Archive
14 August 2020
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Unscored —
A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker t…
-
Unscored —
Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access t…
-
Unscored —
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker…
-
Unscored —
In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.
-
Unscored —
In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.
-
Unscored —
In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.g…
-
Unscored —
In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is pos…
-
Unscored —
In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument c…
-
Unscored —CVE-2020-9767 Public exploit
A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would allow an attacker who…
-
Medium 5.9
GHSL-2020-133: Insufficient validation of user input in resolveRepositoryPath function
The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. This issue may lead to unauthorized access of private Git repositories as long as the malicious user kn…
-
Medium 6.7
Local privilege elevation in Composer-Setup for Windows
In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the following scenarios. 1. A local regular user may modify the existing `C:\ProgramData\ComposerSetup\bin\comp…
-
Low 3.0
Path Traversal in openapi-python-client
In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk.
-
High 8.0
Arbitrary Code Generation
In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.
-
Unscored —
Rapid Software LLC Rapid SCADA 5.8.0 is affected by a local privilege escalation vulnerability in the ScadaAgentSvc.exe…
-
Unscored —
A File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker to execute arbitrary …
-
Medium 6.5
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept …
KEV Nov 3, 2021 -
Unscored —
A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All v…
-
Unscored —
A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login scree…
-
Unscored —
A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact …
-
Critical 9.8
Prototype Pollution
madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
-
Critical 9.8
Prototype Pollution
All versions of phpjs are vulnerable to Prototype Pollution via parse_str.
-
Unscored —
FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information,…
-
Unscored —
FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information,…
-
Unscored —
CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, …
-
Unscored —
ise smart connect KNX Vaillant 1.2.839 contain a Denial of Service.
-
Unscored —
Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code…
-
Medium 6.1
Cross-site scripting vulnerability in TinyMCE
A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configured in classic editing mode.
-
Unscored —CVE-2019-6112 Scanner template
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allow…
-
Unscored —
There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web…
-
Medium 6.5
IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication …