CVE-2020-7826

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

EyeSurfer BflyInstallerX.ocx v1.0.0.16 and earlier versions contain a vulnerability that could allow remote files to be download by setting the arguments to the vulnerable method. This can be leveraged for code execution. When the vulnerable method is called, they fail to properly check the parameters that are passed to it.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-494

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-78277.8DaviewIndy 8.98.7 and earlier version contain Use-After-Free vulnerability, triggered when the user opens a malformed specific file that is CVE-2020-78287.8DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file tha CVE-2020-78297.8DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file tha CVE-2020-78307.8RAONWIZ v2018.0.2.50 and earlier versions contains a vulnerability that could allow remote files to be downloaded by lack of validation. Vul CVE-2020-78318.8A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. Th CVE-2020-78329.8A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to download and execute an arbit CVE-2020-78367.8VOICEYE WSActiveBridgeES versions prior to 2.1.0.3 contains a stack-based buffer overflow vulnerability caused by improper bound checking pa CVE-2020-78378.8An issue was discovered in ML Report Program. There is a stack-based buffer overflow in function sub_41EAF0 at MLReportDeamon.exe. The funct CVE-2020-78388.8A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute CVE-2020-78399.8In MaEPSBroker 2.5.0.31 and prior, a command injection vulnerability caused by improper input validation checks when parsing brokerCommand p CVE-2020-78418.8Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string CVE-2020-78426.6Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the