CVE-2020-12130

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Apr 24, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-121316.1The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo).CVE-2020-121326.1Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request.CVE-2020-121339.8The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewStaCVE-2020-121349.8Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.20 mishandle access control for the syslog log.CVE-2020-121355.5bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_spCVE-2020-121376.1GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS CVE-2020-121388.8AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routineCVE-2020-12147.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code ExecutCVE-2020-121408.8A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code CVE-2020-121419.1An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 and earlier allows an attacker to cause a denial of service and potentially discloCVE-2020-121424.91. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentiaCVE-2020-121434.9The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TL
CVE-2020-12130: Medium severity, CVSS 6.1 | Vulnix