CVE-2020-13958

A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the document event handler and other hyperlinks require a control-click.

• https://lists.apache.org/thread.html/r6b2f48cf6c4aad4ebd13f90033162276b0ccae63bea2d3d89cdaf355%40%3Cannounce.openoffice.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r6b2f48cf6c4aad4ebd13f90033162276b0ccae63bea2d3d89cdaf355%40%3Cannounce.openoffice.apache.org%3EMailing List, Vendor Advisory

Published

Nov 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13952In the course of work on the open source project it was disc…8.1
• CVE-2020-13953In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific UR…5.3
• CVE-2020-13954By default, Apache CXF creates a /services page containing a…6.1
• CVE-2020-13955HttpUtils#getURLConnection method disables explicitly hostna…5.9
• CVE-2020-13956Apache HttpClient versions prior to version 4.5.13 and 5.0.3…5.3
• CVE-2020-13957Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.…9.8
• CVE-2020-13959The default error page for VelocityView in Apache Velocity T…6.1
• CVE-2020-1396An elevation of privilege vulnerability exists when Windows …7.8
• CVE-2020-13960D-Link DSL 2730-U IN_1.10 and IN_1.11 and DIR-600M 3.04 devi…7.5
• CVE-2020-13961Strapi before 3.0.2 could allow a remote authenticated attac…6.5
• CVE-2020-13962Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mu…7.5
• CVE-2020-13963SOPlanning before 1.47 has Incorrect Access Control because …9.8