آسیبپذیریهای حیاتی هفته دوم دی‌ماه
این هفته آسیبپذیریهای «حیاتی» و «پرخطر» بسیاری در محصولات مهم Foxit و D-Link گزارش و وصله‌ها و به‌روزرسانی‌هایی به منظور رفع آن‌ها ارائه شد. همچنین در محصولات شرکت‌های F5، Joomla!، Huawei، Apache، IBM و افزونه WordPress چندین آسیبپذیری «حیاتی» و «پرخطر» وجود داشت.
لیست این آسیب‌پذیری‌ها به همراه لینک وصله‌ها و به‌روزرسانی‌های ارائه‌شده در جدول زیر آمده است.
|
شناسه آسیبپذیری |
امتیاز مبنا |
عنوان آسیبپذیری |
ارزش روز صفر |
رفع آسیبپذیری |
|---|---|---|---|---|
|
CVE-2020-24683 |
۹.۸ |
ABB Symphony Plus Operations/Symphony Plus Historian authentication bypass |
$۲k-$5k |
Not Defined |
|
CVE-2020-24680 |
۲.۵ |
ABB Symphony Plus Operations/Symphony Plus Historian credentials storage |
$۰-$۱k |
Not Defined |
|
CVE-2020-24675 |
۹.۸ |
ABB Symphony Plus Operations/Symphony Plus Historian History Server improper authentication |
$۲k-$5k |
Not Defined |
|
CVE-2020-24674 |
۸.۸ |
ABB Symphony Plus Operations/Symphony Plus Historian improper authorization |
$۲k-$5k |
Not Defined |
|
CVE-2020-24676 |
۸.۸ |
ABB Symphony Plus Operations/Symphony Plus Historian insufficient privileges |
$۲k-$5k |
Not Defined |
|
CVE-2020-24679 |
۷.۵ |
ABB Symphony Plus Operations/Symphony Plus Historian Message denial of service |
$۰-$۱k |
Not Defined |
|
CVE-2020-24678 |
۸.۸ |
ABB Symphony Plus Operations/Symphony Plus Historian privileges management |
$۲k-$5k |
Not Defined |
|
CVE-2020-24673 |
۹.۸ |
ABB Symphony Plus Operations/Symphony Plus Historian sql injection |
$۲k-$5k |
Not Defined |
|
CVE-2020-24677 |
۸.۸ |
ABB Symphony Plus Operations/Symphony Plus Historian unusual condition |
$۲k-$5k |
Not Defined |
|
CVE-2020-35598 |
۵.۳ |
Advanced Comment System index.php pathname traversal |
$۰-$۵k |
Not Defined |
|
CVE-2020-17526 |
۷.۷ |
Apache Airflow improper authorization |
$۱۰k-$25k |
|
|
CVE-2020-24360 |
۶.۵ |
Arista EOS 7800R3/EOS 7500R3/EOS 7280R3 ARP Packet denial of service |
$۰-$۵k |
Not Defined |
|
CVE-2020-26569 |
۶.۳ |
Arista EOS EVPN VxLAN access control |
$۰-$۵k |
Not Defined |
|
CVE-2020-15898 |
۶.۳ |
Arista EOS/EOS X VLAN access control |
$۰-$۵k |
|
|
CVE-2020-26281 |
۷.۵ |
async-h1 POST Request request smuggling |
$۲k-$5k |
|
|
CVE-2020-29447 |
۴.۳ |
Atlassian Crucible File Upload denial of service |
$۰-$۱k |
|
|
CVE-2020-8289 |
۷.۳ |
Backblaze bztransmit Helper certificate validation |
$۰-$۵k |
|
|
CVE-2020-8290 |
۵.۵ |
Backblaze bztransmit Helper privileges management |
$۰-$۵k |
|
|
CVE-2020-35677 |
۴.۸ |
BigProf Online Invoicing System pageEditGroup.php cross site scripting |
$۰-$۵k |
|
|
CVE-2020-35676 |
۶.۱ |
BigProf Online Invoicing System Self-Registration membership_signup.php cross site scripting |
$۰-$۵k |
|
|
CVE-2018-1000891 |
۷.۵ |
Bitcoin SV Checksum resource consumption |
$۰-$۵k |
|
|
CVE-2018-1000892 |
۷.۵ |
Bitcoin SV sendheaders Message resource consumption |
$۰-$۵k |
|
|
CVE-2018-1000893 |
۷.۵ |
Bitcoin SV Transaction resource consumption |
$۰-$۵k |
|
|
CVE-2020-35709 |
۶.۳ |
BloofoxCMS Content-Type pathname traversal |
$۰-$۵k |
Not Defined |
|
CVE-2020-26282 |
۱۰.۰ |
BrowserUp Proxy HTTP Content injection |
$۰-$۵k |
|
|
CVE-2020-35623 |
۷.۵ |
CasAuth Extension unknown vulnerability |
$۲k-$5k |
|
|
CVE-2020-13969 |
۴.۳ |
CRK Business Platform erro.aspx cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-13968 |
۷.۳ |
CRK Business Platform sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-29250 |
۳.۵ |
cxuucms admin.php cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-35346 |
۳.۵ |
cxuucms cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-35347 |
۳.۵ |
cxuucms cross-site request forgery |
$۰-$۵k |
Not Defined |
|
CVE-2020-29249 |
۳.۵ |
cxuucms layui-input Class cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-29243 |
۶.۵ |
David Howden Tag readAPICFrame array index |
$۰-$۵k |
|
|
CVE-2020-29245 |
۶.۵ |
David Howden Tag readAtomData array index |
$۰-$۵k |
|
|
CVE-2020-29242 |
۶.۵ |
David Howden Tag readPICFrame array index |
$۰-$۵k |
|
|
CVE-2020-29244 |
۶.۵ |
David Howden Tag readTextWithDescrFrame array index |
$۰-$۵k |
|
|
CVE-2020-35707 |
۳.۵ |
Daybyday New Client Screen cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-35704 |
۳.۵ |
Daybyday New Lead Screen cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-35706 |
۳.۵ |
Daybyday New Project Screen cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-35705 |
۳.۵ |
Daybyday New User Screen cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-26277 |
۶.۱ |
DBdeployer Tarball link following |
$۲k-$5k |
|
|
CVE-2020-26290 |
۹.۳ |
Dex SAML Connector signature verification |
$۰-$۵k |
|
|
CVE-2020-24578 |
۶.۵ |
D-Link DSL-2888A FTP Service information disclosure |
$۵k-$10k |
|
|
CVE-2020-24580 |
۷.۵ |
D-Link DSL-2888A improper authentication |
$۵k-$10k |
|
|
CVE-2020-24579 |
۸.۸ |
D-Link DSL-2888A improper authentication |
$۱۰k-$25k |
|
|
CVE-2020-24581 |
۸.۰ |
D-Link DSL-2888A Web User Interface execute_cmd.cgi os command injection |
$۱۰k-$25k |
|
|
CVE-2020-29474 |
۶.۳ |
EGavilan Media EGM Address Book Admin Panel sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-29472 |
۶.۳ |
EGavilan Media Under Construction Page Admin Panel sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-35276 |
۵.۵ |
EgavilanMedia ECM Address Book Admin Login Panel sql injection |
$۱k-$2k |
Not Defined |
|
CVE-2020-35273 |
۳.۵ |
EgavilanMedia User Registration & Login System with Admin Panel cross-site request forgery |
$۰-$۱k |
Not Defined |
|
CVE-2020-27254 |
۶.۳ |
Emerson Rosemount X-STREAM Gas Analyzer improper authentication |
$۱k-$2k |
Not Defined |
|
CVE-2020-5681 |
۵.۵ |
Epson EpsonNet SetupManager DLL untrusted search path |
$۰-$۵k |
Not Defined |
|
CVE-2020-35712 |
۵.۵ |
Esri ArcGIS Server server-side request forgery |
$۰-$۵k |
|
|
CVE-2020-29552 |
۵.۵ |
