2020-09-18

2020-09-19

2020-09-20

All (3) Critical (1) High (8) Medium (3)

CVE-2020-25786 Sep 19, 20:15 MEDIUM POC This Month

webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

PHP XSS D-Link Dir 645 Firmware Dir 815 Firmware +4

NVD GitHub

CVSS 3.1

6.1

EPSS

1.0%

CVE-2020-5421 Sep 19, 04:15 MEDIUM PATCH This Month

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable.

Authentication Bypass Java Oracle VMware Oncommand Insight +38

NVD

CVSS 3.1

6.5

EPSS

10.7%

CVE-2020-25789 Sep 19, 21:15 MEDIUM PATCH This Month

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

XSS Tiny Tiny Rss Tt Rss

NVD

CVSS 3.1

6.1

EPSS

0.9%