CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
Bcm4389_firmware, Bcm4389, Bcm43012_firmware, Bcm43012, Bcm43013_firmware, Bcm43013, Bcm4375_firmware, Bcm4375, Bcm43752_firmware, Bcm43752, 20007_office_system, 27mhz_wireless_keyboard, 365_apps, 3d_builder, 3d_viewer, Access, Accessibility_insights_for_android, Accessibility_insights_for_web, Access_multilingual_user_interface_pack, Active_directory
2020-10-22
N/A
7.8 HIGH
An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that can allow a local attacker to gain escalated privileges.
Bcm4389_firmware, Bcm4389, Bcm43012_firmware, Bcm43012, Bcm43013_firmware, Bcm43013, Bcm4375_firmware, Bcm4375, Bcm43752_firmware, Bcm43752, Acrn, Audit, Dhcp6c, Direct_connect, Infiniband_hfi1_driver, Ipsec_tools_racoon_daemon, Kernel, Layer_2_tunneling_protocol, Linux_kernel, Linux_kernel_i40e/i40evf, 20007_office_system, 27mhz_wireless_keyboard, 365_apps, 3d_builder, 3d_viewer, Access, Accessibility_insights_for_android, Accessibility_insights_for_web, Access_multilingual_user_interface_pack, Active_directory
2019-12-12
N/A
9.8 CRITICAL
An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code.
Sd-wan_firmware, Vedge-100, Vedge-1000, Vedge-100b, Vedge-2000, Vedge-5000, Vedge_100m, Vedge_100wm, Hyperflex_hx220c_m5_firmware, Hyperflex_hx220c_m5
2020-10-16
N/A
6.6 MEDIUM
A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by accessing the configuration interface, which may require a password, and then accessing the device's physical interface and inserting a USB storage device. A successful exploit could allow the attacker to execute arbitrary commands on the device in an elevated security context. At the time of publication, this vulnerability affected Cisco Small Business SPA500 Series IP Phones firmware releases 7.6.2SR5 and prior.
Datamanager_box_2.0_firmware, Datamanager_box_2.0, Eco_25.0-3-s_firmware, Eco_25.0-3-s, Eco_27.0-3-s_firmware, Eco_27.0-3-s, Galvo_1.5-1_firmware, Galvo_1.5-1, Galvo_1.5-1_208-240_firmware, Galvo_1.5-1_208-240
2019-12-16
N/A
6.5 MEDIUM
admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= Directory Traversal.
Datamanager_box_2.0_firmware, Datamanager_box_2.0, Eco_25.0-3-s_firmware, Eco_25.0-3-s, Eco_27.0-3-s_firmware, Eco_27.0-3-s, Galvo_1.5-1_firmware, Galvo_1.5-1, Galvo_1.5-1_208-240_firmware, Galvo_1.5-1_208-240
2019-12-16
N/A
9.8 CRITICAL
Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file.
In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122.
Dir-825/ac_g1_firmware, Dir-825/ac_g1, Dsl-2875al_firmware, Dsl-2875al, Dsl-2877al_firmware, Dsl-2877al, Dap-1360_revision_f_firmware, Dap-1360_revision_f, Dsl-2680_firmware, Dsl-2680
2020-08-24
N/A
7.5 HIGH
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to enable or disable MAC address filtering by submitting a crafted Forms/WlanMacFilter_1 POST request without being authenticated on the admin interface.
Dir-825/ac_g1_firmware, Dir-825/ac_g1, Dsl-2875al_firmware, Dsl-2875al, Dsl-2877al_firmware, Dsl-2877al, Dap-1360_revision_f_firmware, Dap-1360_revision_f, Dsl-2680_firmware, Dsl-2680
2020-08-24
N/A
7.5 HIGH
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to change DNS servers without being authenticated on the admin interface by submitting a crafted Forms/dns_1 POST request.
Dir-825/ac_g1_firmware, Dir-825/ac_g1, Dsl-2875al_firmware, Dsl-2875al, Dsl-2877al_firmware, Dsl-2877al, Dap-1360_revision_f_firmware, Dap-1360_revision_f, Dsl-2680_firmware, Dsl-2680
2020-08-24
N/A
7.5 HIGH
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to download the configuration (binary file) settings by submitting a rom-0 GET request without being authenticated on the admin interface.
Dir-825/ac_g1_firmware, Dir-825/ac_g1, Dsl-2875al_firmware, Dsl-2875al, Dsl-2877al_firmware, Dsl-2877al, Dap-1360_revision_f_firmware, Dap-1360_revision_f, Dsl-2680_firmware, Dsl-2680
2020-03-05
N/A
7.5 HIGH
A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to reboot the router by submitting a reboot.html GET request without being authenticated on the admin interface.