Eveo URVE os command injection |
$۱k-$2k |
Not Defined |
|
CVE-2020-29551 |
۵.۵ |
Eveo URVE Shutdown shutdown.php unknown vulnerability |
$۲k-$5k |
Not Defined |
|
CVE-2020-29550 |
۳.۵ |
Eveo URVE sql_db.backup cleartext storage |
$۰-$۱k |
Not Defined |
|
CVE-2020-27729 |
۶.۱ |
F5 BIG-IP APM redirect |
$۵k-$25k |
Not Defined |
|
CVE-2020-27726 |
۶.۱ |
F5 BIG-IP APM Resource Information Page cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-27724 |
۶.۵ |
F5 BIG-IP APM TMM resource consumption |
$۰-$۵k |
Not Defined |
|
CVE-2020-27723 |
۷.۵ |
F5 BIG-IP APM Traffic Management Microkernel denial of service |
$۰-$۵k |
Not Defined |
|
CVE-2020-27722 |
۶.۵ |
F5 BIG-IP APM VDI Plugin resource consumption |
$۰-$۵k |
Not Defined |
|
CVE-2020-27728 |
۷.۵ |
F5 BIG-IP ASM/Advanced WAF AVRD denial of service |
$۰-$۵k |
Not Defined |
|
CVE-2020-27718 |
۷.۵ |
F5 BIG-IP ASM/Advanced WAF JSON Payload resource consumption |
$۰-$۵k |
Not Defined |
|
CVE-2020-27719 |
۶.۱ |
F5 BIG-IP Configuration utility cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-27717 |
۷.۵ |
F5 BIG-IP DNS TMM denial of service |
$۰-$۵k |
Not Defined |
|
CVE-2020-27725 |
۴.۳ |
F5 BIG-IP DNS/BIG-IP GTM zxfrd memory leak |
$۰-$۵k |
Not Defined |
|
CVE-2020-27721 |
۷.۵ |
F5 BIG-IP DNS/BIG-IP LTM GSLB DNS Response denial of service |
$۰-$۵k |
Not Defined |
|
CVE-2020-27727 |
۴.۹ |
F5 BIG-IP iAppsLX REST Installer information disclosure |
$۵k-$25k |
Not Defined |
|
CVE-2020-27720 |
۷.۵ |
F5 BIG-IP LTM Traffic Management Microkernel CGNAT denial of service |
$۰-$۵k |
Not Defined |
|
CVE-2020-27715 |
۷.۵ |
F5 BIG-IP Management Interface resource consumption |
$۰-$۵k |
Not Defined |
|
CVE-2020-27714 |
۷.۵ |
F5 BIG-IP Protocol Inspection Profile denial of service |
$۰-$۵k |
Not Defined |
|
CVE-2020-27716 |
۷.۵ |
F5 BIG-IP Traffic Management Microkernel denial of service |
$۰-$۵k |
Not Defined |
|
CVE-2020-35728 |
۵.۵ |
FasterXML jackson-databind Serialization Gadget unknown vulnerability |
$۰-$۵k |
|
|
CVE-2020-35244 |
۶.۳ |
Flamingo addGroup sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-35245 |
۶.۳ |
Flamingo addUser sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-35284 |
۶.۳ |
Flamingo File Transfer Request pathname traversal |
$۰-$۵k |
Not Defined |
|
CVE-2020-35243 |
۶.۳ |
Flamingo updateUserInfoInDb sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-35242 |
۶.۳ |
Flamingo updateUserTeamInfoInDbAndMemory sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-28096 |
۶.۶ |
Foscam FHD X1 Local Privilege Escalation |
$۰-$۵k |
Not Defined |
|
CVE-2020-13547 |
۸.۸ |
Foxit PDF Reader Browser Plugin memory corruption |
$۲k-$5k |
Not Defined |
|
CVE-2020-13570 |
۸.۸ |
Foxit PDF Reader Browser Plugin use after free |
$۲k-$5k |
Not Defined |
|
CVE-2020-13560 |
۸.۸ |
Foxit PDF Reader Browser Plugin use after free |
$۲k-$5k |
Not Defined |
|
CVE-2020-13557 |
۸.۸ |
