CVE-2020-6856

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-776

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://change.sos-berlin.com/browse/JOC-853Issue Tracking, Vendor Advisory
https://change.sos-berlin.com/browse/JOC-853Issue Tracking, Vendor Advisory

Timeline

Published: Feb 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-68575.5CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords i CVE-2020-68586.5Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear CVE-2020-68595.3Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for W CVE-2020-68608.8libmysofa 0.9.1 has a stack-based buffer overflow in readDataVar in hdf/dataobject.c during the reading of a header message attribute.CVE-2020-68615.5A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the m CVE-2020-68625.3V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obt CVE-2020-68636.5ZTE E8820V3 router product is impacted by a permission and access control vulnerability. Attackers could use this vulnerability to tamper wi CVE-2020-68646.5ZTE E8820V3 router product is impacted by an information leak vulnerability. Attackers could use this vulnerability to to gain wireless pass CVE-2020-68656.5ZTE SDN controller platform is impacted by an information leakage vulnerability. Due to the program's failure to optimize the response of fa CVE-2020-68664.9A ZTE product is impacted by a resource management error vulnerability. An attacker could exploit this vulnerability to cause a denial of se CVE-2020-68675.5ZTE's SDON controller is impacted by the resource management error vulnerability. When RPC is frequently called by other applications in the CVE-2020-68686.5There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB mana