Archive
27 August 2020
Vulnerabilities first published on this day (UTC), newest first.
54 results · Feed
-
Unscored —
Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to determine the names of unauthorized private repositories given their numerical IDs. This vulnerability did not allow unauth…
-
Unscored —
Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server
A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made …
-
Critical 9.8
Scalyr Agent 2 Missing SSL Certificate Validation
The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName.
-
Critical 9.8
Scalyr Agent Missing SSL Certificate Validation
The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verify_hostname option.
-
Unscored —
A vulnerability in the management consoles of Trend Micro Deep Security 10.0-12.0 and Trend Micro Vulnerability Protect…
-
Unscored —
If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection …
-
Unscored —
If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Deep Security 10.x-12.x c…
-
Unscored —
In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.6…
-
Medium 5.3
Dell EMC Isilon OneFS version 8.2.2 and Dell EMC PowerScale OneFS version 9.0.0 contains a buffer overflow vulnerabilit…
-
Unscored —
OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories.
-
Unscored —
OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by…
-
Unscored —
Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects Wor…
-
Unscored —
File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regu…
-
Unscored —
An Arbitrary File Upload in Vehicle Image Upload in Online Bike Rental v1.0 allows authenticated admin to conduct remot…
-
High 8.6
Cisco FXOS and NX-OS Software Cisco Fabric Services Denial of Service Vulnerability
A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attacker to cause process crashes, which could result in a denial of service (DoS) condition on an affected device. The attac…
-
High 7.5
Cisco NX-OS Software IPv6 Protocol Independent Multicast Denial of Service Vulnerability
A vulnerability in the Protocol Independent Multicast (PIM) feature for IPv6 networks (PIM6) of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due t…
-
High 7.8
Cisco Nexus 3000 and 9000 Series Switches Privilege Escalation Vulnerability
A vulnerability in the Enable Secret feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to issue the enable command and get full administrative privileges. To …
-
High 8.6
Cisco NX-OS Software Border Gateway Protocol Multicast VPN Denial of Service Vulnerability
A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) conditi…
-
High 8.6
Cisco NX-OS Software Border Gateway Protocol Multicast VPN Session Denial of Service Vulnerability
A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a BGP session to repeatedly reset, causing a partial denial of service (DoS) condition du…
-
High 8.8
Cisco NX-OS Software Data Management Engine Remote Code Execution Vulnerability
A vulnerability in the Data Management Engine (DME) of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device. The vuln…
-
High 7.2
Cisco NX-OS Software Call Home Command Injection Vulnerability
A vulnerability in the Call Home feature of Cisco NX-OS Software could allow an authenticated, remote attacker to inject arbitrary commands that could be executed with root privileges on the underlying operating system (OS). The vulnerability is due to insuff…
-
Low 3.3
Cisco UCS Manager Software Local Management CLI Denial of Service Vulnerability
A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of CLI comman…
-
Unscored —
oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.
-
Unscored —
On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string…
-
Unscored —
Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.
-
Unscored —
eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might …
-
Unscored —
Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags.
-
Unscored —
Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-t…
-
Unscored —
DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php'
-
Unscored —
13enforme CMS 1.0 has Cross Site Scripting via the "content.php" id parameter.
-
Unscored —
13enforme CMS 1.0 has SQL Injection via the 'content.php' id parameter.
-
Unscored —
SQL injection can occur in Soluzione Globale Ecommerce CMS v1 via the parameter " offerta.php"
-
Unscored —
KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the 'team.php,player.php,club.php' id parameter.
-
Unscored —
Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has SQL Injection via the 'content.php' id parameter.
-
Unscored —
Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter.
-
Unscored —
Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social fee…
-
Unscored —
KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter.
-
Unscored —
In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating…
-
Unscored —
DesignMasterEvents Conference management 1.0.0 allows SQL Injection via the username field on the administrator login p…
-
Low 3.3
IBM Security Guardium Insights 2.0.1 performs an operation at a privilege level that is higher than the minimum level r…