Foxit PDF Reader Browser Plugin use after free |
$۲k-$5k |
Not Defined |
|
CVE-2020-29385 |
۵.۵ |
GNOME gdk-pixbuf LZW Compression lzw.c write_indexes infinite loop |
$۰-$۵k |
|
|
CVE-2020-35448 |
۵.۵ |
GNU Binutils libbfd.c bfd_getl_signed_32 heap-based overflow |
$۰-$۵k |
|
|
CVE-2020-14231 |
۸.۸ |
HCL Client Application Access stack-based overflow |
$۲k-$5k |
Not Defined |
|
CVE-2020-14273 |
۴.۳ |
HCL Domino Server Public API denial of service |
$۰-$۵k |
Not Defined |
|
CVE-2020-14270 |
۵.۳ |
HCL Domino Server XPages information disclosure |
$۱k-$2k |
Not Defined |
|
CVE-2020-14225 |
۶.۵ |
HCL iNotes Message Content information disclosure |
$۱k-$2k |
Not Defined |
|
CVE-2020-26287 |
۸.۷ |
HedgeDoc Mermaid Diagram cross site scripting |
$۰-$۵k |
|
|
CVE-2020-26286 |
۷.۵ |
HedgeDoc uploadimage unrestricted upload |
$۰-$۵k |
|
|
CVE-2020-35669 |
۵.۵ |
http Package HTTP Request injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-9120 |
۴.۳ |
Huawei CloudEngine 1800V Messages resource consumption |
$۰-$۵k |
Not Defined |
|
CVE-2020-9137 |
۵.۳ |
Huawei CloudEngine 7800 access control |
$۵k-$25k |
Not Defined |
|
CVE-2020-9200 |
۵.۵ |
Huawei iManager NetEco 6000 csv injection |
$۵k-$25k |
Not Defined |
|
CVE-2020-9201 |
۵.۵ |
Huawei NIP6800/Secospace USG6600/Secospace USG9500 DHCP Message out-of-bounds read |
$۵k-$25k |
Not Defined |
|
CVE-2020-9119 |
۴.۱ |
Huawei Smart Phone access control |
$۰-$۵k |
Not Defined |
|
CVE-2020-9202 |
۳.۵ |
Huawei TE Mobile information disclosure |
$۰-$۵k |
Not Defined |
|
CVE-2020-4794 |
۶.۳ |
IBM Automation Workstream Services improper authorization |
$۱۰k-$25k |
Not Defined |
|
CVE-2020-4642 |
۳.۳ |
IBM DB2/DB2 Connect Server Management Service denial of service |
$۰-$۵k |
Not Defined |
|
CVE-2020-4757 |
۳.۵ |
IBM FileNet Content Manager/Content Navigator Web UI cross site scripting |
$۲k-$5k |
Not Defined |
|
CVE-2020-4555 |
۶.۳ |
IBM Financial Transaction Manager user session |
$۱۰k-$25k |
Not Defined |
|
CVE-2020-4988 |
۷.۳ |
IBM Loopback Javascript injection |
$۱۰k-$25k |
Not Defined |
|
CVE-2020-4870 |
۳.۷ |
IBM MQ Connection denial of service |
$۵k-$10k |
Not Defined |
|
CVE-2020-4843 |
۴.۳ |
IBM Security Secret Server information disclosure |
$۵k-$10k |
Not Defined |
|
CVE-2020-4842 |
۲.۷ |
IBM Security Secret Server information exposure |
$۵k-$10k |
Not Defined |
|
CVE-2020-4841 |
۳.۷ |
IBM Security Secret Server missing encryption |
$۵k-$10k |
Not Defined |
|
CVE-2020-4840 |
۴.۷ |
IBM Security Secret Server redirect |
$۱۰k-$25k |
Not Defined |
|
CVE-2020-35657 |
۶.۳ |
Jaws Theme os command injection |
$۲k-$5k |
Not Defined |
|
CVE-2020-35656 |
۶.۳ |
Jaws unrestricted upload |
$۲k-$5k |
Not Defined |
|
CVE-2020-35616 |
۵.۵ |
Joomla! ACL input validation |
$۵k-$25k |
Not Defined |
|
CVE-2020-35614 |
۳.۵ |
Joomla! Backend Login Page information disclosure |
$۰-$۵k |
Not Defined |
|
CVE-2020-35613 |
