Archive
June 2020
Vulnerabilities first published in this month (UTC), newest first.
275 results · Clear filters · Feed
-
Medium 6.1
A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all …
-
Medium 5.9
IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Patch 1 and 7.4.0 GA does not require that users should have strong pas…
-
Medium 5.4
SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due …
-
Medium 6.9
Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10…
-
Medium 6.5
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed…
-
Medium 4.3
Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access…
-
Medium 6.5
SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not pe…
-
Medium 5.4
Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 8…
-
Medium 6.1
SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750,…
-
Medium 4.4
Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissio…
-
Medium 6.3
Using VSE to bypass Windows Credentials on Lock screen
Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 14 may allow unauthorized users to interact with the On-Access Scan Messages - Threat Alert Window when the Windows Login Scree…
-
Medium 4.6
DLL search order hijacking in Host IPS
DLL Search Order Hijacking Vulnerability in the installer component of McAfee Host Intrusion Prevention System (Host IPS) for Windows prior to 8.0.0 Patch 15 Update allows attackers with local access to execute arbitrary code via execution from a compromised …
-
Medium 5.9
DLL search order hijacking in MA
DLL Search Order Hijacking vulnerability in McAfee Agent (MA) prior to 5.6.4 allows attackers with local access to execute arbitrary code via execution from a compromised folder.
-
Medium 6.1
The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T495s, X395, T495, A485, A285, A475, A275 whic…
-
Medium 6.4
Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to prevent roll back of CSME Firmwa…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStati…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo No…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkS…
-
Medium 6.4
An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege.
-
Medium 6.7
A symbolic link vulnerability in some Lenovo installation packages, prior to version 1.2.9.3, could allow privileged fi…
-
Medium 6.7
A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 5.4
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a special…
-
Medium 4.3CVE-2020-9819 Exploited
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5…
KEV Nov 3, 2021 -
Medium 4.3
Insecure authorization in Project Deploy Keys in GitLab CE/EE 12.8 and later through 13.0.1 allows users to update perm…
-
Medium 4.8
OpenCart Cross-site Scripting
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor state…
-
Medium 5.0
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. Th…
-
Medium 6.1CVE-2020-13973 Public exploit
Cross-site scripting in json-sanitizer
OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where…
-
Medium 6.3
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML att…
KEV Jun 26, 2024 -
Medium 4.3
It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-…
-
Medium 5.4
Angular vulnerable to Cross-site Scripting
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
-
Medium 5.5
In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Manag…
-
Medium —
Introspection in schema validation in Apollo Server
We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The _Resolution_ section contains details on patched versions. ### Impact If `subscriptions: false` is passed to the `ApolloServer` constructor options, th…
-
Medium —
Use of insecure jQuery version in OctoberCMS
### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. ### Patches Issue has been patched in Build 466 (v1.0.466) by applying th…
-
Medium 6.5
Comments plugin Cross-Site Request Forgery (CSRF)
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.
-
Medium 5.4
Comments plugin stored Cross-site Scripting via a guest name
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name.