CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
A CSV injection (aka Excel Macro Injection or Formula Injection) issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export.
A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 allows remote attackers to inject arbitrary web script or HTML via the viewMode, tvMode, tvType, objID, catgID, objTypeID, or editMode parameter.
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading ' ' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
An issue was discovered in HiveMQ Broker Control Center 4.3.2. A crafted clientid parameter in an MQTT packet (sent to the Broker) is reflected in the client section of the management console. The attacker's JavaScript is loaded in a browser, which can lead to theft of the session and cookie of the administrator's account of the Broker.
Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1381.
Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
In Zoho ManageEngine OpManager before 125144, when is used, directory traversal validation can be bypassed.
Arrows_nx_f05-f_firmware, Arrows_nx_f05-f, Gp7000f_firmware, Gp7000f, Primepower_firmware, Primepower, Gps_firmware, Gps, Sparc_enterprise_m3000_firmware, Sparc_enterprise_m3000
2022-03-29
N/A
7.4 HIGH
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-13817. Reason: This candidate is a reservation duplicate of CVE-2020-13817. Notes: All CVE users should reference CVE-2020-13817 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.