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-0787in the wild

An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'. CVSSv3.1 7.8 (HIGH) · EPSS 99th percentile

CWECWE 59VNDMicrosoftTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
100
Edit Score
2020-03-04
2020-03-04 20:15Z
CRIT

CVE-2020-9054 — Zyxel Nas326_firmware: Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-9054in the wild

Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can all CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 78VNDZyxelTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2020-03-02
2020-03-02 21:15Z
CRIT

CVE-2019-14893 — Fasterxml Jackson-databind: A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-14893

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw CVSSv3.1 9.8 (CRITICAL) · EPSS 90th percentile

CWECWE 502CWECWE 200VNDOracleVNDNetappVNDFasterxmlTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-03-02
2020-03-02 17:15Z
CRIT

CVE-2019-14892 — Fasterxml Jackson-databind: A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2019-14892

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 93th percentile

CWECWE 502CWECWE 200VNDFasterxmlTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-03-02
2020-03-02 04:15Z
CRIT

CVE-2020-9548 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-9548

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile

CWECWE 502VNDNetappVNDFasterxmlTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-03-02
2020-03-02 04:15Z
CRIT

CVE-2020-9547 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-9547

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile

CWECWE 502VNDNetappVNDFasterxmlTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-03-02
2020-03-02 04:15Z
CRIT

CVE-2020-9546 — Fasterxml Jackson-databind: 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-9546

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config). CVSSv3.1 9.8 (CRITICAL) · EPSS 85th percentile

CWECWE 502VNDNetappVNDFasterxmlTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2020-02-24
2020-02-24 22:15Z
CRIT

CVE-2020-1938 — Apache Geode: This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2020-1938in the wild

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configur CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

VNDApacheVNDFedoraprojectTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score