From DHS/US-CERT’s National Vulnerability Database
CVE-2020-25498
PUBLISHED: 2021-01-06
Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and “Keyword” in URL Filter.
CVE-2020-35262
PUBLISHED: 2021-01-06
Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and “Keyword” in URL Filter.
CVE-2020-29041
PUBLISHED: 2021-01-06
A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension (code review). Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contain…
CVE-2020-36178
PUBLISHED: 2021-01-06
oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables).
CVE-2020-8264
PUBLISHED: 2021-01-06
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulne…
