CVE-2017-18771
Certain NETGEAR devices are affected by stored XSS. This affects R9000 before 1.0.2.40, R6100 before 1.0.1.1, 6R7500 before 1.0.0.110, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, WNDR4300v2 before 1.0.0.48, and WNR2000v5 before 1.0.0.58.
Source: CVE-2017-18771
CVE-2017-18774
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6100 before 1.0.0.55, D7800 before V1.0.1.24, R7100LG before V1.0.0.32, WNDR4300v1 before 1.0.2.90, and WNDR4500v3 before 1.0.0.48.
Source: CVE-2017-18774
CVE-2017-18753
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects: D6220, running firmware versions prior to 1.0.0.40 D8500, running firmware versions prior to 1.0.3.39 EX3700, running firmware versions prior to 1.0.0.70 EX3800, running firmware versions prior to 1.0.0.70 EX6000, running firmware versions prior to 1.0.0.30 EX6100, running firmware versions prior to 1.0.2.22 EX6120, running firmware versions prior to 1.0.0.40 EX6130, running firmware versions prior to 1.0.0.22 EX6150v1, running firmware versions prior to 1.0.0.42 EX6200, running firmware versions prior to 1.0.3.88 EX7000, running firmware versions prior to 1.0.0.66 R6300v2, running firmware versions prior to 1.0.4.18 R6400, running firmware versions prior to 1.0.1.24 R6400v2, running firmware versions prior to 1.0.2.32 R6700, running firmware versions prior to 1.0.1.22 R6700v3, running firmware versions prior to 1.0.2.32 R6900, running firmware versions prior to 1.0.1.22 R7000, running firmware versions prior to 1.0.9.6 R6900P, running firmware versions prior to 1.0.0.56 R7000P, running firmware versions prior to 1.0.0.56 R7100LG, running firmware versions prior to 1.0.0.42 R7300DST, running firmware versions prior to 1.0.0.54 R7900, running firmware versions prior to 1.0.1.26 R8300, running firmware versions prior to 1.0.2.106 R8500, running firmware versions prior to 1.0.2.106 WN2500RPv2, running firmware versions prior to 1.0.1.54 WNR3500Lv2, running firmware versions prior to 1.2.0.46
Source: CVE-2017-18753
CVE-2020-12640
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
Source: CVE-2020-12640
CVE-2020-12111
Certain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304.
Source: CVE-2020-12111
CVE-2020-12641
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Source: CVE-2020-12641
CVE-2018-21233
TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in core/kernels/decode_bmp_op.cc.
Source: CVE-2018-21233
CVE-2020-10933
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
Source: CVE-2020-10933
CVE-2020-8791
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary user IDs. Valid and current user IDs are trivial to guess because of the user ID assignment convention used by the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and owner-assigned fingerprint names for any range of arbitrary user IDs.
Source: CVE-2020-8791
CVE-2020-10876
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification code that is required for resetting passwords, nor does it properly restrict excessive verification attempts. This allows an attacker to brute force the four-digit verification code in order to bypass email verification and change the password of a victim account.
Source: CVE-2020-10876