Archive
August 2020
Vulnerabilities first published in this month (UTC), newest first.
203 results · Clear filters · Feed
-
Medium 5.5
pppd arbitrary file read information disclosure vulnerability
The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBE_OPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu…
-
Medium 5.3
Directory Traversal in nhouston
All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory. ## Recommendation It is recommended that a different module be used, as we…
-
Medium 6.5
CSRF Vulnerability in jquery-ujs
Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains. When an attacker controls the href attribute of an ancho…
-
Medium 5.4
Dolibarr stored Cross-Site Scripting (XSS) vulnerability
Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter;…
-
Medium 6.7
RabbitMQ arbitrary code execution using local binary planting
RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An attacker with write privileges to the RabbitMQ installation directory and local access on Windows could …
-
Medium 6.2
IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a den…
-
Medium 6.5
Remote Memory Exposure in bl
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking …
-
Medium 6.5
Grafana Arbitrary File Read
Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.
-
Medium 5.9
IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of use…
-
Medium 4.3
IBM Resilient SOAR V38.0 users may experience a denial of service of the SOAR Platform due to a insufficient input vali…
-
Medium 4.3
IBM Resilient SOAR 38 uses incomplete blacklisting for input validation which allows attackers to bypass application co…
-
Medium 5.3
Dell EMC Isilon OneFS version 8.2.2 and Dell EMC PowerScale OneFS version 9.0.0 contains a buffer overflow vulnerabilit…
-
Medium 4.7
IBM WebSphere Application Server ND 8.5 and 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cro…
-
Medium 5.9
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information, caused by the failu…
-
Medium 4.3
IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the sys…
-
Medium 5.9
IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to…
-
Medium 5.3
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed tech…
-
Medium 6.5
IBM Security Guardium Insights 2.0.1 could allow an attacker to obtain sensitive information or perform unauthorized ac…
-
Medium 5.9
IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to…
-
Medium 6.1
An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager throug…
-
Medium 6.1
An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0,…
-
Medium 5.4
Vulnerability in SuiteCommerce Advanced (SCA) Sites component of Oracle NetSuite service. Supported versions that are a…
-
Medium 5.4
Vulnerability in the SuiteCommerce Advanced (SCA) component of Oracle NetSuite service. Supported versions that are aff…
-
Medium 4.0
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another …
-
Medium 6.8
XSS due to lack of CSRF validation for replying/publishing
In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.
-
Medium 5.3
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is deployed with active debugging code that can create unintended e…
-
Medium 6.8
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 contains hard-coded credentials, such as a password or cryptographi…
-
Medium 5.3
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by…
-
Medium 6.0
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by…
-
Medium 5.3
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 discloses sensitive information to unauthorized users. The informat…
-
Medium 5.9
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote attacker to obtain sensitive information, caus…
-
Medium 5.4
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows us…
-
Medium 5.3
IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to miss…
-
Medium 5.1
Cisco Connected Mobile Experiences Restricted Shell Escape Vulnerability
A vulnerability in the CLI of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to bypass restrictions on the CLI. The vulnerability is due to insufficient security mechanisms in the restrict…
-
Medium 6.7
Cisco Connected Mobile Experiences Privilege Escalation Vulnerability
A vulnerability in Cisco Connected Mobile Experiences (CMX) could allow an authenticated, local attacker with administrative credentials to execute arbitrary commands with root privileges. The vulnerability is due to improper user permissions that are configu…
-
Medium 4.4
Cisco Hyperflex HX-Series Software Weak Storage Vulnerability
A vulnerability in the installation component of Cisco Hyperflex HX-Series Software could allow an authenticated, local attacker to retrieve the password that was configured at installation on an affected device. The vulnerability exists because sensitive inf…
-
Medium 5.9
Cisco Data Center Network Manager Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due t…
-
Medium 6.5
Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite Vulnerability
A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an unauthenticated, remote attacker to overwrite arbitrary files on an end-user system. The vulnerability is due to improper validation of URL parameters that are sent from a website …
-
Medium 4.7
Cisco DNA Center Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco DNA Center software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerabiliti…
-
Medium 5.3
Cisco Vision Dynamic Signage Director Directory Traversal Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to view potentially sensitive information on an affected device. The vulnerability is due to incorrect permissions w…