都是github的，不要用在不对的地方哦！
咳咳！郑重声明，只是拿来一起研究一下！
CVE-2020-0022
https://github.com/marcinguy/CVE-2020-0022
https://github.com/leommxj/cve-2020-0022
CVE-2020-0041
https://github.com/bluefrostsecurity/CVE-2020-0041
https://github.com/j4nn/CVE-2020-0041
CVE-2020-0069
https://github.com/R0rt1z2/AutomatedRoot
https://github.com/TheRealJunior/mtk-su-reverse-cve-2020-0069
https://github.com/yanglingxi1993/CVE-2020-0069
https://github.com/quarkslab/CVE-2020-0069_poc
CVE-2020-0096
https://github.com/wyu0hop/CVE-2020-0096
https://github.com/wrlu/StrandHogg2
CVE-2020-0108
https://github.com/wrlu/ServiceCheater
CVE-2020-0121
https://github.com/mooneee/CVE-2020-0121
CVE-2020-0551
https://github.com/bitdefender/lvi-lfb-attack-poc
CVE-2020-0557
https://github.com/hessandrew/CVE-2020-0557_INTEL-SA-00338
CVE-2020-0568
https://github.com/hessandrew/CVE-2020-0568_INTEL-SA-00344
CVE-2020-0601
https://github.com/0xxon/cve-2020-0601
https://github.com/0xxon/cve-2020-0601-plugin
https://github.com/kudelskisecurity/chainoffools
https://github.com/RrUZi/Awesome-CVE-2020-0601
https://github.com/BleepSec/CVE-2020-0601
https://github.com/saleemrashid/badecparams
https://github.com/Hans-MartinHannibalLauridsen/CurveBall
https://github.com/apodlosky/PoC_CurveBall
https://github.com/ioncodes/Curveball
https://github.com/amlweems/gringotts
https://github.com/aloswoya/CVE-2020-0601
https://github.com/talbeerysec/CurveBallDetection
https://github.com/david4599/CurveballCertTool
https://github.com/eastmountyxz/CVE-2020-0601-EXP
https://github.com/eastmountyxz/CVE-2018-20250-WinRAR
https://github.com/gremwell/cve-2020-0601_poc
https://github.com/bsides-rijeka/meetup-2-curveball
https://github.com/NishantRanjantech/CVE-2020-0601-spoofkey
https://github.com/ShayNehmad/twoplustwo
CVE-2020-0609
https://github.com/2d4d/rdg_scanner_cve-2020-0609
https://github.com/ollypwn/BlueGate
https://github.com/MalwareTech/RDGScanner
https://github.com/Bechsen/CVE-2020-0609
https://github.com/ioncodes/BlueGate
CVE-2020-0618
https://github.com/euphrat1ca/CVE-2020-0618
https://github.com/wortell/cve-2020-0618
CVE-2020-0624
https://github.com/james0x40/CVE-2020-0624
CVE-2020-0668
- [itm4n/SysTracingPoc](https://github.com/itm4n/SysTracingPoc)
- [RedCursorSecurityConsulting/CVE-2020-0668](https://github.com/RedCursorSecurityConsulting/CVE-2020-0668)
- [Nan3r/CVE-2020-0668](https://github.com/Nan3r/CVE-2020-0668)
CVE-2020-0674
- [maxpl0it/CVE-2020-0674-Exploit](https://github.com/maxpl0it/CVE-2020-0674-Exploit)
CVE-2020-0683
- [padovah4ck/CVE-2020-0683](https://github.com/padovah4ck/CVE-2020-0683)
CVE-2020-0688
- [random-robbie/cve-2020-0688](https://github.com/random-robbie/cve-2020-0688)
- [Jumbo-WJB/CVE-2020-0688](https://github.com/Jumbo-WJB/CVE-2020-0688)
- [Ridter/cve-2020-0688](https://github.com/Ridter/cve-2020-0688)
- [Yt1g3r/CVE-2020-0688_EXP](https://github.com/Yt1g3r/CVE-2020-0688_EXP)
- [righter83/CVE-2020-0688](https://github.com/righter83/CVE-2020-0688)
- [truongtn/cve-2020-0688](https://github.com/truongtn/cve-2020-0688)
- [onSec-fr/CVE-2020-0688-Scanner](https://github.com/onSec-fr/CVE-2020-0688-Scanner)
- [youncyb/CVE-2020-0688](https://github.com/youncyb/CVE-2020-0688)
- [zcgonvh/CVE-2020-0688](https://github.com/zcgonvh/CVE-2020-0688)
- [justin-p/PSForgot2kEyXCHANGE](https://github.com/justin-p/PSForgot2kEyXCHANGE)
- [cert-lv/CVE-2020-0688](https://github.com/cert-lv/CVE-2020-0688)
- [ravinacademy/CVE-2020-0688](https://github.com/ravinacademy/CVE-2020-0688)
- [ktpdpro/CVE-2020-0688](https://github.com/ktpdpro/CVE-2020-0688)
- [w4fz5uck5/cve-2020-0688-webshell-upload-technique](https://github.com/w4fz5uck5/cve-2020-0688-webshell-upload-technique)
CVE-2020-0708
- [asc0t6e/CVE-2020-0708](https://github.com/asc0t6e/CVE-2020-0708)
CVE-2020-0728
- [irsl/CVE-2020-0728](https://github.com/irsl/CVE-2020-0728)
CVE-2020-0753
- [afang5472/CVE-2020-0753-and-CVE-2020-0754](https://github.com/afang5472/CVE-2020-0753-and-CVE-2020-0754)
- [VikasVarshney/CVE-2020-0753-and-CVE-2020-0754](https://github.com/VikasVarshney/CVE-2020-0753-and-CVE-2020-0754)
CVE-2020-0787
- [cbwang505/CVE-2020-0787-EXP-ALL-WINDOWS-VERSION](https://github.com/cbwang505/CVE-2020-0787-EXP-ALL-WINDOWS-VERSION)
CVE-2020-0796
- [Aekras1a/CVE-2020-0796-PoC](https://github.com/Aekras1a/CVE-2020-0796-PoC)
- [technion/DisableSMBCompression](https://github.com/technion/DisableSMBCompression)
- [T13nn3s/CVE-2020-0796](https://github.com/T13nn3s/CVE-2020-0796)
- [ollypwn/SMBGhost](https://github.com/ollypwn/SMBGhost)
- [joaozietolie/CVE-2020-0796-Checker](https://github.com/joaozietolie/CVE-2020-0796-Checker)
- [ButrintKomoni/cve-2020-0796](https://github.com/ButrintKomoni/cve-2020-0796)
- [dickens88/cve-2020-0796-scanner](https://github.com/dickens88/cve-2020-0796-scanner)
- [kn6869610/CVE-2020-0796](https://github.com/kn6869610/CVE-2020-0796)
- [awareseven/eternalghosttest](https://github.com/awareseven/eternalghosttest)
- [weidutech/CVE-2020-0796-PoC](https://github.com/weidutech/CVE-2020-0796-PoC)
- [OfJAAH/CVE-2020-0796](https://github.com/OfJAAH/CVE-2020-0796)
- [xax007/CVE-2020-0796-Scanner](https://github.com/xax007/CVE-2020-0796-Scanner)
- [Dhoomralochana/Scanners-for-CVE-2020-0796-Testing](https://github.com/Dhoomralochana/Scanners-for-CVE-2020-0796-Testing)
- [UraSecTeam/smbee](https://github.com/UraSecTeam/smbee)
- [0xtobu/CVE-2020-0796](https://github.com/0xtobu/CVE-2020-0796)
- [netscylla/SMBGhost](https://github.com/netscylla/SMBGhost)
- [eerykitty/CVE-2020-0796-PoC](https://github.com/eerykitty/CVE-2020-0796-PoC)
- [wneessen/SMBCompScan](https://github.com/wneessen/SMBCompScan)
- [ioncodes/SMBGhost](https://github.com/ioncodes/SMBGhost)
- [laolisafe/CVE-2020-0796](https://github.com/laolisafe/CVE-2020-0796)
- [gabimarti/SMBScanner](https://github.com/gabimarti/SMBScanner)
- [Almorabea/SMBGhost-WorkaroundApplier](https://github.com/Almorabea/SMBGhost-WorkaroundApplier)
- [IAreKyleW00t/SMBGhosts](https://github.com/IAreKyleW00t/SMBGhosts)
- [vysecurity/CVE-2020-0796](https://github.com/vysecurity/CVE-2020-0796)
- [marcinguy/CVE-2020-0796](https://github.com/marcinguy/CVE-2020-0796)
- [plorinquer/cve-2020-0796](https://github.com/plorinquer/cve-2020-0796)
- [BinaryShadow94/SMBv3.1.1-scan---CVE-2020-0796](https://github.com/BinaryShadow94/SMBv3.1.1-scan---CVE-2020-0796)
- [w1ld3r/SMBGhost_Scanner](https://github.com/w1ld3r/SMBGhost_Scanner)
- [wsfengfan/CVE-2020-0796](https://github.com/wsfengfan/CVE-2020-0796)
- [GuoKerS/aioScan_CVE-2020-0796](https://github.com/GuoKerS/aioScan_CVE-2020-0796)
- [jiansiting/CVE-2020-0796-Scanner](https://github.com/jiansiting/CVE-2020-0796-Scanner)
- [maxpl0it/Unauthenticated-CVE-2020-0796-PoC](https://github.com/maxpl0it/Unauthenticated-CVE-2020-0796-PoC)
- [sujitawake/smbghost](https://github.com/sujitawake/smbghost)
- [julixsalas/CVE-2020-0796](https://github.com/julixsalas/CVE-2020-0796)
- [insightglacier/SMBGhost_Crash_Poc](https://github.com/insightglacier/SMBGhost_Crash_Poc)
- [5l1v3r1/CVE-2020-0796-PoC-and-Scan](https://github.com/5l1v3r1/CVE-2020-0796-PoC-and-Scan)
- [cory-zajicek/CVE-2020-0796-DoS](https://github.com/cory-zajicek/CVE-2020-0796-DoS)
- [tripledd/cve-2020-0796-vuln](https://github.com/tripledd/cve-2020-0796-vuln)
- [danigargu/CVE-2020-0796](https://github.com/danigargu/CVE-2020-0796)
- [ZecOps/CVE-2020-0796-LPE-POC](https://github.com/ZecOps/CVE-2020-0796-LPE-POC)
- [TinToSer/CVE-2020-0796-LPE](https://github.com/TinToSer/CVE-2020-0796-LPE)
- [f1tz/CVE-2020-0796-LPE-EXP](https://github.com/f1tz/CVE-2020-0796-LPE-EXP)
- [tango-j/CVE-2020-0796](https://github.com/tango-j/CVE-2020-0796)
- [jiansiting/CVE-2020-0796](https://github.com/jiansiting/CVE-2020-0796)
- [LabDookhtegan/CVE-2020-0796-EXP](https://github.com/LabDookhtegan/CVE-2020-0796-EXP)
- [Rvn0xsy/CVE_2020_0796_CNA](https://github.com/Rvn0xsy/CVE_2020_0796_CNA)
- [intelliroot-tech/cve-2020-0796-Scanner](https://github.com/intelliroot-tech/cve-2020-0796-Scanner)
- [ZecOps/CVE-2020-0796-RCE-POC](https://github.com/ZecOps/CVE-2020-0796-RCE-POC)
- [thelostworldFree/CVE-2020-0796](https://github.com/thelostworldFree/CVE-2020-0796)
- [section-c/CVE-2020-0796](https://github.com/section-c/CVE-2020-0796)
- [bacth0san96/SMBGhostScanner](https://github.com/bacth0san96/SMBGhostScanner)
- [DreamoneOnly/CVE-2020-0796-LPE](https://github.com/DreamoneOnly/CVE-2020-0796-LPE)
- [halsten/CVE-2020-0796](https://github.com/halsten/CVE-2020-0796)
- [ysyyrps123/CVE-2020-0796](https://github.com/ysyyrps123/CVE-2020-0796)
- [ysyyrps123/CVE-2020-0796-exp](https://github.com/ysyyrps123/CVE-2020-0796-exp)
- [fdbao/SMBGhost](https://github.com/fdbao/SMBGhost)
- [exp-sky/CVE-2020-0796](https://github.com/exp-sky/CVE-2020-0796)
- [Barriuso/SMBGhost_AutomateExploitation](https://github.com/Barriuso/SMBGhost_AutomateExploitation)
- [Almorabea/SMBGhost-LPE-Metasploit-Module](https://github.com/Almorabea/SMBGhost-LPE-Metasploit-Module)
- [ZecOps/SMBGhost-SMBleed-scanner](https://github.com/ZecOps/SMBGhost-SMBleed-scanner)
- [getdrive/smbghost](https://github.com/getdrive/smbghost)
CVE-2020-0797
- [bonesg/CVE-2020-0797](https://github.com/bonesg/CVE-2020-0797)
CVE-2020-0910
- [inetshell/CVE-2020-0910](https://github.com/inetshell/CVE-2020-0910)
CVE-2020-0976
- [ericzhong2010/GUI-Check-CVE-2020-0976](https://github.com/ericzhong2010/GUI-Check-CVE-2020-0976)
CVE-2020-1015
- [0xeb-bp/cve-2020-1015](https://github.com/0xeb-bp/cve-2020-1015)
CVE-2020-1048
- [zveriu/CVE-2009-0229-PoC](https://github.com/zveriu/CVE-2009-0229-PoC)
- [shubham0d/CVE-2020-1048](https://github.com/shubham0d/CVE-2020-1048)
CVE-2020-1054
- [0xeb-bp/cve-2020-1054](https://github.com/0xeb-bp/cve-2020-1054)
- [Iamgublin/CVE-2020-1054](https://github.com/Iamgublin/CVE-2020-1054)
- [HongYe-Code/CVE-2020-1054](https://github.com/HongYe-Code/CVE-2020-1054)
CVE-2020-1066
- [cbwang505/CVE-2020-1066-EXP](https://github.com/cbwang505/CVE-2020-1066-EXP)
CVE-2020-1102
- [DanielRuf/snyk-js-jquery-565129](https://github.com/DanielRuf/snyk-js-jquery-565129)
CVE-2020-1206
- [ZecOps/CVE-2020-1206-POC](https://github.com/ZecOps/CVE-2020-1206-POC)
- [Info-Security-Solution-Kolkata/CVE-2020-1206-Exploit](https://github.com/Info-Security-Solution-Kolkata/CVE-2020-1206-Exploit)
- [Info-Security-Solution-Kolkata/Smbleed-CVE-2020-1206-Exploit](https://github.com/Info-Security-Solution-Kolkata/Smbleed-CVE-2020-1206-Exploit)
CVE-2020-1283
- [RedyOpsResearchLabs/CVE-2020-1283_Windows-Denial-of-Service-Vulnerability](https://github.com/RedyOpsResearchLabs/CVE-2020-1283_Windows-Denial-of-Service-Vulnerability)
CVE-2020-1301
- [P1kAju/CVE-2020-1301](https://github.com/P1kAju/CVE-2020-1301)
- [shubham0d/CVE-2020-1301](https://github.com/shubham0d/CVE-2020-1301)
CVE-2020-1313
- [irsl/CVE-2020-1313](https://github.com/irsl/CVE-2020-1313)
CVE-2020-1337
- [math1as/CVE-2020-1337-exploit](https://github.com/math1as/CVE-2020-1337-exploit)
- [VoidSec/CVE-2020-1337](https://github.com/VoidSec/CVE-2020-1337)
- [neofito/CVE-2020-1337](https://github.com/neofito/CVE-2020-1337)
- [sailay1996/cve-2020-1337-poc](https://github.com/sailay1996/cve-2020-1337-poc)
CVE-2020-1349
- [0neb1n/CVE-2020-1349](https://github.com/0neb1n/CVE-2020-1349)
CVE-2020-1350
- [pr4jwal/NSE-scripts](https://github.com/pr4jwal/NSE-scripts)
- [mr-r3b00t/CVE-2020-1350](https://github.com/mr-r3b00t/CVE-2020-1350)
- [zoomerxsec/Fake_CVE-2020-1350](https://github.com/zoomerxsec/Fake_CVE-2020-1350)
- [T13nn3s/CVE-2020-1350](https://github.com/T13nn3s/CVE-2020-1350)
- [corelight/SIGRed](https://github.com/corelight/SIGRed)
- [jmaddington/dRMM-CVE-2020-1350-response](https://github.com/jmaddington/dRMM-CVE-2020-1350-response)
- [maxpl0it/CVE-2020-1350-DoS](https://github.com/maxpl0it/CVE-2020-1350-DoS)
- [captainGeech42/CVE-2020-1350](https://github.com/captainGeech42/CVE-2020-1350)
- [connormcgarr/CVE-2020-1350](https://github.com/connormcgarr/CVE-2020-1350)
- [5ing/CVE-2020-1350-poc](https://github.com/5ing/CVE-2020-1350-poc)
- [graph-inc/CVE-2020-1350](https://github.com/graph-inc/CVE-2020-1350)
- [CVEmaster/CVE-2020-1350](https://github.com/CVEmaster/CVE-2020-1350)
- [Secuora-Org/CVE-2020-1350-checker.ps1](https://github.com/Secuora-Org/CVE-2020-1350-checker.ps1)
- [gdwnet/cve-2020-1350](https://github.com/gdwnet/cve-2020-1350)
- [simeononsecurity/CVE-2020-1350-Fix](https://github.com/simeononsecurity/CVE-2020-1350-Fix)
CVE-2020-1362
- [Q4n/CVE-2020-1362](https://github.com/Q4n/CVE-2020-1362)
CVE-2020-1472
- [mingchen-script/CVE-2020-1472-visualizer](https://github.com/mingchen-script/CVE-2020-1472-visualizer)
CVE-2020-1764
- [jpts/cve-2020-1764-poc](https://github.com/jpts/cve-2020-1764-poc)
CVE-2020-1938
- [0nise/CVE-2020-1938](https://github.com/0nise/CVE-2020-1938)
- [xindongzhuaizhuai/CVE-2020-1938](https://github.com/xindongzhuaizhuai/CVE-2020-1938)
- [nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC](https://github.com/nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC)
- [bkfish/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner](https://github.com/bkfish/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner)
- [laolisafe/CVE-2020-1938](https://github.com/laolisafe/CVE-2020-1938)
- [DaemonShao/CVE-2020-1938](https://github.com/DaemonShao/CVE-2020-1938)
- [sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read](https://github.com/sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read)
- [fairyming/CVE-2020-1938](https://github.com/fairyming/CVE-2020-1938)
- [dacade/CVE-2020-1938](https://github.com/dacade/CVE-2020-1938)
- [woaiqiukui/CVE-2020-1938TomcatAjpScanner](https://github.com/woaiqiukui/CVE-2020-1938TomcatAjpScanner)
- [fatal0/tomcat-cve-2020-1938-check](https://github.com/fatal0/tomcat-cve-2020-1938-check)
- [ze0r/GhostCat-LFI-exp](https://github.com/ze0r/GhostCat-LFI-exp)
- [delsadan/CNVD-2020-10487-Bulk-verification](https://github.com/delsadan/CNVD-2020-10487-Bulk-verification)
- [00theway/Ghostcat-CNVD-2020-10487](https://github.com/00theway/Ghostcat-CNVD-2020-10487)
- [shaunmclernon/ghostcat-verification](https://github.com/shaunmclernon/ghostcat-verification)
- [Zaziki1337/Ghostcat-CVE-2020-1938](https://github.com/Zaziki1337/Ghostcat-CVE-2020-1938)
- [w4fz5uck5/CVE-2020-1938-Clean-Version](https://github.com/w4fz5uck5/CVE-2020-1938-Clean-Version)
- [syncxx/CVE-2020-1938-Tool](https://github.com/syncxx/CVE-2020-1938-Tool)
- [ZhengHaoCHeng/CNVD-2020-10487](https://github.com/ZhengHaoCHeng/CNVD-2020-10487)
- [I-Runtime-Error/CVE-2020-1938](https://github.com/I-Runtime-Error/CVE-2020-1938)
- [Umesh2807/Ghostcat](https://github.com/Umesh2807/Ghostcat)
- [MateoSec/ghostcatch](https://github.com/MateoSec/ghostcatch)
CVE-2020-1947
- [jas502n/CVE-2020-1947](https://github.com/jas502n/CVE-2020-1947)
- [wsfengfan/CVE-2020-1947](https://github.com/wsfengfan/CVE-2020-1947)
- [shadowsock5/ShardingSphere_CVE-2020-1947](https://github.com/shadowsock5/ShardingSphere_CVE-2020-1947)
- [HexChristmas/CVE-2020-1947](https://github.com/HexChristmas/CVE-2020-1947)
CVE-2020-1948
- [ctlyz123/CVE-2020-1948](https://github.com/ctlyz123/CVE-2020-1948)
- [askDing/cve-2020-1948-poc](https://github.com/askDing/cve-2020-1948-poc)
- [txrw/Dubbo-CVE-2020-1948](https://github.com/txrw/Dubbo-CVE-2020-1948)
- [L0kiii/Dubbo-deserialization](https://github.com/L0kiii/Dubbo-deserialization)
CVE-2020-1967
- [irsl/CVE-2020-1967](https://github.com/irsl/CVE-2020-1967)
CVE-2020-2034
- [blackhatethicalhacking/CVE-2020-2034-POC](https://github.com/blackhatethicalhacking/CVE-2020-2034-POC)
CVE-2020-2333
- [section-c/CVE-2020-2333](https://github.com/section-c/CVE-2020-2333)
CVE-2020-2546
- [hktalent/CVE_2020_2546](https://github.com/hktalent/CVE_2020_2546)
CVE-2020-2551
- [0xn0ne/weblogicScanner](https://github.com/0xn0ne/weblogicScanner)
- [hktalent/CVE-2020-2551](https://github.com/hktalent/CVE-2020-2551)
- [0nise/CVE-2020-2551](https://github.com/0nise/CVE-2020-2551)
- [zzwlpx/weblogicPoc](https://github.com/zzwlpx/weblogicPoc)
- [Dido1960/Weblogic-CVE-2020-2551-To-Internet](https://github.com/Dido1960/Weblogic-CVE-2020-2551-To-Internet)
CVE-2020-2555
- [Hu3sky/CVE-2020-2555](https://github.com/Hu3sky/CVE-2020-2555)
- [wsfengfan/CVE-2020-2555](https://github.com/wsfengfan/CVE-2020-2555)
- [0nise/CVE-2020-2555](https://github.com/0nise/CVE-2020-2555)
- [Y4er/CVE-2020-2555](https://github.com/Y4er/CVE-2020-2555)
- [Maskhe/cve-2020-2555](https://github.com/Maskhe/cve-2020-2555)
CVE-2020-2883
- [Y4er/CVE-2020-2883](https://github.com/Y4er/CVE-2020-2883)
- [MagicZer0/Weblogic_CVE-2020-2883_POC](https://github.com/MagicZer0/Weblogic_CVE-2020-2883_POC)
- [ZZZWD/CVE-2020-2883](https://github.com/ZZZWD/CVE-2020-2883)
CVE-2020-3153
- [shubham0d/CVE-2020-3153](https://github.com/shubham0d/CVE-2020-3153)
- [raspberry-pie/CVE-2020-3153](https://github.com/raspberry-pie/CVE-2020-3153)
- [goichot/CVE-2020-3153](https://github.com/goichot/CVE-2020-3153)
CVE-2020-3187
- [pry0cc/CVE-2020-3187](https://github.com/pry0cc/CVE-2020-3187)
CVE-2020-3452
- [XDev05/CVE-2020-3452-PoC](https://github.com/XDev05/CVE-2020-3452-PoC)
- [Loneyers/cve-2020-3452](https://github.com/Loneyers/cve-2020-3452)
- [PR3R00T/CVE-2020-3452-Cisco-Scanner](https://github.com/PR3R00T/CVE-2020-3452-Cisco-Scanner)
- [mr-r3b00t/CVE-2020-3452](https://github.com/mr-r3b00t/CVE-2020-3452)
- [foulenzer/CVE-2020-3452](https://github.com/foulenzer/CVE-2020-3452)
- [Gh0st0ne/http-vuln-cve2020-3452.nse](https://github.com/Gh0st0ne/http-vuln-cve2020-3452.nse)
- [tacticalDevC/CVE-2020-3452](https://github.com/tacticalDevC/CVE-2020-3452)
- [paran0id34/CVE-2020-3452](https://github.com/paran0id34/CVE-2020-3452)
- [murataydemir/CVE-2020-3452](https://github.com/murataydemir/CVE-2020-3452)
CVE-2020-3766
- [hessandrew/CVE-2020-3766_APSB20-12](https://github.com/hessandrew/CVE-2020-3766_APSB20-12)
CVE-2020-3952
- [commandermoon/CVE-2020-3952](https://github.com/commandermoon/CVE-2020-3952)
- [frustreated/CVE-2020-3952](https://github.com/frustreated/CVE-2020-3952)
- [guardicore/vmware_vcenter_cve_2020_3952](https://github.com/guardicore/vmware_vcenter_cve_2020_3952)
- [gelim/CVE-2020-3952](https://github.com/gelim/CVE-2020-3952)
- [Fa1c0n35/vmware_vcenter_cve_2020_3952](https://github.com/Fa1c0n35/vmware_vcenter_cve_2020_3952)
CVE-2020-3956
- [aaronsvk/CVE-2020-3956](https://github.com/aaronsvk/CVE-2020-3956)
CVE-2020-4276
- [mekoko/CVE-2020-4276](https://github.com/mekoko/CVE-2020-4276)
### CVE-2020-4463
<code>
IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484.
</code>
- [Ibonok/CVE-2020-4463](https://github.com/Ibonok/CVE-2020-4463)
### CVE-2020-5236
<code>
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxxx10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.
</code>
- [motikan2010/CVE-2020-5236](https://github.com/motikan2010/CVE-2020-5236)
### CVE-2020-5250
<code>
In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.
</code>
- [drkbcn/lblfixer_cve2020_5250](https://github.com/drkbcn/lblfixer_cve2020_5250)
### CVE-2020-5254
<code>
In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited. NetHack 3.6.6 resolves this issue.
</code>
- [dpmdpm2/CVE-2020-5254](https://github.com/dpmdpm2/CVE-2020-5254)
### CVE-2020-5260
<code>
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
</code>
- [brompwnie/cve-2020-5260](https://github.com/brompwnie/cve-2020-5260)
- [Asgavar/CVE-2020-5260](https://github.com/Asgavar/CVE-2020-5260)
- [sv3nbeast/CVE-2020-5260](https://github.com/sv3nbeast/CVE-2020-5260)
### CVE-2020-5267
<code>
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.
</code>
- [GUI/legacy-rails-CVE-2020-5267-patch](https://github.com/GUI/legacy-rails-CVE-2020-5267-patch)
### CVE-2020-5410
<code>
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
</code>
- [dead5nd/config-demo](https://github.com/dead5nd/config-demo)
- [osamahamad/CVE-2020-5410-POC](https://github.com/osamahamad/CVE-2020-5410-POC)
### CVE-2020-5837
<code>
Symantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log files that are replaced by symbolic links, which can lead to a potential elevation of privilege.
</code>
- [RedyOpsResearchLabs/SEP-14.2-Arbitrary-Write](https://github.com/RedyOpsResearchLabs/SEP-14.2-Arbitrary-Write)
### CVE-2020-5844
<code>
index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020.
</code>
- [TheCyberGeek/CVE-2020-5844](https://github.com/TheCyberGeek/CVE-2020-5844)
### CVE-2020-5902
<code>
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
</code>
- [zhzyker/exphub](https://github.com/zhzyker/exphub)
- [dwisiswant0/CVE-2020-5902](https://github.com/dwisiswant0/CVE-2020-5902)
- [aqhmal/CVE-2020-5902-Scanner](https://github.com/aqhmal/CVE-2020-5902-Scanner)
- [jas502n/CVE-2020-5902](https://github.com/jas502n/CVE-2020-5902)
- [ar0dd/CVE-2020-5902](https://github.com/ar0dd/CVE-2020-5902)
- [yassineaboukir/CVE-2020-5902](https://github.com/yassineaboukir/CVE-2020-5902)
- [rwincey/CVE-2020-5902-NSE](https://github.com/rwincey/CVE-2020-5902-NSE)
- [Un4gi/CVE-2020-5902](https://github.com/Un4gi/CVE-2020-5902)
- [nsflabs/CVE-2020-5902](https://github.com/nsflabs/CVE-2020-5902)
- [yasserjanah/CVE-2020-5902](https://github.com/yasserjanah/CVE-2020-5902)
- [JaneMandy/CVE-2020-5902](https://github.com/JaneMandy/CVE-2020-5902)
- [JSec1337/RCE-CVE-2020-5902](https://github.com/JSec1337/RCE-CVE-2020-5902)
- [dunderhay/CVE-2020-5902](https://github.com/dunderhay/CVE-2020-5902)
- [r0ttenbeef/cve-2020-5902](https://github.com/r0ttenbeef/cve-2020-5902)
- [sv3nbeast/CVE-2020-5902_RCE](https://github.com/sv3nbeast/CVE-2020-5902_RCE)
- [cybersecurityworks553/scanner-CVE-2020-5902](https://github.com/cybersecurityworks553/scanner-CVE-2020-5902)
- [tututu12138/CVE-2020-5902](https://github.com/tututu12138/CVE-2020-5902)
- [tom0li/CVE-2020-5902](https://github.com/tom0li/CVE-2020-5902)
- [lijiaxing1997/CVE-2020-5902-POC-EXP](https://github.com/lijiaxing1997/CVE-2020-5902-POC-EXP)
- [qlkwej/poc-CVE-2020-5902](https://github.com/qlkwej/poc-CVE-2020-5902)
- [Zinkuth/F5-BIG-IP-CVE-2020-5902](https://github.com/Zinkuth/F5-BIG-IP-CVE-2020-5902)
- [0xAbdullah/CVE-2020-5902](https://github.com/0xAbdullah/CVE-2020-5902)
- [jinnywc/CVE-2020-5902](https://github.com/jinnywc/CVE-2020-5902)
- [GoodiesHQ/F5-Patch](https://github.com/GoodiesHQ/F5-Patch)
- [jiansiting/CVE-2020-5902](https://github.com/jiansiting/CVE-2020-5902)
- [wdlid/CVE-2020-5902-fix](https://github.com/wdlid/CVE-2020-5902-fix)
- [Any3ite/CVE-2020-5902-F5BIG](https://github.com/Any3ite/CVE-2020-5902-F5BIG)
- [k3nundrum/CVE-2020-5902](https://github.com/k3nundrum/CVE-2020-5902)
- [inho28/CVE-2020-5902-F5-BIGIP](https://github.com/inho28/CVE-2020-5902-F5-BIGIP)
- [cristiano-corrado/f5_scanner](https://github.com/cristiano-corrado/f5_scanner)
- [ajdumanhug/CVE-2020-5902](https://github.com/ajdumanhug/CVE-2020-5902)
- [zhzyker/CVE-2020-5902](https://github.com/zhzyker/CVE-2020-5902)
- [GovindPalakkal/EvilRip](https://github.com/GovindPalakkal/EvilRip)
- [dnerzker/CVE-2020-5902](https://github.com/dnerzker/CVE-2020-5902)
- [c130rg/checkvulnCVE2020590](https://github.com/c130rg/checkvulnCVE2020590)
- [halencarjunior/f5scan](https://github.com/halencarjunior/f5scan)
- [deepsecurity-pe/GoF5-CVE-2020-5902](https://github.com/deepsecurity-pe/GoF5-CVE-2020-5902)
- [Shu1L/CVE-2020-5902-fofa-scan](https://github.com/Shu1L/CVE-2020-5902-fofa-scan)
- [d4rk007/F5-Big-IP-CVE-2020-5902-mass-exploiter](https://github.com/d4rk007/F5-Big-IP-CVE-2020-5902-mass-exploiter)
- [TheCyberViking/CVE-2020-5902-Vuln-Checker](https://github.com/TheCyberViking/CVE-2020-5902-Vuln-Checker)
- [itsjeffersonli/CVE-2020-5902](https://github.com/itsjeffersonli/CVE-2020-5902)
- [MrCl0wnLab/checker-CVE-2020-5902](https://github.com/MrCl0wnLab/checker-CVE-2020-5902)
- [qiong-qi/CVE-2020-5902-POC](https://github.com/qiong-qi/CVE-2020-5902-POC)
- [theLSA/f5-bigip-rce-cve-2020-5902](https://github.com/theLSA/f5-bigip-rce-cve-2020-5902)
- [pwnhacker0x18/CVE-2020-5902-Mass](https://github.com/pwnhacker0x18/CVE-2020-5902-Mass)
- [Al1ex/CVE-2020-5902](https://github.com/Al1ex/CVE-2020-5902)
- [momika233/cve-2020-5902](https://github.com/momika233/cve-2020-5902)
- [rockmelodies/CVE-2020-5902-rce-gui](https://github.com/rockmelodies/CVE-2020-5902-rce-gui)
- [f5devcentral/cve-2020-5902-ioc-bigip-checker](https://github.com/f5devcentral/cve-2020-5902-ioc-bigip-checker)
- [corelight/CVE-2020-5902-F5BigIP](https://github.com/corelight/CVE-2020-5902-F5BigIP)
- [Technowlogy-Pushpender/CVE-2020-5902-Scanner](https://github.com/Technowlogy-Pushpender/CVE-2020-5902-Scanner)
- [murataydemir/CVE-2020-5902](https://github.com/murataydemir/CVE-2020-5902)
### CVE-2020-6286
<code>
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.
