CVE-2020-11941

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/157476/Open-AudIT-3.2.2-Command-Injection-SQL-Injection.htmlThird Party Advisory
https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.0Release Notes, Third Party Advisory
https://www.coresecurity.com/advisories/open-audit-multiple-vulnerabilitiesExploit, Third Party Advisory
http://packetstormsecurity.com/files/157476/Open-AudIT-3.2.2-Command-Injection-SQL-Injection.htmlThird Party Advisory
https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.0Release Notes, Third Party Advisory
https://www.coresecurity.com/advisories/open-audit-multiple-vulnerabilitiesExploit, Third Party Advisory

Timeline

Published: Apr 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-119429.8An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections.CVE-2020-119438.8An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.CVE-2020-119446.1Abe (aka bitcoin-abe) through 0.7.2, and 0.8pre, allows XSS in __call__ in abe.py because the PATH_INFO environment variable is mishandled d CVE-2020-119459.8An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resource CVE-2020-119467.5Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.CVE-2020-119473.8iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process mem CVE-2020-119496.5testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an a CVE-2020-11953.1An elevation of privilege vulnerability exists in Microsoft Edge (Chromium-based) when the Feedback extension improperly validates input. An CVE-2020-119508.8VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execu CVE-2020-119519.8An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a Backdoor root acco CVE-2020-119526.2An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. Attackers can bypass the CLI CVE-2020-119538.8An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70_4 devices. Attackers can execute code.