Archive
13 May 2020
Vulnerabilities first published on this day (UTC), newest first.
17 results · Clear filters · Feed
-
Medium 5.4
Cross-Site Scripting in TYPO3 CMS
In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting; properties being ass…
-
Medium 5.4
Cross-Site Scripting in TYPO3 CMS
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placeholder attributes containing data of other database records are vulnerable to cross-site scripting…
-
Medium 5.3
PAN-OS: GlobalProtect registration open redirect
An open redirection vulnerability in the GlobalProtect component of Palo Alto Networks PAN-OS allows an attacker to specify an arbitrary redirection target away from the trusted GlobalProtect gateway. If the user then successfully authenticates it will cause …
-
Medium 5.4
PAN-OS: Improper SAML SSO authorization of shared local users
An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the username is shared for the purposes of SSO authentication. This can result in authenti…
-
Medium 6.8
GlobalProtect App: Passwords may be logged in clear text while collecting troubleshooting logs
Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app (also known as GlobalProtect Agent) for MacOS and Windows. For this issue to occur all …
-
Medium 6.5
PAN-OS: Authenticated administrator can delete arbitrary system file
An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affecting the integrity of the system or causing denial of service to all PAN-OS services. This issue affe…
-
Medium 4.1
PAN-OS: Predictable temporary file vulnerability
A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earli…
-
Medium 4.9
PAN-OS: Management server rasmgr denial of service
A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a request that causes the rasmgr daemon to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by …
-
Medium 5.3
PAN-OS: Panorama management server log injection
A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. This vulnerability can be leveraged to obfuscate an ongoing attack or f…
-
Medium 5.4
Cross-Site Scripting in SVG Sanitizer
The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated i…
-
Medium 5.8
Potential exposure of log information in Ops Manager
In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB …
-
Medium 6.5
Persistent XSS in markdown parser used by obs-server
A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9d…
-
Medium 4.3
Missing Authorization in TYPO3 extension
The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
-
Medium 6.1
Open redirect in direct_mail
The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.
-
Medium 4.3
Missing Authorization in TYPO3 extension
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
-
Medium 5.3
Denial of service in direct_mail
The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated user to obtain sensiti…