آسیب‌پذیری‌های حیاتی هفته سوم اسفندماه
این هفته در محصول بسیار مهم Qualcomm آسیب‌پذیری‌های زیادی با سطح خطر «حیاتی» و «بالا» شناسایی شد. همچنین محصولات پرکاربرد شرکت سیسکو، SUSE و D-Link نیز چندین آسیب‌پذیری حیاتی داشتند. مرورگر محبوب موزیلا فایرفاکس و محصولات امنیتی ESET نیز دارای آسیب‌پذیری‌های با سطح خطر «حیاتی» بودند. آسیب‌پذیری‌های این هفته بیشتر از نوع تخریب حافظه بودند.
|
نوع آسیب‌پذیری |
محصول آسیب‌پذیر |
شناسه آسیب‌پذیری |
|
Cross Site Scripting |
Alfresco Enterprise/Community Document Upload |
CVE-2020-8778 |
|
Cross Site Scripting |
Alfresco Enterprise/Community URL Property |
CVE-2020-8776 |
|
Cross Site Scripting |
Alfresco Enterprise/Community User Profile Photo |
CVE-2020-8777 |
|
Privilege Escalation |
Ansible Pipe Lookup Plugin subprocess.Popen() |
CVE-2020-1734 |
|
Privilege Escalation |
Artica Pandora FMS Web Admin File Upload |
CVE-2020-8500 |
|
Denial of Service |
BitTorrent uTorrent Bencoding Parser |
CVE-2020-8437 |
|
Cross Site Request Forgery |
Centreon call.php |
CVE-2019-17642 |
|
Information Disclosure |
Centreon GetXMLHost4Services.php |
CVE-2019-17643 |
|
SQL Injection |
Centreon hostXML.php |
CVE-2019-17647 |
|
Information Disclosure |
Centreon |
CVE-2019-17646 |
|
Information Disclosure |
Centreon refreshMacroAjax.php |
CVE-2019-17645 |
|
Information Disclosure |
Centreon refreshMacroAjax.php |
CVE-2019-17644 |
|
Denial of Service |
Cisco Cisco Email Security Appliance Advanced Malware Protection Resource Exhaustion |
CVE-2020-3181 |
|
Denial of Service |
Cisco Email Security Appliance Web-based Management Interface CPU Exhaustion |
CVE-2020-3164 |
|
Cross Site Scripting |
Cisco Identity Services Engine Web-based Management Interface |
CVE-2020-3157 |
|
Weak Authentication |
Cisco Intelligent Proximity SSL Man-in-the-Middle |
CVE-2020-3155 |
|
Denial of Service |
Cisco IOS XR IPsec Packet Processor |
CVE-2020-3190 |
|
Cross Site Scripting |
Cisco Prime Collaboration Provisioning Web-based Management Interface |
CVE-2020-3192 |
|
Information Disclosure |
Cisco Prime Collaboration Provisioning Web-based Management Interface |
CVE-2020-3193 |
|
Privilege Escalation |
Cisco Remote PHY Device Software Linux Shell |
CVE-2020-3176 |
|
Denial of Service |
Cisco FXOS and NX-OS Software Cisco Discovery Protocol Arbitrary Code Execution and |
CVE-2020-3172 |
|
Command Injection |
Cisco FXOS and UCS Manager Software Local Management CLI |
CVE-2020-3171 |
|
Command Injection |
Cisco FXOS and UCS Manager Software CLI |
CVE-2020-3167 |
|
Cross Site Scripting |
Cisco TelePresence Management Suite Web-based Management Interface |
CVE-2020-3185 |
|
Information Disclosure |
Cisco Webex Meetings Client mDNS |
CVE-2020-3182 |
|
Privilege Escalation |
Cisco WebEx Network Recording Player/Webex Player |
CVE-2020-3128 |
|
Privilege Escalation |
Cisco WebEx Network Recording Player/Webex Player |
CVE-2020-3127 |
|
Privilege Escalation |
CNCF Envoy Access Control |
CVE-2020-8664 |
|
Denial of Service |