</code>
- [murataydemir/CVE-2020-6286](https://github.com/murataydemir/CVE-2020-6286)
### CVE-2020-6287
<code>
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
</code>
- [chipik/SAP_RECON](https://github.com/chipik/SAP_RECON)
- [duc-nt/CVE-2020-6287-exploit](https://github.com/duc-nt/CVE-2020-6287-exploit)
- [Onapsis/CVE-2020-6287_RECON-scanner](https://github.com/Onapsis/CVE-2020-6287_RECON-scanner)
- [ynsmroztas/CVE-2020-6287-Sap-Add-User](https://github.com/ynsmroztas/CVE-2020-6287-Sap-Add-User)
- [murataydemir/CVE-2020-6287](https://github.com/murataydemir/CVE-2020-6287)
### CVE-2020-6418
<code>
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
</code>
- [ChoKyuWon/CVE-2020-6418](https://github.com/ChoKyuWon/CVE-2020-6418)
### CVE-2020-6514
<code>
Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream.
</code>
- [cudi1999/CVE-2020-6514](https://github.com/cudi1999/CVE-2020-6514)
### CVE-2020-6519
<code>
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
</code>
- [PerimeterX/CVE-2020-6519](https://github.com/PerimeterX/CVE-2020-6519)
### CVE-2020-6650
<code>
UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates available. This results in arbitrary code execution on the machine where software is installed.
</code>
- [RavSS/Eaton-UPS-Companion-Exploit](https://github.com/RavSS/Eaton-UPS-Companion-Exploit)
### CVE-2020-6861
<code>
A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the master spending key by sending crafted messages to this app selected on a PIN-entered Ledger connected to a host PC.
</code>
- [ph4r05/ledger-app-monero-1.42-vuln](https://github.com/ph4r05/ledger-app-monero-1.42-vuln)
### CVE-2020-6888
- [section-c/CVE-2020-6888](https://github.com/section-c/CVE-2020-6888)
### CVE-2020-7209
<code>
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
</code>
- [cwinfosec/CVE-2020-7209](https://github.com/cwinfosec/CVE-2020-7209)
### CVE-2020-7246
<code>
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.
</code>
- [lnxcrew/CVE-2020-7246](https://github.com/lnxcrew/CVE-2020-7246)
### CVE-2020-7247
<code>
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
</code>
- [FiroSolutions/cve-2020-7247-exploit](https://github.com/FiroSolutions/cve-2020-7247-exploit)
- [superzerosec/cve-2020-7247](https://github.com/superzerosec/cve-2020-7247)
- [r0lh/CVE-2020-7247](https://github.com/r0lh/CVE-2020-7247)
### CVE-2020-7283
<code>
Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to create and edit files via symbolic link manipulation in a location they would otherwise not have access to. This is achieved through running a malicious script or program on the target machine.
</code>
- [RedyOpsResearchLabs/CVE-2020-7283-McAfee-Total-Protection-MTP-16.0.R26-EoP](https://github.com/RedyOpsResearchLabs/CVE-2020-7283-McAfee-Total-Protection-MTP-16.0.R26-EoP)
### CVE-2020-7471
<code>
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.
</code>
- [Saferman/CVE-2020-7471](https://github.com/Saferman/CVE-2020-7471)
- [secoba/DjVul_StringAgg](https://github.com/secoba/DjVul_StringAgg)
- [SNCKER/CVE-2020-7471](https://github.com/SNCKER/CVE-2020-7471)
### CVE-2020-7473
<code>
In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020, allow unauthenticated attackers to access the documents and folders of ShareFile users. NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-8982 and CVE-2020-8983 but has essentially the same risk.
</code>
- [DimitriNL/CTX-CVE-2020-7473](https://github.com/DimitriNL/CTX-CVE-2020-7473)
### CVE-2020-7693
<code>
Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
</code>
- [andsnw/sockjs-dos-py](https://github.com/andsnw/sockjs-dos-py)
### CVE-2020-7799
<code>
An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> Themes), can execute commands on the underlying operating system by abusing freemarker.template.utility.Execute in the Apache FreeMarker engine that processes custom templates.
</code>
- [Pikaqi/cve-2020-7799](https://github.com/Pikaqi/cve-2020-7799)
- [ianxtianxt/CVE-2020-7799](https://github.com/ianxtianxt/CVE-2020-7799)
### CVE-2020-7931
<code>
In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template.
</code>
- [gquere/CVE-2020-7931](https://github.com/gquere/CVE-2020-7931)
### CVE-2020-7961
<code>
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
</code>
- [mzer0one/CVE-2020-7961-POC](https://github.com/mzer0one/CVE-2020-7961-POC)
- [TheSysOwner/CVE-2020-7961-payloads](https://github.com/TheSysOwner/CVE-2020-7961-payloads)
- [wcxxxxx/CVE-2020-7961](https://github.com/wcxxxxx/CVE-2020-7961)
### CVE-2020-7980
<code>
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.
</code>
- [Xh4H/Satellian-CVE-2020-7980](https://github.com/Xh4H/Satellian-CVE-2020-7980)
### CVE-2020-8004
<code>
STMicroelectronics STM32F1 devices have Incorrect Access Control.
</code>
- [wuxx/CVE-2020-8004](https://github.com/wuxx/CVE-2020-8004)
### CVE-2020-8012
<code>
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.
</code>
- [wetw0rk/Exploit-Development](https://github.com/wetw0rk/Exploit-Development)
### CVE-2020-8103
<code>
A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects Bitdefender Antivirus Free versions prior to 1.0.17.178.
</code>
- [RedyOpsResearchLabs/-CVE-2020-8103-Bitdefender-Antivirus-Free-EoP](https://github.com/RedyOpsResearchLabs/-CVE-2020-8103-Bitdefender-Antivirus-Free-EoP)
### CVE-2020-8163
<code>
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
</code>
- [sh286/CVE-2020-8163](https://github.com/sh286/CVE-2020-8163)
- [h4ms1k/CVE-2020-8163](https://github.com/h4ms1k/CVE-2020-8163)
### CVE-2020-8165
<code>
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
</code>
- [masahiro331/CVE-2020-8165](https://github.com/masahiro331/CVE-2020-8165)
### CVE-2020-8193
<code>
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.
</code>
- [jas502n/CVE-2020-8193](https://github.com/jas502n/CVE-2020-8193)
- [Airboi/Citrix-ADC-RCE-CVE-2020-8193](https://github.com/Airboi/Citrix-ADC-RCE-CVE-2020-8193)
- [Zeop-CyberSec/citrix_adc_netscaler_lfi](https://github.com/Zeop-CyberSec/citrix_adc_netscaler_lfi)
- [PR3R00T/CVE-2020-8193-Citrix-Scanner](https://github.com/PR3R00T/CVE-2020-8193-Citrix-Scanner)
- [ctlyz123/CVE-2020-8193](https://github.com/ctlyz123/CVE-2020-8193)
### CVE-2020-8417
<code>
The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.
</code>
- [vulncrate/wp-codesnippets-cve-2020-8417](https://github.com/vulncrate/wp-codesnippets-cve-2020-8417)
- [waleweewe12/CVE-2020-8417](https://github.com/waleweewe12/CVE-2020-8417)
### CVE-2020-8515
<code>
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.
</code>
- [imjdl/CVE-2020-8515-PoC](https://github.com/imjdl/CVE-2020-8515-PoC)
### CVE-2020-8558
<code>
The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.
</code>
- [tabbysable/POC-2020-8558](https://github.com/tabbysable/POC-2020-8558)
- [rhysemmas/martian-packets](https://github.com/rhysemmas/martian-packets)
### CVE-2020-8559
<code>
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
</code>
- [tabbysable/POC-2020-8559](https://github.com/tabbysable/POC-2020-8559)
- [tdwyer/CVE-2020-8559](https://github.com/tdwyer/CVE-2020-8559)
### CVE-2020-8597
<code>
eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.
</code>
- [marcinguy/CVE-2020-8597](https://github.com/marcinguy/CVE-2020-8597)
- [WinMin/CVE-2020-8597](https://github.com/WinMin/CVE-2020-8597)
- [Dilan-Diaz/Point-to-Point-Protocol-Daemon-RCE-Vulnerability-CVE-2020-8597-](https://github.com/Dilan-Diaz/Point-to-Point-Protocol-Daemon-RCE-Vulnerability-CVE-2020-8597-)
### CVE-2020-8617
<code>
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
</code>
- [knqyf263/CVE-2020-8617](https://github.com/knqyf263/CVE-2020-8617)
- [rmkn/cve-2020-8617](https://github.com/rmkn/cve-2020-8617)
### CVE-2020-8809
<code>
Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those), this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters), this can lead to code execution when combined with CVE-2020-8810.