۶.۳ |
Joomla! Blacklist sql injection |
$۵k-$25k |
Not Defined |
|
CVE-2020-35610 |
۵.۵ |
Joomla! com_finder access control |
$۵k-$25k |
Not Defined |
|
CVE-2020-35611 |
۴.۳ |
Joomla! Configuration Page information disclosure |
$۵k-$25k |
Not Defined |
|
CVE-2020-35615 |
۳.۵ |
Joomla! Email Export cross-site request forgery |
$۰-$۵k |
Not Defined |
|
CVE-2020-35612 |
۵.۵ |
Joomla! mod_random_image path traversal |
$۵k-$25k |
Not Defined |
|
CVE-2020-35716 |
۷.۵ |
Linksys RE6500 langSwitch denial of service |
$۰-$۵k |
|
|
CVE-2020-35714 |
۸.۸ |
Linksys RE6500 systemCommand command injection |
$۰-$۵k |
|
|
CVE-2020-35715 |
۸.۸ |
Linksys RE6500 upload_settings.cgi os command injection |
$۰-$۵k |
|
|
CVE-2020-28912 |
۶.۳ |
MariaDB Named Pipe Connection channel accessible |
$۰-$۵k |
|
|
CVE-2020-35587 |
۷.۵ |
Mersive Solstice Pod Firmware information disclosure |
$۰-$۱k |
Official Fix |
|
CVE-2020-35586 |
۷.۵ |
Mersive Solstice Pod Open Control API excessive authentication |
$۱k-$2k |
Official Fix |
|
CVE-2020-35585 |
۷.۵ |
Mersive Solstice Pod Open Control API info excessive authentication |
$۱k-$2k |
Official Fix |
|
CVE-2020-35584 |
۷.۵ |
Mersive Solstice Pod Web Services cleartext transmission |
$۰-$۱k |
Official Fix |
|
CVE-2020-35608 |
۷.۸ |
Microsoft Azure Sphere AF_PACKET Socket memory corruption |
$۱۰k-$25k |
|
|
CVE-2020-35609 |
۵.۵ |
Microsoft Azure Sphere ioctl Call memory corruption |
$۱۰k-$25k |
|
|
CVE-2020-29596 |
۷.۵ |
MiniWeb HTTP Server POST Request denial of service |
$۰-$۱k |
|
|
CVE-2020-25196 |
۳.۷ |
Moxa NPort IAW5000A-IO Telnet/SSH excessive authentication |
$۱k-$2k |
|
|
CVE-2020-25192 |
۵.۳ |
Moxa NPort IAW5000A-IO Web Server information disclosure |
$۱k-$2k |
Not Defined |
|
CVE-2020-25190 |
۳.۷ |
Moxa NPort IAW5000A-IO Web Server missing encryption |
$۰-$۱k |
Not Defined |
|
CVE-2020-25194 |
۶.۳ |
Moxa NPort IAW5000A-IO Web Server privileges management |
$۲k-$5k |
Not Defined |
|
CVE-2020-25198 |
۶.۳ |
Moxa NPort IAW5000A-IO Web Server session fixiation |
$۱k-$2k |
Not Defined |
|
CVE-2020-25153 |
۳.۷ |
Moxa NPort IAW5000A-IO Web Service weak password |
$۱k-$2k |
Not Defined |
|
CVE-2020-28460 |
۵.۶ |
multi-ini injection |
$۲k-$5k |
|
|
CVE-2020-28448 |
۹.۸ |
multi-ini injection |
$۲k-$5k |
|
|
CVE-2020-13473 |
۳.۳ |
NCH Express Account Configuration File missing encryption |
$۰-$۵k |
Not Defined |
|
CVE-2020-13474 |
۵.۵ |
NCH Express Account URL access control |
$۰-$۵k |
Not Defined |
|
CVE-2020-13476 |
۳.۵ |
NCH Express Invoice Quotes List Module cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2019-11786 |
۶.۳ |
Odoo Community/Enterprise access control |
$۲k-$5k |
|
|
CVE-2018-15645 |
۸.۱ |
Odoo Community/Enterprise access control |
$۲k-$5k |
|
|
CVE-2018-15634 |
۷.۱ |
Odoo Community/Enterprise Attachment Management cross site scripting |
$۰-$۱k |
|
|
CVE-2018-15641 |
۳.۵ |
Odoo Community/Enterprise Calendar Event cross site scripting |
