Archive
August 2020
Vulnerabilities first published in this month (UTC), newest first.
1,173 results · Feed
-
Medium 6.1
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows use…
-
Medium 5.7
Combodo iTop - CSRF
Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.
-
High 7.5
Combodo iTop - Security Misconfiguration
A security misconfiguration exists in Combodo iTop, which can expose sensitive information.
-
High 7.4
Combodo iTop - Reflected XSS
Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.
-
High 7.5
Combodo iTop - Broken Access Control
A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.
-
Medium 6.8
Combodo iTop - Stored XSS
Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.
-
Unscored —
flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title…
-
Unscored —
flatCore before 1.5.7 allows upload and execution of a .php file by an admin.
-
Unscored —CVE-2020-16248 Scanner template
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this m…
-
Unscored —
In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm.
-
Unscored —
JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.
-
Unscored —
JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.
-
Unscored —
In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissi…
-
Unscored —
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.
-
Unscored —
In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.
-
Unscored —
In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.
-
Unscored —
In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.ex…
-
Unscored —
In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there…
-
Unscored —
JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.
-
Unscored —
In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.
-
Unscored —
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.
-
Unscored —
JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.
-
Unscored —
In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.
-
Unscored —
In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.
-
Unscored —
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to denial-of-…
-
Unscored —
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to conduct pe…
-
Unscored —
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to bypass aut…
-
Unscored —
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate pr…
-
Unscored —
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-…
-
Unscored —
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct pe…
-
Unscored —
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass aut…
-
Unscored —
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate pr…
-
Medium 5.9
Unauthenticated Information Disclosure Vulnerability in IP Office
A vulnerability was discovered in the web interface component of IP Office that may potentially allow a remote, unauthenticated user with network access to gain sensitive information. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0…
-
Unscored —
TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to denial-of-…
-
Unscored —
TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to conduct pe…
-
Unscored —
TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to bypass aut…
-
Unscored —
TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to elevate pr…
-
Medium 6.5
Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard
Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboa…
-
Unscored —
An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Th…
-
Unscored —
An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. Th…