</code>
- [seqred-s-a/gxdlmsdirector-cve](https://github.com/seqred-s-a/gxdlmsdirector-cve)
### CVE-2020-8813
<code>
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
</code>
- [mhaskar/CVE-2020-8813](https://github.com/mhaskar/CVE-2020-8813)
### CVE-2020-8816
<code>
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
</code>
- [AndreyRainchik/CVE-2020-8816](https://github.com/AndreyRainchik/CVE-2020-8816)
- [MartinSohn/CVE-2020-8816](https://github.com/MartinSohn/CVE-2020-8816)
- [cybervaca/CVE-2020-8816](https://github.com/cybervaca/CVE-2020-8816)
- [team0se7en/CVE-2020-8816](https://github.com/team0se7en/CVE-2020-8816)
### CVE-2020-8825
<code>
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
</code>
- [hacky1997/CVE-2020-8825](https://github.com/hacky1997/CVE-2020-8825)
### CVE-2020-8835
<code>
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the introducing commit was backported to that branch. This vulnerability was fixed in 5.6.1, 5.5.14, and 5.4.29. (issue is aka ZDI-CAN-10780)
</code>
- [Prabhashaka/IT19147192-CVE-2020-8835](https://github.com/Prabhashaka/IT19147192-CVE-2020-8835)
- [socketcall/CVE-2020-8835](https://github.com/socketcall/CVE-2020-8835)
- [snappyJack/Rick_write_exp_CVE-2020-8835](https://github.com/snappyJack/Rick_write_exp_CVE-2020-8835)
### CVE-2020-8840
<code>
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
</code>
- [jas502n/CVE-2020-8840](https://github.com/jas502n/CVE-2020-8840)
- [Wfzsec/FastJson1.2.62-RCE](https://github.com/Wfzsec/FastJson1.2.62-RCE)
- [fairyming/CVE-2020-8840](https://github.com/fairyming/CVE-2020-8840)
- [0nise/CVE-2020-8840](https://github.com/0nise/CVE-2020-8840)
- [Blyth0He/CVE-2020-8840](https://github.com/Blyth0He/CVE-2020-8840)
### CVE-2020-8888
- [SnipJoe/CVE-2020-8888](https://github.com/SnipJoe/CVE-2020-8888)
### CVE-2020-8950
<code>
The AUEPLauncher service in Radeon AMD User Experience Program Launcher through 1.0.0.1 on Windows allows elevation of privilege by placing a crafted file in %PROGRAMDATA%AMDPPCupload and then creating a symbolic link in %PROGRAMDATA%AMDPPCtemp that points to an arbitrary folder with an arbitrary file name.
</code>
- [sailay1996/amd_eop_poc](https://github.com/sailay1996/amd_eop_poc)
### CVE-2020-8958
<code>
Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the boaform/admin/formPing Dest IP Address field.
</code>
- [qurbat/gpon](https://github.com/qurbat/gpon)
### CVE-2020-9006
<code>
The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)
</code>
- [tz4678/cve-2020-9006](https://github.com/tz4678/cve-2020-9006)
### CVE-2020-9008
<code>
Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.
</code>
- [kyletimmermans/blackboard-xss](https://github.com/kyletimmermans/blackboard-xss)
### CVE-2020-9038
<code>
Joplin through 1.0.184 allows Arbitrary File Read via XSS.
</code>
- [JavierOlmedo/CVE-2020-9038](https://github.com/JavierOlmedo/CVE-2020-9038)
### CVE-2020-9047
<code>
A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system.
</code>
- [norrismw/CVE-2020-9047](https://github.com/norrismw/CVE-2020-9047)
### CVE-2020-9283
<code>
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
</code>
- [brompwnie/CVE-2020-9283](https://github.com/brompwnie/CVE-2020-9283)
### CVE-2020-9332
<code>
ftusbbus2.sys in FabulaTech USB for Remote Desktop through 2020-02-19 allows privilege escalation via crafted IoCtl code related to a USB HID device.
</code>
- [Sentinel-One/CVE-2020-9332](https://github.com/Sentinel-One/CVE-2020-9332)
### CVE-2020-9375
<code>
TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexpected Referer field.
</code>
- [thewhiteh4t/cve-2020-9375](https://github.com/thewhiteh4t/cve-2020-9375)
### CVE-2020-9376
<code>
** UNSUPPORTED WHEN ASSIGNED ** D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
</code>
- [renatoalencar/dlink-dir610-exploits](https://github.com/renatoalencar/dlink-dir610-exploits)
### CVE-2020-9380
<code>
IPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by uploading a script.
</code>
- [migueltarga/CVE-2020-9380](https://github.com/migueltarga/CVE-2020-9380)
### CVE-2020-9442
<code>
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%OpenVPN Connectdriverstapamd64win10, which allows local users to gain privileges by copying a malicious drvstore.dll there.
</code>
- [hessandrew/CVE-2020-9442](https://github.com/hessandrew/CVE-2020-9442)
### CVE-2020-9460
<code>
Octech Oempro 4.7 through 4.11 allow XSS by an authenticated user. The parameter CampaignName in Campaign.Create is vulnerable.
</code>
- [g-rubert/CVE-2020-9460](https://github.com/g-rubert/CVE-2020-9460)
### CVE-2020-9461
<code>
Octech Oempro 4.7 through 4.11 allow stored XSS by an authenticated user. The FolderName parameter of the Media.CreateFolder command is vulnerable.
</code>
- [g-rubert/CVE-2020-9461](https://github.com/g-rubert/CVE-2020-9461)
### CVE-2020-9484
<code>
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
</code>
- [threedr3am/tomcat-cluster-session-sync-exp](https://github.com/threedr3am/tomcat-cluster-session-sync-exp)
- [masahiro331/CVE-2020-9484](https://github.com/masahiro331/CVE-2020-9484)
- [IdealDreamLast/CVE-2020-9484](https://github.com/IdealDreamLast/CVE-2020-9484)
- [qerogram/CVE-2020-9484](https://github.com/qerogram/CVE-2020-9484)
- [osamahamad/CVE-2020-9484-Mass-Scan](https://github.com/osamahamad/CVE-2020-9484-Mass-Scan)
- [DeviantSec/CVE-2020-9484-Scanner](https://github.com/DeviantSec/CVE-2020-9484-Scanner)
### CVE-2020-9495
<code>
Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects.
</code>
- [ggolawski/CVE-2020-9495](https://github.com/ggolawski/CVE-2020-9495)
### CVE-2020-9547
<code>
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
</code>
- [fairyming/CVE-2020-9547](https://github.com/fairyming/CVE-2020-9547)
### CVE-2020-9548
<code>
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
</code>
- [fairyming/CVE-2020-9548](https://github.com/fairyming/CVE-2020-9548)
### CVE-2020-9758
<code>
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level access, leading to full account takeover. The attack fetches multiple credentials because they are stored in the database (stored XSS). This affects the mobile/chat URI via the lgn and psswrd parameters.
</code>
- [ari034/CVE-2020-9758](https://github.com/ari034/CVE-2020-9758)
### CVE-2020-9768
<code>
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2. An application may be able to execute arbitrary code with system privileges.
</code>
- [MrKris99/CVE-2020-9768](https://github.com/MrKris99/CVE-2020-9768)
### CVE-2020-9781
<code>
The issue was addressed by clearing website permission prompts after navigation. This issue is fixed in iOS 13.4 and iPadOS 13.4. A user may grant website permissions to a site they didn't intend to.
</code>
- [c0d3G33k/Safari-Video-Permission-Spoof-CVE-2020-9781](https://github.com/c0d3G33k/Safari-Video-Permission-Spoof-CVE-2020-9781)
### CVE-2020-9934
- [mattshockl/CVE-2020-9934](https://github.com/mattshockl/CVE-2020-9934)
### CVE-2020-10135
<code>
Legacy pairing and secure-connections pairing authentication in Bluetooth® BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.
</code>
- [marcinguy/CVE-2020-10135-BIAS](https://github.com/marcinguy/CVE-2020-10135-BIAS)
### CVE-2020-10199
<code>
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
</code>
- [jas502n/CVE-2020-10199](https://github.com/jas502n/CVE-2020-10199)
- [zhzyker/CVE-2020-10199_POC-EXP](https://github.com/zhzyker/CVE-2020-10199_POC-EXP)
- [aleenzz/CVE-2020-10199](https://github.com/aleenzz/CVE-2020-10199)
### CVE-2020-10204
<code>
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
</code>
- [duolaoa333/CVE-2020-10204](https://github.com/duolaoa333/CVE-2020-10204)
- [zhzyker/CVE-2020-10204](https://github.com/zhzyker/CVE-2020-10204)
### CVE-2020-10560
<code>
An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can be used to read any file with the permissions of the webserver. This can lead to further compromise. The attacker must conduct a brute-force attack against the SiteKey to insert into a crafted URL for components/OssnComments/ossn_com.php and/or libraries/ossn.lib.upgrade.php.
</code>
- [LucidUnicorn/CVE-2020-10560-Key-Recovery](https://github.com/LucidUnicorn/CVE-2020-10560-Key-Recovery)
- [kevthehermit/CVE-2020-10560](https://github.com/kevthehermit/CVE-2020-10560)
### CVE-2020-10663
<code>
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
</code>
- [rails-lts/json_cve_2020_10663](https://github.com/rails-lts/json_cve_2020_10663)
### CVE-2020-10665
<code>
Docker Desktop allows local privilege escalation to NT AUTHORITYSYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker Desktop for Windows Stable before 2.2.0.4, and Docker Desktop for Windows Edge before 2.2.2.0.
</code>
- [spaceraccoon/CVE-2020-10665](https://github.com/spaceraccoon/CVE-2020-10665)
### CVE-2020-10673
<code>
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
</code>
- [0nise/CVE-2020-10673](https://github.com/0nise/CVE-2020-10673)
- [Al1ex/CVE-2020-10673](https://github.com/Al1ex/CVE-2020-10673)
### CVE-2020-10713
<code>
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
</code>
- [eclypsium/BootHole](https://github.com/eclypsium/BootHole)
### CVE-2020-10749
<code>
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
</code>
- [knqyf263/CVE-2020-10749](https://github.com/knqyf263/CVE-2020-10749)
### CVE-2020-10759
- [justinsteven/CVE-2020-10759-poc](https://github.com/justinsteven/CVE-2020-10759-poc)
### CVE-2020-11076
<code>
In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
</code>
- [dentarg/cougar](https://github.com/dentarg/cougar)
### CVE-2020-11107
<code>
An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini for all users (including admins) to enable arbitrary command execution.
</code>
- [S1lkys/CVE-2020-11107](https://github.com/S1lkys/CVE-2020-11107)
### CVE-2020-11108
<code>
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.
</code>
- [Frichetten/CVE-2020-11108-PoC](https://github.com/Frichetten/CVE-2020-11108-PoC)
### CVE-2020-11113
<code>
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
</code>
- [Al1ex/CVE-2020-11113](https://github.com/Al1ex/CVE-2020-11113)
### CVE-2020-11444
<code>
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
</code>
- [zhzyker/CVE-2020-11444](https://github.com/zhzyker/CVE-2020-11444)
### CVE-2020-11492
<code>
An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to starting Docker with the same name, this attacker can intercept a connection attempt from Docker Service (which runs as SYSTEM), and then impersonate their privileges.
</code>
- [CrackerCat/CVE-2020-11492](https://github.com/CrackerCat/CVE-2020-11492)
### CVE-2020-11493
- [fengjixuchui/CVE-2020-11493](https://github.com/fengjixuchui/CVE-2020-11493)
### CVE-2020-11519
<code>
The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to read or write to physical disc sectors via a \.SecureDocDevice handle. Exploiting this vulnerability results in privileged code execution.
</code>
- [patois/winmagic_sd](https://github.com/patois/winmagic_sd)
### CVE-2020-11539
<code>
An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices. It has been identified that the smart band has no pairing (mode 0 Bluetooth LE security level) The data being transmitted over the air is not encrypted. Adding to this, the data being sent to the smart band doesn't have any authentication or signature verification. Thus, any attacker can control a parameter of the device.
</code>
- [the-girl-who-lived/CVE-2020-11539](https://github.com/the-girl-who-lived/CVE-2020-11539)
### CVE-2020-11579
- [ShielderSec/CVE-2020-11579](https://github.com/ShielderSec/CVE-2020-11579)
### CVE-2020-11650
<code>
An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent.
</code>
- [weinull/CVE-2020-11650](https://github.com/weinull/CVE-2020-11650)
### CVE-2020-11651
<code>
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
</code>
- [chef-cft/salt-vulnerabilities](https://github.com/chef-cft/salt-vulnerabilities)
- [rossengeorgiev/salt-security-backports](https://github.com/rossengeorgiev/salt-security-backports)
- [dozernz/cve-2020-11651](https://github.com/dozernz/cve-2020-11651)
- [0xc0d/CVE-2020-11651](https://github.com/0xc0d/CVE-2020-11651)
- [jasperla/CVE-2020-11651-poc](https://github.com/jasperla/CVE-2020-11651-poc)
- [Imanfeng/SaltStack-Exp](https://github.com/Imanfeng/SaltStack-Exp)
- [bravery9/SaltStack-Exp](https://github.com/bravery9/SaltStack-Exp)
- [kevthehermit/CVE-2020-11651](https://github.com/kevthehermit/CVE-2020-11651)
- [lovelyjuice/cve-2020-11651-exp-plus](https://github.com/lovelyjuice/cve-2020-11651-exp-plus)
- [heikanet/CVE-2020-11651-CVE-2020-11652-EXP](https://github.com/heikanet/CVE-2020-11651-CVE-2020-11652-EXP)
- [RakhithJK/CVE-2020-11651](https://github.com/RakhithJK/CVE-2020-11651)
### CVE-2020-11652
<code>
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
</code>
- [fanjq99/CVE-2020-11652](https://github.com/fanjq99/CVE-2020-11652)
### CVE-2020-11794
- [w4cky/CVE-2020-11794](https://github.com/w4cky/CVE-2020-11794)
### CVE-2020-11890
<code>
An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration.
</code>
- [HoangKien1020/CVE-2020-11890](https://github.com/HoangKien1020/CVE-2020-11890)
### CVE-2020-11896
<code>
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.
</code>
- [Fans0n-Fan/Treck20-Related](https://github.com/Fans0n-Fan/Treck20-Related)
### CVE-2020-11932
<code>
It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.
</code>
- [ProjectorBUg/CVE-2020-11932](https://github.com/ProjectorBUg/CVE-2020-11932)
- [Staubgeborener/CVE-2020-11932](https://github.com/Staubgeborener/CVE-2020-11932)
### CVE-2020-11996
<code>
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
</code>
- [rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996](https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996)
### CVE-2020-12078
<code>
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.
</code>
- [mhaskar/CVE-2020-12078](https://github.com/mhaskar/CVE-2020-12078)
- [84KaliPleXon3/CVE-2020-12078](https://github.com/84KaliPleXon3/CVE-2020-12078)
### CVE-2020-12112
<code>
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.
</code>
- [tchenu/CVE-2020-12112](https://github.com/tchenu/CVE-2020-12112)
### CVE-2020-12116
<code>
Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.
</code>
- [BeetleChunks/CVE-2020-12116](https://github.com/BeetleChunks/CVE-2020-12116)
### CVE-2020-12432
<code>
The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtain an API access token, which can be accomplished if the attacker is able to upload a .docx or .odt file. The associated API endpoints for exploitation are /wopi/files and /wopi/getAccessToken.
</code>
- [d7x/CVE-2020-12432](https://github.com/d7x/CVE-2020-12432)
### CVE-2020-12629
<code>
include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.
</code>
- [mkelepce/CVE-2020-12629](https://github.com/mkelepce/CVE-2020-12629)
### CVE-2020-12688
- [TheCyberGeek/Centreon-20.04](https://github.com/TheCyberGeek/Centreon-20.04)
### CVE-2020-12695
<code>
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.
</code>
- [yunuscadirci/CallStranger](https://github.com/yunuscadirci/CallStranger)
- [corelight/callstranger-detector](https://github.com/corelight/callstranger-detector)
### CVE-2020-12696
<code>
The iframe plugin before 4.5 for WordPress does not sanitize a URL.
</code>
- [g-rubert/CVE-2020-12696](https://github.com/g-rubert/CVE-2020-12696)
### CVE-2020-12712
<code>
A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile.
</code>
- [SanderUbink/CVE-2020-12712](https://github.com/SanderUbink/CVE-2020-12712)
### CVE-2020-12717
<code>
The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected.
</code>
- [wabzqem/covidsafe-CVE-2020-12717-exploit](https://github.com/wabzqem/covidsafe-CVE-2020-12717-exploit)
### CVE-2020-12753
<code>
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Arbitrary code execution can occur via the bootloader because of an EL1/EL3 coldboot vulnerability involving raw_resources. The LG ID is LVE-SMP-200006 (May 2020).
</code>
- [shinyquagsire23/CVE-2020-12753-PoC](https://github.com/shinyquagsire23/CVE-2020-12753-PoC)
### CVE-2020-12800
<code>
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.
</code>
- [amartinsec/CVE-2020-12800](https://github.com/amartinsec/CVE-2020-12800)
### CVE-2020-12828
<code>
An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations over a socket bound to localhost. Binding to the socket and providing a path where a malicious executable file resides leads to executing the malicious executable file with SYSTEM privileges.
</code>
- [0xsha/ZombieVPN](https://github.com/0xsha/ZombieVPN)
### CVE-2020-12832
<code>
WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.
</code>
- [0x05010705/simplefilelist1.7](https://github.com/0x05010705/simplefilelist1.7)
### CVE-2020-12856
<code>
OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.
</code>
- [alwentiu/COVIDSafe-CVE-2020-12856](https://github.com/alwentiu/COVIDSafe-CVE-2020-12856)
### CVE-2020-13094
<code>
Dolibarr before 11.0.4 allows XSS.
</code>
- [mkelepce/CVE-2020-13094](https://github.com/mkelepce/CVE-2020-13094)
### CVE-2020-13151
<code>
Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute() calls, but this is insufficient. Anyone with network access can use a crafted UDF to execute arbitrary OS commands on all nodes of the cluster at the permission level of the user running the Aerospike service.
</code>
- [b4ny4n/CVE-2020-13151](https://github.com/b4ny4n/CVE-2020-13151)
### CVE-2020-13158
<code>
Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter.
</code>
- [InfoSec4Fun/CVE-2020-13158](https://github.com/InfoSec4Fun/CVE-2020-13158)
### CVE-2020-13159
<code>
Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name, dhclient_mac, Hostname, or Alias field. NOTE: this may overlap CVE-2020-10818.
</code>
- [InfoSec4Fun/CVE-2020-13159](https://github.com/InfoSec4Fun/CVE-2020-13159)
### CVE-2020-13254
<code>
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
</code>
- [danpalmer/django-cve-2020-13254](https://github.com/danpalmer/django-cve-2020-13254)
### CVE-2020-13424
<code>
The XCloner component before 3.5.4 for Joomla! allows Authenticated Local File Disclosure.
</code>
- [mkelepce/CVE-2020-13424](https://github.com/mkelepce/CVE-2020-13424)
### CVE-2020-13457
- [alt3kx/CVE-2020-13457](https://github.com/alt3kx/CVE-2020-13457)
### CVE-2020-13640
<code>
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)
</code>
- [asterite3/CVE-2020-13640](https://github.com/asterite3/CVE-2020-13640)
### CVE-2020-13646
<code>
In Cheetah free WiFi 5.1, the driver file (liebaonat.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x830020f8, 0x830020E0, 0x830020E4, or 0x8300210c.
</code>
- [y5s5k5/CVE-2020-13646](https://github.com/y5s5k5/CVE-2020-13646)
### CVE-2020-13777
<code>
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.
</code>
- [0xxon/cve-2020-13777](https://github.com/0xxon/cve-2020-13777)
- [shigeki/challenge_CVE-2020-13777](https://github.com/shigeki/challenge_CVE-2020-13777)
- [prprhyt/PoC_TLS1_3_CVE-2020-13777](https://github.com/prprhyt/PoC_TLS1_3_CVE-2020-13777)
### CVE-2020-13884
<code>
Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows local users to gain privileges during the uninstallation of the application.
</code>
- [hessandrew/CVE-2020-13884](https://github.com/hessandrew/CVE-2020-13884)
### CVE-2020-13885
<code>
Citrix Workspace App before 1912 on Windows has Insecure Permissions which allows local users to gain privileges during the uninstallation of the application.
</code>
- [hessandrew/CVE-2020-13885](https://github.com/hessandrew/CVE-2020-13885)
### CVE-2020-13886
- [lucxssouza/CVE-2020-13886](https://github.com/lucxssouza/CVE-2020-13886)
### CVE-2020-13889
<code>
showAlert() in the administration panel in Bludit 3.12.0 allows XSS.
</code>
- [gh0st56/CVE-2020-13889](https://github.com/gh0st56/CVE-2020-13889)
### CVE-2020-13925
<code>
Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.
</code>
- [bit4woo/CVE-2020-13925](https://github.com/bit4woo/CVE-2020-13925)
### CVE-2020-13996
<code>
The J2Store plugin before 3.3.13 for Joomla! allows a SQL injection attack by a trusted store manager.
</code>
- [mkelepce/CVE-2020-13996](https://github.com/mkelepce/CVE-2020-13996)
### CVE-2020-14064
<code>
IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.
</code>
- [networksecure/CVE-2020-14064](https://github.com/networksecure/CVE-2020-14064)
### CVE-2020-14065
<code>
IceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.
</code>
- [networksecure/CVE-2020-14065](https://github.com/networksecure/CVE-2020-14065)
### CVE-2020-14066
<code>
IceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are dangerous for clients to access.
</code>
- [networksecure/CVE-2020-14066](https://github.com/networksecure/CVE-2020-14066)
### CVE-2020-14199
<code>
BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into making two signatures in certain cases, potentially leading to a huge transaction fee. NOTE: this affects all hardware wallets. It was fixed in 1.9.1 for the Trezor One and 2.3.1 for the Trezor Model T.
</code>
- [nondejus/CVE-2020-14199](https://github.com/nondejus/CVE-2020-14199)
### CVE-2020-14321
- [HoangKien1020/CVE-2020-14321](https://github.com/HoangKien1020/CVE-2020-14321)
### CVE-2020-14645
<code>
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
</code>
- [Y4er/CVE-2020-14645](https://github.com/Y4er/CVE-2020-14645)
- [DaBoQuan/CVE-2020-14645](https://github.com/DaBoQuan/CVE-2020-14645)
- [ChenZIDu/CVE-2020-14645](https://github.com/ChenZIDu/CVE-2020-14645)
### CVE-2020-14947
<code>
OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/ms_config/ms_snmp_config.php is mishandled in get_mib_oid.
</code>
- [mhaskar/CVE-2020-14947](https://github.com/mhaskar/CVE-2020-14947)
### CVE-2020-14955
<code>
In Jiangmin Antivirus 16.0.13.129, the driver file (KVFG.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x220440.
</code>
- [y5s5k5/CVE-2020-14955](https://github.com/y5s5k5/CVE-2020-14955)
### CVE-2020-14957
<code>
In Windows cleaning assistant 3.2, the driver file (AtpKrnl.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x223CCD.
</code>
- [y5s5k5/CVE-2020-14957-CVE-2020-14956](https://github.com/y5s5k5/CVE-2020-14957-CVE-2020-14956)
### CVE-2020-14965
<code>
On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML context of the target pages and stations in the access-control settings via targets_lists_name or hosts_lists_name. The vulnerability can also be exploited through a CSRF, requiring no authentication as an administrator.
</code>
- [g-rubert/CVE-2020-14965](https://github.com/g-rubert/CVE-2020-14965)
### CVE-2020-15051
<code>
An issue was discovered in Artica Proxy before 4.30.000000. Stored XSS exists via the Server Domain Name, Your Email Address, Group Name, MYSQL Server, Database, MYSQL Username, Group Name, and Task Description fields.
</code>
- [pratikshad19/CVE-2020-15051](https://github.com/pratikshad19/CVE-2020-15051)
### CVE-2020-15052
<code>
An issue was discovered in Artica Proxy CE before 4.28.030.418. SQL Injection exists via the Netmask, Hostname, and Alias fields.
</code>
- [pratikshad19/CVE-2020-15052](https://github.com/pratikshad19/CVE-2020-15052)
### CVE-2020-15053
<code>
An issue was discovered in Artica Proxy CE before 4.28.030.418. Reflected XSS exists via these search fields: real time request, System Events, Proxy Events, Proxy Objects, and Firewall objects.
</code>
- [pratikshad19/CVE-2020-15053](https://github.com/pratikshad19/CVE-2020-15053)
### CVE-2020-15367
<code>
Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page.
</code>
- [inflixim4be/CVE-2020-15367](https://github.com/inflixim4be/CVE-2020-15367)
### CVE-2020-15392
<code>
A user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs during password recovery, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames.
</code>
- [inflixim4be/CVE-2020-15392](https://github.com/inflixim4be/CVE-2020-15392)
### CVE-2020-15399
- [mkelepce/CVE-2020-15399](https://github.com/mkelepce/CVE-2020-15399)
### CVE-2020-15778
<code>
scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
</code>
- [cpandya2909/CVE-2020-15778](https://github.com/cpandya2909/CVE-2020-15778)
### CVE-2020-15931
- [optiv/CVE-2020-15931](https://github.com/optiv/CVE-2020-15931)
### CVE-2020-15956
<code>
ActiveMediaServer.exe in ACTi NVR3 Standard Server 3.0.12.42 allows remote unauthenticated attackers to trigger a buffer overflow and application termination via a malformed payload.
</code>
- [megamagnus/cve-2020-15956](https://github.com/megamagnus/cve-2020-15956)
### CVE-2020-72381
- [jdordonezn/CVE-2020-72381](https://github.com/jdordonezn/CVE-2020-72381)
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论