$۰-$۱k |
|
|
CVE-2019-11782 |
۶.۳ |
Odoo Community/Enterprise Contact Management access control |
$۲k-$5k |
|
|
CVE-2018-15632 |
۹.۱ |
Odoo Community/Enterprise Database input validation |
$۲k-$5k |
|
|
CVE-2018-15633 |
۷.۱ |
Odoo Community/Enterprise Document Module cross site scripting |
$۰-$۱k |
|
|
CVE-2019-11783 |
۶.۵ |
Odoo Community/Enterprise Mail Channel access control |
$۲k-$5k |
|
|
CVE-2019-11785 |
۶.۵ |
Odoo Community/Enterprise Mail Module access control |
$۲k-$5k |
|
|
CVE-2019-11784 |
۶.۵ |
Odoo Community/Enterprise Mail Module access control |
$۲k-$5k |
|
|
CVE-2018-15638 |
۷.۱ |
Odoo Community/Enterprise Mail Module cross site scripting |
$۰-$۱k |
|
|
CVE-2019-11781 |
۸.۸ |
Odoo Community/Enterprise Portal input validation |
$۲k-$5k |
|
|
CVE-2020-29396 |
۷.۴ |
Odoo Community/Enterprise Python sandbox |
$۲k-$5k |
Not Defined |
|
CVE-2020-35680 |
۴.۳ |
OpenSMTPD lka_filter.c null pointer dereference |
$۰-$۵k |
|
|
CVE-2020-35679 |
۳.۵ |
OpenSMTPD Message table.c memory leak |
$۰-$۵k |
|
|
CVE-2020-6159 |
۶.۱ |
Opera Web Browser Address Bar cross site scripting |
$۵k-$10k |
|
|
CVE-2020-14874 |
۴.۷ |
Oracle Cloud Services Infrastructure Identity/Access Management Remote Privilege Escalation |
$۱۰k-$25k |
Not Defined |
|
CVE-2020-29194 |
۲.۱ |
Panasonic Security System WV-S2231L Admin Control Panel set_factory denial of service |
$۰-$۵k |
Not Defined |
|
CVE-2020-29193 |
۴.۳ |
Panasonic Security System WV-S2231L hard-coded password |
$۰-$۵k |
Not Defined |
|
CVE-2020-26766 |
۳.۵ |
PHPGurukul User Registration & Login cross-site request forgery |
$۰-$۵k |
Not Defined |
|
CVE-2020-35708 |
۶.۳ |
PHPList Import Administrators Page sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-8995 |
۷.۳ |
Programi Bilanc hard-coded credentials |
$۱k-$2k |
Not Defined |
|
CVE-2020-11719 |
۵.۳ |
Programi Bilanc inadequate encryption |
$۰-$۵k |
Not Defined |
|
CVE-2020-11720 |
۶.۳ |
Programi Bilanc Installation hard-coded password |
$۱k-$2k |
Not Defined |
|
CVE-2020-11718 |
۳.۷ |
Programi Bilanc software-update Package missing encryption |
$۰-$۱k |
Not Defined |
|
CVE-2020-11717 |
۶.۳ |
Programi sql injection |
$۱k-$2k |
Not Defined |
|
CVE-2020-2503 |
۹.۰ |
QNAP QES File Station cross site scripting |
$۰-$۵k |
|
|
CVE-2020-2504 |
۷.۵ |
QNAP QES File Station path traversal |
$۰-$۵k |
|
|
CVE-2020-2499 |
۷.۲ |
QNAP QES hard-coded password |
$۰-$۵k |
|
|
CVE-2020-2505 |
۲.۳ |
QNAP QES information exposure |
$۰-$۵k |
|
|
CVE-2020-35388 |
۴.۳ |
Rainrocka Xinhu information disclosure |
$۰-$۵k |
Not Defined |
|
CVE-2020-35370 |
۸.۸ |
Raysync code injection |
$۰-$۵k |
|
|
CVE-2020-35713 |
۹.۸ |
RE6500 New Password setSysAdm os command injection |
$۰-$۵k |
|
|
CVE-2020-35668 |
۷.۵ |
RedisGraph null pointer dereference |
$۰-$۵k |
|
|
CVE-2020-35730 |
۳.۵ |
RoundCube Webmail Email Message rcube_string_replacer.php linkref_addindex cross site scripting |
