Archive
20 August 2020
Vulnerabilities first published on this day (UTC), newest first.
16 results · Feed
-
Unscored —
eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones. Th…
-
Unscored —
MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allow…
-
High 7.5
Improper Input Validation in vault-ssh-helper
HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.
-
Medium 4.3
IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that the…
-
Medium 4.3
IBM Content Navigator 3.0.7 and 3.0.8 is vulnerable to improper input validation. A malicious administrator could bypas…
-
Unscored —
In the default configuration of Rangee GmbH RangeeOS 8.0.4, all components are executed in the context of the privilege…
-
Unscored —
The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restr…
-
Unscored —
Multiple Rangee GmbH RangeeOS 8.0.4 modules store credentials in plaintext including credentials of users for several e…
-
Unscored —
The Kommbox component in Rangee GmbH RangeeOS 8.0.4 is vulnerable to Remote Code Execution due to untrusted user suppli…
-
Unscored —
Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: …
-
Unscored —
PHPGurukul Vehicle Parking Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Passw…
-
Unscored —
An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, ma…
-
Unscored —
An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, ma…
-
Unscored —
In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. Using funct…
-
High 8.1
RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication
The Micro Air Vehicle Link (MAVLink) protocol presents authentication mechanisms on its version 2.0 however according to its documentation, in order to maintain backwards compatibility, GCS and autopilot negotiate the version via the AUTOPILOT_VERSION message…
-
High 8.0
RVD#2401: Use of unsafe yaml load, ./src/actionlib/tools/library.py:132
Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent, and allows for the creation of Python objects. Through this fla…