Archive
25 August 2020
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
High 7.3
OS Command Injection and Improper Input Validation in ansible
A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take ad…
-
High 7.8
Maven Extension plugin for Gradle Enterprise vulnerable to Deserialization of Untrusted Data
An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execu…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
High 8.8CVE-2020-17389 EPSS 10%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8CVE-2020-17387 EPSS 10%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8CVE-2020-15645 EPSS 11%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8CVE-2020-15643 EPSS 59%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeCons…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of installations of Marv…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConv…
-
High 7.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConv…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…
-
High 7.5
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…
-
High 7.5
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.3-…
-
High 8.1CVE-2020-24616 Public exploit
Code Injection in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
-
High 8.7
Cross-Site Scripting in highcharts
Versions of `highcharts` prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize `href` values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they clic…
-
High 7.5
Softing Industrial Automation OPC
Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to uncontrolled resource consumption, which may allow an attacker to cause a denial-of-service condition.
-
High 8.1
USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916
GateManager versions prior to 9.2c, The affected product uses a weak hash type, which may allow an attacker to view user passwords.
-
High 8.1
OFF-BY-ONE ERROR CWE-193
GateManager versions prior to 9.2c, The affected product is vulnerable to an off-by-one error, which may allow an attacker to remotely execute arbitrary code or cause a denial-of-service condition.
-
High 7.5
Cellopoint CelloOS - Unauthenticated Arbitrary File Disclosure
Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly, which allows unauthorized user to launch Path Traversal attack and access arbitrate file on the system.
-
High 7.2
Cellopoint CelloOS - Remote Command Execution (RCE)
Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With the cookie of the system administrator, attackers can inject and remotely execute arbitrary command to manipulate the system.