CNCF Envoy Pipeline Memory Exhaustion |
CVE-2020-8661 |
|
Denial of Service |
CNCF Envoy Proxy Memory Exhaustion |
CVE-2020-8659 |
|
Privilege Escalation |
CNCF Envoy TLS Inspector |
CVE-2020-8660 |
|
Command Injection |
Comtrend VR-3033 Diagnostic Page |
CVE-2020-10173 |
|
Cross Site Request Forgery |
Coscp Prime Network Registrar Web-based Interface |
CVE-2020-3148 |
|
Privilege Escalation |
Craft CMS Seomatic Injection |
CVE-2020-9757 |
|
Weak Authentication |
D-Link DSL-2640B E1 Administrative Interface |
CVE-2020-9544 |
|
Information Disclosure |
D-Link DSL-2680 Web Administration Interface Config |
CVE-2019-19224 |
|
Privilege Escalation |
D-Link DSL-2680 Web Administration Interface dns_1 |
CVE-2019-19225 |
|
Cross Site Scripting |
D-Link DSL-2680 Web Administration Interface info.html |
CVE-2019-19222 |
|
Denial of Service |
D-Link DSL-2680 Web Administration Interface reboot.html |
CVE-2019-19223 |
|
Privilege Escalation |
D-Link DSL-2680 Web Administration Interface WlanMacFilter_1 |
CVE-2019-19226 |
|
Privilege Escalation |
D-Link DWL-2600AP |
CVE-2019-20501 |
|
Privilege Escalation |
D-Link DWL-2600AP |
CVE-2019-20500 |
|
Privilege Escalation |
D-Link DWL-2600AP |
CVE-2019-20499 |
|
Memory Corruption |
D-Link DIR-615Jx10 fmwlan.c |
CVE-2020-9535 |
|
Memory Corruption |
D-Link DIR-615Jx10 fmwlan.c |
CVE-2020-9534 |
|
SQL Injection |
Django |
CVE-2020-9402 |
|
Memory Corruption |
EFS Easy Chat Server body2.ghp |
CVE-2019-20502 |
|
Privilege Escalation |
Emerson ValveLink Configuration Parameter |
CVE-2020-6971 |
|
Denial of Service |
ESET Cyber Security |
CVE-2019-17549 |
|
Privilege Escalation |
ESET Cyber Security Permission |
CVE-2019-19792 |
|
Privilege Escalation |
ESET Smart Security Premium AV Parsing Engine |
CVE-2020-10180 |
|
Unknown Vulnerability |
FasterXML jackson-databind br.com.anteros.dbcp.AnterosDBCPConfig Serialized |
CVE-2020-9548 |
|
Unknown Vulnerability |
FasterXML jackson-databind Serialized |
CVE-2020-9547 |
|
Unknown Vulnerability |
FasterXML jackson-databind Serialized |
CVE-2020-9546 |
|
Cross Site Request Forgery |
GeniXCMS Incomplete Fix |
CVE-2020-10057 |
|
Memory Corruption |
GNU C Library Double Function e_rem_pio2l.c |
CVE-2020-10029 |
|
Cross Site Scripting |
HCL Connections Help System |
CVE-2020-4082 |
|
Information Disclosure |
HCL Connections |
CVE-2020-4083 |
|
Memory Corruption |
HHVM JSON Decoding TryParse |
CVE-2020-1893 |
|
Denial of Service |
HHVM JSON handleBackslash |
CVE-2020-1888 |
|
Memory Corruption |
HHVM JSON JSON_parser |
CVE-2020-1892 |
|
Information Disclosure |
HPE OneView Global Dashboard |
CVE-2020-7130 |
|
Weak Authentication |
Humax HGA12R-02 BRGCAA Session |
CVE-2020-9370 |
|
Weak Authentication |
Humax HGA12R-02 BRGCAA Web-based Interface |
CVE-2020-9477 |
|
Denial of Service |
Huawei NIP6800/Secospace USG6600/Secospace USG9500 |
CVE-2020-1881 |
|
Privilege Escalation |
Huawei NIP6800/Secospace USG6600/Secospace USG9500 |
CVE-2020-1877 |
|
Memory Corruption |
