CVE-2020-36917

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

iDS6 DSSPro Digital Signage System 6.2 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept authentication credentials through cleartext cookie transmission. Attackers can exploit the autoSave feature to capture user passwords during man-in-the-middle attacks on HTTP communications.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Guangzhou Yeroo Tech Co., Ltd.	iDS6 DSSPro Digital Signage System	V6.2 B2014.12.12.1220; V5.6 B2017.07.12.1757; V4.3

References

Timeline

Published: Jan 6, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2020

CVE-2020-369184.3iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative a CVE-2020-369196.1WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject mali CVE-2020-36929.8u'Possible buffer overflow while updating output buffer for IMEI and Gateway Address due to lack of check of input validation for parameters CVE-2020-369208.8iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileg CVE-2020-369217.5RED-V Super Digital Signage System 5.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to access se CVE-2020-369227.5Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive CVE-2020-369239.8Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization c CVE-2020-369246.1Sony BRAVIA Digital Signage 1.7.8 contains a remote file inclusion vulnerability that allows attackers to inject arbitrary client-side scrip CVE-2020-369259.8Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that allows remote attackers to CVE-2020-369265.3SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification deta CVE-2020-369277.8DiskPulse Enterprise 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attacker CVE-2020-369287.8Brother BRAgent 1.38 contains an unquoted service path vulnerability in the WBA_Agent_Client service running with LocalSystem privileges. At