Archive
August 2020
Vulnerabilities first published in this month (UTC), newest first.
25 results · Clear filters · Feed
-
Low 2.9
IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings du…
-
Low 3.3
Cisco UCS Manager Software Local Management CLI Denial of Service Vulnerability
A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of CLI comman…
-
Low 3.3
IBM Security Guardium Insights 2.0.1 performs an operation at a privilege level that is higher than the minimum level r…
-
Low 3.7
IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters. This may lead to information discl…
-
Low 2.7
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information abou…
-
Low 3.7
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or sessio…
-
Low 3.7
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or sessio…
-
Low 3.9
Cross Site Scripting vulnerability in ePO extension of MACC
Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the policy discovery section.
-
Low 3.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-…
-
Low 3.9
ALEOS AT Command Injections
Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4.
-
Low 3.3
ALEOS ACEView Message Replay
A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView service can be replayed to other gateways sharing the same credentials.
-
Low 3.7
ALEOS ACEView Service Out-Of-Bounds Read
An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9. Sensitive information may be disclosed via the ACEviewservice, accessible by default on the LAN.
-
Low 2.1
Philips SureSigns VS4 Improper Input Validation
Philips SureSigns VS4, A.07.107 and prior receives input or data, but it does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Phantom…
-
Low 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio …
-
Low 3.0
Path Traversal in openapi-python-client
In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk.
-
Low 3.1
For GitLab before 13.0.12, 13.1.6, 13.2.3 after a group transfer occurs, members from a parent group keep their access …
-
Low 2.8
Confidential Information Disclosure vulnerability in Asylo
A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_recvfrom' function generates a return value which is deserialized by 'MessageReader', and copied into …
-
Low 3.0
PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions
When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider S…
-
Low 3.8
Sensitive date stored in logcat file
Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A malicious app or unauthorized user can harvest the information and later on can use the information…
-
Low 3.7
Jenkins Email Extension Plugin SMTP password transmitted and displayed in plain text
Jenkins Email Extension Plugin 2.72 and 2.73 transmits and displays the SMTP password in plain text as part of the global Jenkins configuration form, potentially resulting in its exposure.
-
Low 2.5
In-band key negotiation issue in AWS S3 Crypto SDK for GoLang
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to c…
-
Low 3.7
IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensi…
-
Low 3.8
An exploitable information disclosure vulnerability exists in SoftPerfect’s RAM Disk 4.1 spvve.sys driver. A specially …
-
Low 2.9
IBM Cognos Analytics 11.0 and 11.1 is susceptible to an information disclosure vulnerability where an attacker could ga…