CVE-2020-12837

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading images to garage doors. The magic bytes of PNG must be used.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Sep 24, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-128389.8ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php.CVE-2020-128399.8ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.php.CVE-2020-12846.5A denial of service vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests,CVE-2020-128406.5ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload sound files via /index.phpCVE-2020-128416.5ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.phpCVE-2020-128429.8ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php.CVE-2020-128439.8ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to garage doors. The magic bytes for WAV mustCVE-2020-128457.5Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crasCVE-2020-128468.0Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /serCVE-2020-128477.2Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console” that is available to users with an administrator roCVE-2020-128485.4In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is crCVE-2020-128495.4Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile
CVE-2020-12837: High severity, CVSS 7.5 | Vulnix