Huawei NIP6800/Secospace USG6600/Secospace USG9500 Out-of-Bounds |
CVE-2020-1876 |
|
Denial of Service |
Huawei NIP6800/Secospace USG6600/Secospace USG9500 Reboot |
CVE-2020-1875 |
|
Denial of Service |
Huawei NIP6800/Secospace USG6600/Secospace USG9500 |
CVE-2020-1874 |
|
Memory Corruption |
Huawei NIP6800/Secospace USG6600/Secospace USG9500 Out-of-Bounds |
CVE-2020-1873 |
|
Information Disclosure |
Huawei CloudEngine 12800 |
CVE-2020-1861 |
|
Privilege Escalation |
Huawei NIP6800/Secospace USG6600/Secospace USG9500 Access Control |
CVE-2020-1860 |
|
Privilege Escalation |
Huawei PCManager |
CVE-2020-1844 |
|
Memory Corruption |
Huawei Honor V10 Driver Out-of-Bounds |
CVE-2020-1792 |
|
Privilege Escalation |
IBM Platform LSF |
CVE-2020-4278 |
|
Information Disclosure |
IBM Tivoli Netcool/OMNIbus_GUI Web Pages Storage |
CVE-2020-4197 |
|
Cross Site Scripting |
IBM Tivoli Netcool/OMNIbus_GUI Web UI |
CVE-2020-4198 |
|
Cross Site Scripting |
IBM Tivoli Netcool/OMNIbus_GUI Web UI |
CVE-2020-4196 |
|
Privilege Escalation |
IPTV Smarters Web TV Player Upload OS |
CVE-2020-9380 |
|
Weak Authentication |
lua-openssl X.509 Certificate Validation |
CVE-2020-9434 |
|
Weak Authentication |
lua-openssl X.509 Certificate Validation |
CVE-2020-9433 |
|
Weak Authentication |
lua-openssl X.509 Certificate Validation openssl_x509_check_host |
CVE-2020-9432 |
|
Memory Corruption |
Mozilla Firefox |
CVE-2020-6801 |
|
Memory Corruption |
Mozilla Firefox/Firefox ESR/Thunderbird |
CVE-2020-6800 |
|
Privilege Escalation |
Mozilla Firefox/Firefox ESR Argument Injection |
CVE-2020-6799 |
|
Privilege Escalation |
Mozilla Firefox/Firefox ESR/Thunderbird Template Tag |
CVE-2020-6798 |
|
Privilege Escalation |
Mozilla Firefox/Firefox ESR/Thunderbird File Download |
CVE-2020-6797 |
|
Memory Corruption |
Mozilla Firefox Crash Reporting |
CVE-2020-6796 |
|
Denial of Service |
Mozilla Thunderbird SMIME NULL Pointer Dereference |
CVE-2020-6795 |
|
Information Disclosure |
Mozilla Thunderbird Password |
CVE-2020-6794 |
|
Information Disclosure |
Mozilla Thunderbird Envelope Memory |
CVE-2020-6793 |
|
Memory Corruption |
Mozilla Thunderbird Uninitialized Memory |
CVE-2020-6792 |
|
Privilege Escalation |
Mozilla Firefox/Firefox ESR/Thunderbird IonMonkey JIT Compiler Type Confusion |
CVE-2019-17026 |
|
Cross Site Scripting |
Mozilla IoT Gateway Reflected |
CVE-2020-6804 |
|
Open Redirect |
Mozilla IoT Gateway Login Page |
CVE-2020-6803 |
|
Information Disclosure |
NAVER Cloud Explorer Upgrade File Download |
CVE-2020-9751 |
|
Privilege Escalation |
NVIDIA Windows GPU Display Driver Control Panel |
CVE-2020-5957 |
|
Denial of Service |
Omron PLC CJ Ethernet Module |
CVE-2020-6986 |
|
Privilege Escalation |
OpenBlocks IoT VX2 OS |
CVE-2020-5535 |
|
Weak Authentication |
OpenBlocks IoT VX2 |
CVE-2020-5536 |
|
Privilege Escalation |
PDFescape Desktop Installer |
CVE-2020-9418 |
|
SQL Injection |
PHPGurukul Daily Expense Tracker System index.php |
