CVE-2020-26943

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-269449.8An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the CVE-2020-269458.1MyBatis before 3.5.6 mishandles deserialization of object streams.CVE-2020-269477.8monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which a CVE-2020-269489.8Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.CVE-2020-26955.3Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Approval Framework). Suppo CVE-2020-269508.8In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condi CVE-2020-269516.1A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker alre CVE-2020-269528.8Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash wh CVE-2020-269534.3It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phish CVE-2020-269544.3When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed de CVE-2020-269556.5When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download opera CVE-2020-269566.1In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerabili