CVE-2020-12101

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by manipulating an id field in the POST request for altering an address.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Apr 30, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-121027.7In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows autheCVE-2020-121037.7In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create baCVE-2020-121048.8The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql fiCVE-2020-121055.9OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls, which might assist attackers in performing man-iCVE-2020-121069.8The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows unauthenticated users to send HTTP POST request to several critical AdministrCVE-2020-121079.8The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows command injection via a text field, which allow full control over this moduleCVE-2020-121086.5/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.CVE-2020-121098.8Certain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0.9 build 200304, NC220 1.3.0 build 200304, CVE-2020-12117.8An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'ConnecCVE-2020-121109.8Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 2CVE-2020-121118.8Certain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450 1.5.3 build 200304.CVE-2020-121127.5BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.