CVE-2020-15001

An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked when updating NFC specific components of the OTP configurations. This may allow an attacker to access configured OTPs and passwords stored in slots that were not configured by the user to be read over NFC, despite a user having set an access code. (Users who have not set an access code, or who have not configured the OTP slots, are not impacted by this issue.)

• CWE-862

• https://www.yubico.com/support/security-advisories/ysa-2020-04/Exploit, Mitigation, Vendor Advisory
• https://www.yubico.com/support/security-advisories/ysa-2020-04/Exploit, Mitigation, Vendor Advisory

Published

Jul 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1499A spoofing vulnerability exists when Microsoft SharePoint Se…5.4
• CVE-2020-14990IOBit Advanced SystemCare Free 13.5.0.263 allows local users…7.1
• CVE-2020-14993A stack-based buffer overflow on DrayTek Vigor2960, Vigor390…9.8
• CVE-2020-14999A logic bug in system monitoring driver of Acronis Agent aft…7.5
• CVE-2020-1500A spoofing vulnerability exists when Microsoft SharePoint Se…5.4
• CVE-2020-15000A PIN management problem was discovered on Yubico YubiKey 5 …5.9
• CVE-2020-15002OX App Suite through 7.10.3 allows SSRF via the the /ajax/me…5
• CVE-2020-15003OX App Suite through 7.10.3 allows Information Exposure beca…4.3
• CVE-2020-15004OX App Suite through 7.10.3 allows stats/diagnostic?param= X…4.8
• CVE-2020-15005In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4,…3.1
• CVE-2020-15006Bludit 3.12.0 allows stored XSS via JavaScript code in an SV…5.4
• CVE-2020-15007A buffer overflow in the M_LoadDefaults function in m_misc.c…9.8