CVE-2020-10106 |
|
Cross Site Scripting |
PHPGurukul Daily Expense Tracker System manage-expense.php |
CVE-2020-10107 |
|
Cross Site Request Forgery |
phpipam result.php |
CVE-2020-7988 |
|
Denial of Service |
Qt WebSocket Memory Consumption |
CVE-2018-21035 |
|
Denial of Service |
QEMU vnc-enc-zrle.c zrle_compress_data |
CVE-2019-20382 |
|
Privilege Escalation |
Qualcomm Snapdragon Auto AC Config |
CVE-2019-14071 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Audio Use-After-Free |
CVE-2019-14032 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Clientlog/Serverlog |
CVE-2019-14045 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Clip Out-of-Bounds |
CVE-2019-14048 |
|
Denial of Service |
Qualcomm Snapdragon Auto CSEQ Header NULL Pointer Dereference |
CVE-2019-10549 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Diag Command Heap-based |
CVE-2019-10604 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Driver Uninitialized Memory |
CVE-2019-14079 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Graphics Use-After-Free |
CVE-2019-14029 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Integer Overflow |
CVE-2019-14086 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Keydata Length |
CVE-2019-14098 |
|
Memory Corruption |
Qualcomm Snapdragon Auto LMP Packet |
CVE-2019-14095 |
|
Memory Corruption |
Qualcomm Snapdragon Auto |
CVE-2019-14030 |
|
Memory Corruption |
Qualcomm Snapdragon Auto |
CVE-2019-10586 |
|
Memory Corruption |
Qualcomm Snapdragon Auto |
CVE-2019-10554 |
|
Memory Corruption |
Qualcomm Snapdragon Auto |
CVE-2019-10553 |
|
Memory Corruption |
Qualcomm Snapdragon Auto |
CVE-2019-10552 |
|
Memory Corruption |
Qualcomm Snapdragon Auto msm Routing Out-of-Bounds |
CVE-2019-14068 |
|
Denial of Service |
Qualcomm Snapdragon Auto NULL Pointer Dereference |
CVE-2019-10591 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Out-of-Bounds |
CVE-2019-14050 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Route Use-After-Free |
CVE-2019-10603 |
|
Memory Corruption |
Qualcomm Snapdragon Auto RSN IE |
CVE-2019-14031 |
|
Memory Corruption |
Qualcomm Snapdragon Auto RX FIFO |
CVE-2019-14000 |
|
Memory Corruption |
Qualcomm Snapdragon Auto SDP Body Stack-based |
CVE-2019-10587 |
|
Memory Corruption |
Qualcomm Snapdragon Auto SDP Stack-based |
CVE-2019-10594 |
|
Memory Corruption |
Qualcomm Snapdragon Auto SDP Video |
CVE-2019-10593 |
|
Denial of Service |
Qualcomm Snapdragon Auto Segment NULL Pointer Dereference |
CVE-2019-14061 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Service Descriptor Extended Attribute Parser Integer Underflow |
CVE-2019-14083 |
|
Memory Corruption |
Qualcomm Snapdragon Auto SIP URI |
CVE-2019-10577 |
|
Denial of Service |
Qualcomm Snapdragon Auto SPDM Command NULL Pointer Dereference |
CVE-2019-10616 |
|
Memory Corruption |
Qualcomm Snapdragon Auto SSID Length |
CVE-2019-14028 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Stack-based |
CVE-2019-14015 |
