CVE-2020-25561

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

SapphireIMS 5 utilized default sapphire:ims credentials to connect the client to server. This credential is saved in ServerConf.config file in the client.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-255626.5In SapphireIMS 5.0, there is no CSRF token present in the entire application. This can lead to CSRF vulnerabilities in critical application CVE-2020-255639.8In SapphireIMS 5.0, it is possible to create local administrator on any client without requiring any credentials by directly accessing RemotCVE-2020-255648.8In SapphireIMS 5.0, it is possible to create local administrator on any client with credentials of a non-privileged user by directly accessiCVE-2020-255659.8In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the porCVE-2020-255669.8In SapphireIMS 5.0, it is possible to take over an account by sending a request to the Save_Password form as shown in POC. Notice that we doCVE-2020-25574.7Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Security). Supported versions that are affCVE-2020-255739.8An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust. It creates an uninitialized NonNull pointer, which violates a noCVE-2020-255747.5An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of servCVE-2020-255759.8An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has CVE-2020-255769.8An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraiCVE-2020-255779.8In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before pCVE-2020-255785.3In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p
CVE-2020-25561: High severity, CVSS 7.8 | Vulnix