CVE-2020-35584

In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature. An attacker suitably positioned to view a legitimate user's network traffic could record and monitor their interactions with the web services and obtain any information the user supplies, including Administrator passwords and screen keys.

• CWE-319

• https://documentation.mersive.com/content/pages/release-notes.htmRelease Notes, Vendor Advisory
• https://github.com/aress31/solstice-pod-cvesExploit, Third Party Advisory
• https://www.mersive.com/uk/products/solstice/Product, Vendor Advisory
• https://documentation.mersive.com/content/pages/release-notes.htmRelease Notes, Vendor Advisory
• https://github.com/aress31/solstice-pod-cvesExploit, Third Party Advisory
• https://www.mersive.com/uk/products/solstice/Product, Vendor Advisory

Published

Dec 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35578An issue was discovered in the Manage Plugins page in Nagios…7.2
• CVE-2020-35579tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=…7.5
• CVE-2020-3558A vulnerability in the web-based management interface of Cis…6.1
• CVE-2020-35580A local file inclusion vulnerability in the FileServlet in a…7.5
• CVE-2020-35581A stored cross-site scripting (XSS) issue in Envira Gallery …5.4
• CVE-2020-35582A stored cross-site scripting (XSS) issue in Envira Gallery …5.4
• CVE-2020-35585In Solstice Pod before 3.3.0 (or Open4.3), the screen key ca…7.5
• CVE-2020-35586In Solstice Pod before 3.3.0 (or Open4.3), the Administrator…7.5
• CVE-2020-35587In Solstice Pod before 3.0.3, the firmware can easily be dec…7.5
• CVE-2020-35588Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-35589The limit-login-attempts-reloaded plugin before 2.17.4 for W…5.4
• CVE-2020-3559A vulnerability in Cisco Aironet Access Point (AP) Software …8.6