CVE-2020-15297

CRITICAL Year: 2020
CVSS v3 Score
9.1
Critical
CVSS v2 Score
6.4
Medium
Weakness Type
CWE-918
View all →

Vulnerability Description

Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged attacker to bypass the in-place mitigations and interact with hosts on the network. This issue affects: Bitdefender Update Server versions prior to 6.6.20.294.

Related Vulnerabilities

CVE-2017-14611

CRITICAL
CVSS:9.1(Critical)

SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued ahe...

CWE-9182017

CVE-2018-1000138

CRITICAL
CVSS:9.1(Critical)

I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or upda...

CWE-9182018

CVE-2018-16444

CRITICAL
CVSS:9.1(Critical)

An issue was discovered in SeaCMS 6.61. adm1n/admin_reslib.php has SSRF via the url parameter.

CWE-9182018

CVE-2018-19601

CRITICAL
CVSS:9.1(Critical)

Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.

CWE-9182018

CVE-2018-9302

CRITICAL
CVSS:9.1(Critical)

SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter....

CWE-9182018

CVE-2019-12994

CRITICAL
CVSS:9.1(Critical)

Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.

CWE-9182019