CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In February 2020 (CVSS score >= 9)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2020-9463 78 Exec Code 2020-02-28 2020-03-03
9.0
 None Remote Low ??? Complete Complete Complete
Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/internal.php?object=centreon_configuration_remote request.
2 CVE-2020-9398 89 Sql 2020-02-25 2020-03-03
9.3
 None Remote Medium Not required Complete Complete Complete
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
3 CVE-2020-9273 416 Exec Code 2020-02-20 2021-09-14
9.0
 None Remote Low ??? Complete Complete Complete
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.
4 CVE-2020-9269 89 Exec Code Sql 2020-02-18 2020-02-20
9.0
 None Remote Low ??? Complete Complete Complete
SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php.
5 CVE-2020-9043 269 2020-02-17 2021-07-21
9.0
 None Remote Low ??? Complete Complete Complete
The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.
6 CVE-2020-9027 78 2020-02-17 2020-02-19
10.0
 None Remote Low Not required Complete Complete Complete
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected.
7 CVE-2020-9026 78 2020-02-17 2020-02-19
10.0
 None Remote Low Not required Complete Complete Complete
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected.
8 CVE-2020-9024 269 2020-02-17 2021-07-21
10.0
 None Remote Low Not required Complete Complete Complete
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadperl.sh (executed as root at boot time) scripts.
9 CVE-2020-9021 78 2020-02-17 2020-02-20
10.0
 None Remote Low Not required Complete Complete Complete
Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to injections of operating system commands through timeconfig.py via shell metacharacters in the htmlNtpServer parameter.
10 CVE-2020-9020 78 2020-02-17 2020-02-19
10.0
 None Remote Low Not required Complete Complete Complete
Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field.
11 CVE-2020-8964 798 Bypass 2020-02-13 2020-02-25
10.0
 None Remote Low Not required Complete Complete Complete
TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to bypass authentication by placing t3axs=TiMEtOOlsj7G3xMm52wB in a t3.cgi request, aka a "hardcoded cookie."
12 CVE-2020-8963 78 Exec Code 2020-02-13 2020-02-25
10.0
 None Remote Low Not required Complete Complete Complete
TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the t3.cgi srmodel or srtime parameter.
13 CVE-2020-8949 78 Exec Code 2020-02-12 2020-02-25
9.0
 None Remote Low ??? Complete Complete Complete
Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation, as demonstrated by the cgi-bin/webui/admin/tools/app_ping/diag_ping/; substring.
14 CVE-2020-8947 78 Exec Code 2020-02-12 2020-02-14
9.0
 None Remote Low ??? Complete Complete Complete
functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224.
15 CVE-2020-8946 78 Exec Code 2020-02-12 2020-02-21
9.0
 None Remote Low ??? Complete Complete Complete
Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi log_3g_type parameter.
16 CVE-2020-8858 78 Exec Code 2020-02-14 2020-02-19
9.0
 None Remote Low ??? Complete Complete Complete
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552.
17 CVE-2020-8813 78 Exec Code 2020-02-22 2022-05-24
9.3
 None Remote Medium Not required Complete Complete Complete
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
18 CVE-2020-8794 125 Exec Code 2020-02-25 2021-05-04
10.0
 None Remote Low Not required Complete Complete Complete
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.
19 CVE-2020-8655 269 2020-02-07 2022-01-01
9.3
 None Remote Medium Not required Complete Complete Complete
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.
20 CVE-2020-8654 78 2020-02-07 2021-12-30
9.0
 None Remote Low ??? Complete Complete Complete
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.
21 CVE-2020-8636 306 Exec Code 2020-02-06 2020-02-12
10.0
 None Remote Low Not required Complete Complete Complete
An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution .
22 CVE-2020-8515 78 Exec Code 2020-02-01 2022-01-01
10.0
 None Remote Low Not required Complete Complete Complete
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.
23 CVE-2020-8429 20 Bypass 2020-02-11 2021-07-21
9.0
 None Remote Low ??? Complete Complete Complete
The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be exploited to allow an authenticated attacker to run remote code on the underlying operating system. The logFile parameter in the getLogs function was used as a variable in a command to read log files; however, due to poor input sanitisation, it was possible to bypass a replacement and break out of the command.
24 CVE-2020-8010 Exec Code 2020-02-18 2022-04-29
10.0
 None Remote Low Not required Complete Complete Complete
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.
25 CVE-2020-6969 522 2020-02-05 2020-02-14
10.0
 None Remote Low Not required Complete Complete Complete
It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More Touch Panels EA9 series: firmware versions prior to 6.53 and manipulate system configurations.