$۰-$۵k |
|
|
CVE-2020-35693 |
۴.۰ |
Samsung Galaxy Note 4 Bluetooth Low Energy information disclosure |
$۰-$۵k |
Not Defined |
|
CVE-2019-16959 |
۶.۵ |
Solarwinds Web Help Desk Formula csv injection |
$۱k-$2k |
Not Defined |
|
CVE-2020-28071 |
۲.۴ |
SourceCodester Alumni Management System gallery.php cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-28070 |
۷.۳ |
SourceCodester Alumni Management System view_event.php sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-28073 |
۷.۳ |
SourceCodester Library Management System sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-28074 |
۷.۳ |
SourceCodester Online Health Care System sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-7845 |
۷.۳ |
Spamsniper Mail From stack-based overflow |
$۰-$۵k |
Not Defined |
|
CVE-2020-35666 |
۷.۳ |
Steedos findone sql injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-25917 |
۸.۸ |
Stratodesk NoTouch Center submitCreateTCUser.do access control |
$۰-$۵k |
|
|
CVE-2020-27515 |
۳.۵ |
TechKshetra Info Solutions Savsoft Quiz cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-35349 |
۳.۵ |
TechKshetra Info Solutions Savsoft Quiz Custom Fields Page field_title cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-5808 |
۷.۵ |
Tenable Tenable.sc Automatic Distribution Configuration unknown vulnerability |
$۲k-$5k |
|
|
CVE-2020-28094 |
۵.۵ |
Tenda AC1200 Download unknown vulnerability |
$۰-$۵k |
Not Defined |
|
CVE-2020-28093 |
۶.۳ |
Tenda AC1200 hard-coded password |
$۰-$۵k |
Not Defined |
|
CVE-2020-29189 |
۶.۳ |
TerraMaster TOS access control |
$۰-$۵k |
Not Defined |
|
CVE-2020-35665 |
۹.۸ |
TerraMaster TOS CSV makecvs.php os command injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-28186 |
۶.۳ |
TerraMaster TOS Forgot Password injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-28184 |
۳.۵ |
TerraMaster TOS index.php cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-28185 |
۵.۳ |
TerraMaster TOS initialise.php information disclosure |
$۰-$۵k |
Not Defined |
|
CVE-2020-28188 |
۷.۳ |
TerraMaster TOS makecvs.php os command injection |
$۰-$۵k |
Not Defined |
|
CVE-2020-28187 |
۶.۳ |
TerraMaster TOS pathname traversal |
$۰-$۵k |
Not Defined |
|
CVE-2020-28190 |
۳.۷ |
TerraMaster TOS Update cleartext transmission |
$۰-$۵k |
Not Defined |
|
CVE-2020-35575 |
۴.۳ |
TP-Link WRD4300 Web Interface information disclosure |
$۰-$۵k |
|
|
CVE-2020-25066 |
۹.۸ |
Treck HTTP Server heap-based overflow |
$۲k-$5k |
Official Fix |
|
CVE-2020-27338 |
۷.۱ |
Treck IPv6 DHCPv6 Client out-of-bounds read |
$۱k-$2k |
Official Fix |
|
CVE-2020-27336 |
۵.۳ |
Treck IPv6 out-of-bounds read |
$۱k-$2k |
Official Fix |
|
CVE-2020-27337 |
۷.۳ |
Treck IPv6 out-of-bounds write |
$۲k-$5k |
Official Fix |
|
CVE-2020-35627 |
۶.۳ |
Ultimate WooCommerce Gift Cards Custom GiftCard Template unrestricted upload |
$۰-$۵k |
|
|
