Archive
August 2020
Vulnerabilities first published in this month (UTC), newest first.
203 results · Clear filters · Feed
-
Medium 4.9
Cisco Vision Dynamic Signage Director Path Traversal Vulnerability
A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrative privileges to conduct directory traversal attacks and obtain read access to sensitive files on an …
-
Medium 6.3
Cisco Vision Dynamic Signage Director Role-Based Access Control Vulnerability
A vulnerability in the role-based access control (RBAC) functionality of the web management software of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker to access resources that they should not be able to access and perform …
-
Medium 5.5
Cisco Vision Dynamic Signage Director Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrative privileges to conduct a cross-site scripting (XSS) attack against a user of the interface on an af…
-
Medium 5.3
Cisco Small Business Smart and Managed Switches Denial of Service Vulnerability
A vulnerability in the IPv6 packet processing engine of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficien…
-
Medium 6.5
Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Memory Leak Vulnerability
A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a memory leak, which could lead to a denial of service (DoS) condition on an affected device. The vul…
-
Medium 6.5
Cisco Data Center Network Manager Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of the affected software. T…
-
Medium 5.4
Cisco Data Center Network Manager Path Traversal Vulnerability
A vulnerability in a specific REST API method of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. The vulnerability is due to insufficient validation of u…
-
Medium 5.5
Cisco Data Center Network Manager Information Disclosure Vulnerability
A vulnerability in Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, local attacker to obtain confidential information from an affected device. The vulnerability is due to insufficient protection of confidential information on an…
-
Medium 5.3
Cisco Data Center Network Manager Read File Path Traversal Vulnerability
A vulnerability in a specific REST API of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user…
-
Medium 6.3
Cisco Data Center Network Manager Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to bypass authorization on an affected device and access sensitive information that is related to the devi…
-
Medium 6.5
Cisco Data Center Network Manager Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists b…
-
Medium —
Expo on iOS is insecure due incorrect security attribute application
secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.
-
Medium 6.5
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
Medium 6.0
This vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Des…
-
Medium 6.5
This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4…
-
Medium 6.5
This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3…
-
Medium 6.0
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
Medium 6.5
This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3…
-
Medium 6.5
Ericssonlg iPECS Privilege Escalation Vulnerability
A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission. The vulnerability is due to insecure permission when handling session cookies. An attacker could exploit this vulnera…
-
Medium 6.1
Codiad Cross-site Scripting Vulnerability
** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanage…
-
Medium 6.5
Cellopoint CelloOS - Server-Side Request Forgery (SSRF)
Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.
-
Medium 6.7
An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .confi…
-
Medium 6.5
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect …
-
Medium 4.4
IBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be read by a local user. …
-
Medium 5.3
IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a deni…
-
Medium 6.2
IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a deni…
-
Medium 4.3
IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execu…
-
Medium 5.4
IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim. By pers…
-
Medium 4.4
IBM Trusteer Rapport/Apex 3.6.1908.22 contains an unused legacy driver which could allow a user with administrator priv…
-
Medium 4.3
update-policy rules of type "subdomain" are enforced incorrectly
In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a sp…
-
Medium 6.5
A truncated TSIG response can lead to an assertion failure
In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, co…
-
Medium 6.5
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manag…
-
Medium 5.7
ALEOS Multiple Web UI vulnerabilities
Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9.
-
Medium 6.0
ALEOS SMS Handler Buffer Overflow
A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root.
-
Medium 4.1
ALEOS AT Command API Abuse
An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values.
-
Medium 6.3
ALEOS AT Command Stack Overflow
A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code execution
-
Medium 6.3
ALEOS AT API Stack Overflow
A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution.
-
Medium 6.5
Dolibarr CRM allows Privilege Escalation
Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
-
Medium 6.8
RVD#1495: Universal Robots URCaps execute with unbounded privileges
Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video. In our …
-
Medium 6.5
Specific GeoQuery can cause DoS against MongoDB Server
A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects MongoDB Server v4.4 versions prior to 4.4.0-rc7; MongoD…