26 CVE-2020-6842 78 Exec Code 2020-02-21 2020-02-25
9.0
 None Remote Low ??? Complete Complete Complete
D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the media renderer name.
27 CVE-2020-6841 78 Exec Code 2020-02-21 2020-02-25
10.0
 None Remote Low Not required Complete Complete Complete
D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter.
28 CVE-2020-6770 502 Exec Code 2020-02-07 2020-02-12
10.0
 None Remote Low Not required Complete Complete Complete
Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000 and DIVAR IP 7000 if a vulnerable BVMS version is installed.
29 CVE-2020-6760 78 Exec Code 2020-02-06 2020-02-11
10.0
 None Remote Low Not required Complete Complete Complete
Schmid ZI 620 V400 VPN 090 routers allow an attacker to execute OS commands as root via shell metacharacters to an entry on the SSH subcommand menu, as demonstrated by ping.
30 CVE-2020-6192 20 Exec Code 2020-02-12 2020-02-19
9.0
 None Remote Low ??? Complete Complete Complete
SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP Landscape Management.
31 CVE-2020-6191 20 2020-02-12 2020-02-19
9.0
 None Remote Low ??? Complete Complete Complete
SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation.
32 CVE-2020-5245 74 Exec Code 2020-02-24 2022-05-12
9.0
 None Remote Low ??? Complete Complete Complete
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.
33 CVE-2020-5242 863 Exec Code 2020-02-20 2020-02-26
9.3
 None Remote Medium Not required Complete Complete Complete
openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file which cannot be changed via REST calls.
34 CVE-2020-4222 78 Exec Code 2020-02-24 2022-01-01
10.0
 None Remote Low Not required Complete Complete Complete
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175091.
35 CVE-2020-4213 78 Exec Code 2020-02-24 2022-01-01
10.0
 None Remote Low Not required Complete Complete Complete
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175024.
36 CVE-2020-4212 20 Exec Code 2020-02-24 2022-01-01
10.0
 None Remote Low Not required Complete Complete Complete
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175023.
37 CVE-2020-4211 78 Exec Code 2020-02-24 2022-01-01
10.0
 None Remote Low Not required Complete Complete Complete
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175022.
38 CVE-2020-4210 78 Exec Code 2020-02-24 2022-01-01
10.0
 None Remote Low Not required Complete Complete Complete
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175020.
39 CVE-2020-3925 Exec Code 2020-02-03 2020-02-12
9.3
 None Remote Medium Not required Complete Complete Complete
A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts.
40 CVE-2020-3924 74 2020-02-27 2021-07-21
10.0
 None Remote Low Not required Complete Complete Complete
DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a patch file and gain access to the system.
41 CVE-2020-3923 863 2020-02-27 2021-07-21
10.0
 None Remote Low Not required Complete Complete Complete
DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crack the default password and gain access to the system.
42 CVE-2020-3871 119 Exec Code Overflow Mem. Corr. 2020-02-27 2021-07-21
9.3
 None Remote Medium Not required Complete Complete Complete
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arbitrary code with kernel privileges.
43 CVE-2020-3868 787 Exec Code Mem. Corr. 2020-02-27 2021-12-01
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to arbitrary code execution.
44 CVE-2020-3858 119 Exec Code Overflow Mem. Corr. 2020-02-27 2021-07-21
9.3
 None Remote Medium Not required Complete Complete Complete
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. An application may be able to execute arbitrary code with kernel privileges.
45 CVE-2020-3856 20 Mem. Corr. 2020-02-27 2021-07-21
9.3
 None Remote Medium Not required Complete Complete Complete
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. Processing a maliciously crafted string may lead to heap corruption.
46 CVE-2020-3854 119 Exec Code Overflow Mem. Corr. 2020-02-27 2021-07-21
9.3
 None Remote Medium Not required Complete Complete Complete
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arbitrary code with system privileges.
47 CVE-2020-3853 843 Exec Code 2020-02-27 2020-03-03
9.3
 None Remote Medium Not required Complete Complete Complete
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. A malicious application may be able to execute arbitrary code with system privileges.
48 CVE-2020-3845 119 Exec Code Overflow Mem. Corr. 2020-02-27 2021-07-21
9.3
 None Remote Medium Not required Complete Complete Complete
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arbitrary code with system privileges.
49 CVE-2020-3843 787 Mem. Corr. 2020-02-27 2022-05-31
9.3
 None Remote Medium Not required Complete Complete Complete
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4.7, watchOS 5.3.7. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
50 CVE-2020-3842 119 Exec Code Overflow Mem. Corr. 2020-02-27 2021-07-21
9.3
 None Remote Medium Not required Complete Complete Complete
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
Total number of vulnerabilities : 121   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.