Archive
26 August 2020
Vulnerabilities first published on this day (UTC), newest first.
105 results · Feed
-
Medium 5.4
Vulnerability in SuiteCommerce Advanced (SCA) Sites component of Oracle NetSuite service. Supported versions that are a…
-
Medium 5.4
Vulnerability in the SuiteCommerce Advanced (SCA) component of Oracle NetSuite service. Supported versions that are aff…
-
Unscored —
Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.0…
-
Unscored —
Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.0…
-
Unscored —
An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to …
-
Unscored —
An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks.
-
Unscored —
IBM Rational Asset Manager 7.5 could allow a remote attacker to bypass security restrictions. An attacker could exploit…
-
Critical —
Server secret was included in static assets and served to clients
### Impact Server JWT signing secret was included in static assets and served to clients. This ALLOWS Flood's builtin authentication to be bypassed. Given Flood is granted access to rTorrent's SCGI interface (which is unprotected and ALLOWS arbitrary code exe…
-
Medium 4.0
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another …
-
Unscored —
An issue was discovered on Nescomed Multipara Monitor M1000 devices. The onboard Flash memory stores data in cleartext,…
-
Medium 6.8
XSS due to lack of CSRF validation for replying/publishing
In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.
-
Medium 5.3
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is deployed with active debugging code that can create unintended e…
-
High 8.8
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary co…
-
High 7.4
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not require that users should have strong passwords by default…
-
Low 2.7
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information abou…
-
Medium 6.8
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 contains hard-coded credentials, such as a password or cryptographi…
-
Medium 5.3
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by…
-
Medium 6.0
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by…
-
Medium 5.3
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 discloses sensitive information to unauthorized users. The informat…
-
Medium 5.9
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote attacker to obtain sensitive information, caus…
-
Low 3.7
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or sessio…
-
Medium 5.4
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows us…
-
Low 3.7
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or sessio…
-
Medium 5.3
IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to miss…
-
Unscored —
A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11. Authenticated remote adversarie…
-
High 8.3
OpenStack Nova Live migration fails to update persistent domain XML
An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination h…
-
Unscored —
Ericom Access Server 9.2.0 (for AccessNow and Ericom Blaze) allows SSRF to make outbound WebSocket connection requests …
-
Unscored —
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment…
-
Unscored —
An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV be…
-
Unscored —
A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to …
-
Unscored —
The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an una…
-
High 7.7
Heap buffer overflow in libIEC61850
In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happen leading to heap buffer overflow. This can cause an application crash or on some platforms even the execution of remo…
-
Unscored —
The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and f…
-
Unscored —
The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header inject…
-
Unscored —
WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature.
-
Unscored —
webTareas v2.1 is affected by Cross Site Scripting (XSS) on "Search."
-
Unscored —
PHP-Fusion 9.03.60 is affected by Cross Site Scripting (XSS) via infusions/member_poll_panel/poll_admin.php.
-
Unscored —
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."
-
Unscored —
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Content."
-
Unscored —
NavigateCMS 2.9 is affected by Cross Site Scripting (XSS) on module "Configuration."