|
Memory Corruption |
Qualcomm Snapdragon Auto Stack-based |
CVE-2019-10569 |
|
Weak Authentication |
Qualcomm Snapdragon Auto TCP SYN Packet Sequence |
CVE-2019-2317 |
|
Memory Corruption |
Qualcomm Snapdragon Auto UE |
CVE-2019-10550 |
|
Unknown Vulnerability |
Qualcomm Snapdragon Auto |
CVE-2019-14072 |
|
Memory Corruption |
Qualcomm Snapdragon Auto UTCB Object Stack-based |
CVE-2019-10612 |
|
Memory Corruption |
Qualcomm Snapdragon Auto WLAN Double-Free |
CVE-2018-11838 |
|
Memory Corruption |
Qualcomm Snapdragon Auto WLAN Driver Out-of-Bounds |
CVE-2019-10526 |
|
Memory Corruption |
Qualcomm Snapdragon Auto WLAN Integer Underflow |
CVE-2019-14085 |
|
Memory Corruption |
Qualcomm Snapdragon Auto WLAN |
CVE-2019-2311 |
|
Memory Corruption |
Qualcomm Snapdragon Auto WLAN |
CVE-2019-2300 |
|
Memory Corruption |
Qualcomm Snapdragon Auto WLAN |
CVE-2019-10546 |
|
Memory Corruption |
Qualcomm Snapdragon Auto WLAN Parser |
CVE-2019-14097 |
|
Memory Corruption |
Qualcomm Snapdragon Auto WLAN WMI |
CVE-2019-14026 |
|
Memory Corruption |
Qualcomm Snapdragon Compute |
CVE-2019-14027 |
|
Memory Corruption |
Qualcomm Snapdragon Compute WLAN |
CVE-2019-14082 |
|
Memory Corruption |
Qualcomm Snapdragon Compute WLAN Module |
CVE-2019-14081 |
|
Information Disclosure |
Reactor Netty HttpClient Credentials |
CVE-2020-5404 |
|
Denial of Service |
Reactor Netty HttpServer |
CVE-2020-5403 |
|
Weak Encryption |
Rubetek SmartHome Beacon Sniffing |
CVE-2020-9550 |
|
Directory Traversal |
Spring Cloud Config spring-cloud-config-server |
CVE-2020-5405 |
|
Privilege Escalation |
SuSE Linux Enterprise Server Code Generation configs.sh |
CVE-2019-3695 |
|
Privilege Escalation |
SuSE Linux Enterprise Server pcp |
CVE-2019-3696 |
|
Privilege Escalation |
SuSE Linux Enterprise Server Symlink |
CVE-2020-8013 |
|
SQL Injection |
TestLink keywordsView.php |
CVE-2019-20107 |
|
Privilege Escalation |
Timeshift Temp File TeeJee.FileSystem.vala init_tmp |
CVE-2020-10174 |
|
Remote Code Execution |
UNCTAD ASYCUDA World Java RMI Server |
CVE-2020-9761 |
|
Privilege Escalation |
Xiaomi AI speaker MDZ-25-DT UART Interface Backdoor |
CVE-2020-8994 |
|
Weak Authentication |
YubiKey Validation Server Sync Endpoint Replay |
CVE-2020-10185 |
|
SQL Injection |
YubiKey Validation Server Verify Endpoint |
CVE-2020-10184 |
|
Information Disclosure |
Zammad 404.html |
CVE-2020-10105 |
|
Information Disclosure |
Zammad Access Control |
CVE-2020-10100 |
|
Information Disclosure |
Zammad Cache |
CVE-2020-10096 |
|
Cross Site Scripting |
Zammad Email |
CVE-2020-10098 |
|
Information Disclosure |
Zammad Error Message |
CVE-2020-10097 |
|
Unknown Vulnerability |
Zammad File Upload |
CVE-2020-10103 |
|
Information Disclosure |
Zammad Forgot Password Email |
CVE-2020-10102 |
|
Unknown Vulnerability |
Zammad Ticket |
CVE-2020-10099 |
|
Information Disclosure |
Zammad URL Hash |
CVE-2020-10104 |
|
Denial of Service |
Zammad WebSocket Server Crash |
CVE-2020-10101 |
