CVE-2020-36125

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalidation in sensitive operations can be bypassed remotely by an authenticated attacker through requesting the endpoint directly.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
May 7, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-361268.1Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalationCVE-2020-361276.5Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature fuCVE-2020-361288.2Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session tCVE-2020-361298.8AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.CVE-2020-36137.8Double free issue in kernel memory mapping due to lack of memory protection mechanism in Snapdragon Compute, Snapdragon Mobile, Snapdragon VCVE-2020-361306.5AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.CVE-2020-361318.8AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.CVE-2020-361338.8AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h.CVE-2020-361346.5AOM v2.0.1 was discovered to contain a segmentation violation via the component aom_dsp/x86/obmc_sad_avx2.c.CVE-2020-361356.5AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.CVE-2020-361367.5SQL Injection vulnerability in cskaza cszcms version 1.2.9, allows attackers to gain sensitive information via pm_sendmail parameter in csz_CVE-2020-361387.5An issue was discovered in decode_frame in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service (Do
CVE-2020-36125: High severity, CVSS 7.1 | Vulnix