CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
Vigor2925_firmware, Vigor_2925, Vigor_2925n, Vigor2925ac, Vigor2925fn, Vigor2925n-plus, Vigor2925vac, Vigor2925vn-plus, Vigor300b_firmware, Vigor300b
2020-06-23
N/A
9.8 CRITICAL
A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 3 of 3).
Vigor2925_firmware, Vigor_2925, Vigor_2925n, Vigor2925ac, Vigor2925fn, Vigor2925n-plus, Vigor2925vac, Vigor2925vn-plus, Vigor300b_firmware, Vigor300b
2020-06-23
N/A
9.8 CRITICAL
A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 2 of 3).
Vigor2925_firmware, Vigor_2925, Vigor_2925n, Vigor2925ac, Vigor2925fn, Vigor2925n-plus, Vigor2925vac, Vigor2925vn-plus, Vigor300b_firmware, Vigor300b
2020-06-23
N/A
9.8 CRITICAL
A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 1 of 3).
Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1021, CVE-2020-1088.
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.
Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the hostname" field.
The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.
Manageengine_adselfservice_plus, Application_control_plus, Desktop_central, Firewall_analyzer, Log360, Manageengine_access_manager_plus, Manageengine_ad360, Manageengine_adaudit_plus, Manageengine_admanager_plus, Manageengine_analytics_plus
2020-10-15
N/A
7.5 HIGH
Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet.