CVE Arsenal Intel

CVE-2020-29574

🔥 KEV Software Genérico Database

9.8

CRITICAL

EPSS

12.0%

2020 1 PoC

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2020-17463

🔥 KEV Software Genérico Web Database ⚡ nuclei

9.8

CRITICAL

EPSS

17.5%

2020 2 PoCs

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

nuclei -t CVE-2020-17463.yaml ⎘

↗ PoC 1 ↗ PoC 2 🔍 GCVE ⚔ EDB

CVE-2020-6141

OS4Ed Web Database

9.8

CRITICAL

EPSS

10.8%

2020 CWE-89 1 PoC

An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can send an HTTP request to trigger this vulnerability.

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2020-2884

WebLogic Server Database

9.8

CRITICAL

EPSS

3.9%

2020 2 PoCs

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Sin template local disponible

↗ PoC 1 ↗ PoC 2 🔍 GCVE ⚔ EDB

CVE-2020-2961

Enterprise Manager Base Platform Web Database

9.8

CRITICAL

EPSS

1.6%

2020 1 PoC

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework (Oracle OHS)). Supported versions that are affected are 13.2.0.0 and 13.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Base Platform. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2020-36084

Software Genérico Web Database

9.8

CRITICAL

EPSS

0.6%

2020 1 PoC

SQL Injection vulnerability in SourceCodester Responsive E-Learning System 1.0 allows remote attackers to inject sql query in /elearning/delete_teacher_students.php?id= parameter via id field.

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2020-2953

Retail Customer Management and Segmentation Foundation Web Database

9.8

CRITICAL

EPSS

1.6%

2020 1 PoC

Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Promotions). The supported version that is affected is 18.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Customer Management and Segmentation Foundation. Successful attacks of this vulnerability can result in takeover of Oracle Retail Customer Management and Segmentation Foundation. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2020-14855

Universal Work Queue Web Database

9.8

CRITICAL

EPSS

5.1%

2020 1 PoC

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in takeover of Oracle Universal Work Queue. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2020-6139

OS4Ed Web Database

9.8

CRITICAL

EPSS

0.7%

2020 CWE-89 1 PoC

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email parameter in the password reset page /opensis/ResetUserInfo.php is vulnerable to SQL injection. An attacker can send an HTTP request to trigger this vulnerability.

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2020-13500

Aveva Database

9.8

CRITICAL

EPSS

0.3%

2020 CWE-89 1 PoC

SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter ClassName in CHaD.asmx is vulnerable to unauthenticated SQL injection attacks.

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2020-14687

WebLogic Server Database

9.8

CRITICAL

EPSS

1.9%

2020 1 PoC

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2020-14825

WebLogic Server Database

9.8

CRITICAL

EPSS

20.3%

2020 1 PoC

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2020-14882

🔥 KEV WebLogic Server Web Database ⚡ nuclei

9.8

CRITICAL

EPSS

94.5%

2020 38 PoCs

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

nuclei -t CVE-2020-14882.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 +32 más 🔍 GCVE ⚔ EDB

CVE-2020-2931

Knowledge Web Database

9.8

CRITICAL

EPSS

1.9%

2020 1 PoC

Vulnerability in the Oracle Knowledge product of Oracle Knowledge (component: Web Applications - InfoCenter). Supported versions that are affected are 8.6.0-8.6.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle Knowledge. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2020-14644

🔥 KEV WebLogic Server Database

9.8

CRITICAL

EPSS

93.6%

2020 2 PoCs

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Sin template local disponible

↗ PoC 1 ↗ PoC 2 🔍 GCVE ⚔ EDB

CVE-2020-5722

🔥 KEV Grandstream UCM6200 Series Web Database ⚡ nuclei

9.8

CRITICAL

EPSS

92.7%

2020 3 PoCs

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.

nuclei -t CVE-2020-5722.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 🔍 GCVE ⚔ EDB

CVE-2020-0618

🔥 KEV Microsoft SQL Server Database ⚡ nuclei

9.8

CRITICAL

EPSS

94.3%

2020 6 PoCs

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

nuclei -t CVE-2020-0618.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 🔍 GCVE ⚔ EDB

CVE-2020-2950

Oracle Business Intelligence Enterprise Edition Web Database

9.8

CRITICAL

EPSS

85.9%

2020 2 PoCs

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CV

Sin template local disponible

↗ PoC 1 ↗ PoC 2 🔍 GCVE ⚔ EDB

CVE-2020-2555

🔥 KEV WebCenter Portal Database

9.8

CRITICAL

EPSS

93.1%

2020 15 PoCs

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Sin template local disponible

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 +9 más 🔍 GCVE ⚔ EDB

CVE-2020-14625

WebLogic Server Database

9.8

CRITICAL

EPSS

8.3%

2020 1 PoC

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Sin template local disponible

↗ PoC 1 🔍 GCVE ⚔ EDB