CVE-2020-35650 |
۶.۱ |
Uncanny Groups POST Parameter user-code-redemption.php ulgm_code_redeem cross site scripting |
$۰-$۱k |
|
|
CVE-2020-9439 |
۶.۱ |
Uncanny Owl Tin Canny Reporting TinCan_Content_List_Table.php cross site scripting |
$۰-$۱k |
|
|
CVE-2020-3999 |
۶.۵ |
VMware ESXi/Workstation/Fusion/Cloud Foundation GuestInfo denial of service |
$۲k-$5k |
|
|
CVE-2020-35738 |
۵.۵ |
Wavpack pack_utils.c WavpackPackSamples out-of-bounds write |
$۰-$۵k |
|
|
CVE-2020-35606 |
۸.۰ |
Webmin Package Updates Module unknown vulnerability |
$۲k-$5k |
|
|
CVE-2020-35625 |
۸.۸ |
Widgets Extension Smarty Template command unknown vulnerability |
$۲k-$5k |
|
|
CVE-2020-26422 |
۵.۶ |
Wireshark QUIC Dissector denial of service |
$۰-$۱k |
Not Defined |
|
CVE-2020-29247 |
۳.۵ |
WonderCMS Admin Panel cross site scripting |
$۰-$۵k |
Not Defined |
|
CVE-2020-35589 |
۵.۴ |
WordPress limit-login-attempts-reloaded Plugin cross site scripting |
$۰-$۱k |
|
|
CVE-2020-35590 |
۹.۸ |
WordPress limit-login-attempts-reloaded Plugin X-Forwarded-For Header LimitLoginAttempts.php origin validation |
$۲k-$5k |
|
|
CVE-2020-29172 |
۶.۱ |
WordPress LiteSpeed Cache Plugin cross site scripting |
$۰-$۵k |
|
|
CVE-2020-20412 |
۵.۵ |
Xiph.Org libvorbis OGG File codebook.c array index |
$۰-$۵k |
|
|
CVE-2020-35376 |
۵.۵ |
Xpdf Type 1C Font getOp stack-based overflow |
$۰-$۵k |
Not Defined |
|
CVE-2020-26034 |
۳.۵ |
Zammad Create User information disclosure |
$۰-$۵k |
|
|
CVE-2020-26031 |
۶.۵ |
Zammad Global Search permission |
$۰-$۵k |
|
|
CVE-2020-26032 |
۵.۵ |
Zammad Massenversand server-side request forgery |
$۰-$۵k |
|
|
CVE-2020-29159 |
۵.۵ |
Zammad privileges management |
$۰-$۵k |
|
|
CVE-2020-29160 |
۴.۶ |
Zammad REST API Call access control |
$۰-$۵k |
|
|
CVE-2020-26033 |
۳.۵ |
Zammad REST API cross-site request forgery |
$۰-$۵k |
|
|
CVE-2020-26030 |
۶.۵ |
Zammad SSO Endpoint improper authentication |
$۰-$۵k |
|
|
CVE-2020-26035 |
۳.۵ |
Zammad Tags Element cross site scripting |
$۰-$۵k |
|
|
CVE-2020-29158 |
۵.۵ |
Zammad Ticket Detail View access control |
$۰-$۵k |
|
|
CVE-2020-26028 |
۵.۵ |
Zammad Ticket permission |
$۰-$۵k |
|
|
CVE-2020-26029 |
۵.۵ |
Zammad X-On-Behalf-Of Header improper authorization |
$۰-$۵k |
|
|
CVE-2020-6881 |
۴.۳ |
ZTE E8810/E8820/E8822 MQTT denial of service |
$۰-$۱k |
Not Defined |
|
CVE-2020-6882 |
۴.۳ |
ZTE E8810/E8820/E8822 MQTT Service information disclosure |
$۱k-$2k |
Not Defined |
|
CVE-2020-29583 |
۷.۳ |
ZyXEL USG SSH Server/Web Interface hard-coded password |
$۲k-$5k |
Not Defined |
|
CVE-2020-29299 |
۵.۵ |
ZyXEL VPN On-premise Password Change chg_exp_pwd command injection |
$۰-$۵k |
سطح خطر حدود ۳۳% آسیبپذیریهای هفته، «پرخطر» و «حیاتی» برآورد شده است که بسیار قابل‌توجه است.
متأسفانه تنها برای ۳۸% آسیبپذیریهای هفته، به‌روزرسانی‌ها و یا وصله‌هایی رسماً ارائه شده که برای جلوگیری از سوءاستفاده ازآسیب‌پذیری‌ها بهتر است سریعاً اعمال شوند.
