CVE-2020-7813

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download and execute arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-494

Affected software

Vendor	Product	Versions
Kaoni	ezHTTPTrans	>= 1.0.0.70, <= 1.0.0.90

References

http://www.kaoni.com/Product
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35428Third Party Advisory
http://www.kaoni.com/Product
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35428Third Party Advisory

Timeline

Published: May 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-78149.8RAONWIZ v2018.0.2.50 and eariler versions contains a vulnerability that could allow remote files to be downloaded and excuted by lack of val CVE-2020-78159.8XPLATFORM v9.2.260 and eariler versions contain a vulnerability that could allow remote files to be downloaded by setting the arguments to t CVE-2020-78167.8A vulnerability in the JPEG image parsing module in DaView Indy, DaVa+, DaOffice softwares could allow an unauthenticated, remote attacker t CVE-2020-78177.8MyBrowserPlus downloads the files needed to run the program through the setup file (Setup.inf). At this time, there is a vulnerability in do CVE-2020-78187.8DaviewIndy 8.98.9 and earlier has a Heap-based overflow vulnerability, triggered when the user opens a malformed PDF file that is mishandled CVE-2020-78197.5A SQL-Injection vulnerability in the nTracker USB Enterprise(secure USB management solution) allows a remote unauthenticated attacker to per CVE-2020-78209.8Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary co CVE-2020-78219.8Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary co CVE-2020-78227.8DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. A CVE-2020-78237.8DaviewIndy has a Memory corruption vulnerability, triggered when the user opens a malformed image file that is mishandled by Daview.exe. Att CVE-2020-78246.5A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission CVE-2020-78259.8A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier. An