CVE-2020-10126

HIGH Year: 2020
CVSS v3 Score
7.6
High
CVSS v2 Score
7.2
High
Weakness Type
CWE-305
View all →

Vulnerability Description

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacker with physical access to internal ATM components to restart the host computer and execute arbitrary code with SYSTEM privileges because while booting, the update process looks for CAB archives on removable media and executes a specific file without first validating the signature of the CAB archive.

Related Vulnerabilities

CVE-2020-11012

HIGH
CVSS:7.5(High)

MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating n...

CWE-3052020

CVE-2020-15078

HIGH
CVSS:7.5(High)

OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potential...

CWE-3052020

CVE-2021-43175

HIGH
CVSS:7.5(High)

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API ...

CWE-3052021

CVE-2023-2959

HIGH
CVSS:7.5(High)

Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users.This issue affects Oliva Expertise EKS: before 1.2.

CWE-3052023

CVE-2023-4727

HIGH
CVSS:7.5(High)

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with...

CWE-3052023

CVE-2024-20378

HIGH
CVSS:7.5(High)

A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. This vulnera...

CWE-3052024