Archive
August 2020
Vulnerabilities first published in this month (UTC), newest first.
1,173 results · Feed
-
Medium 6.5
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…
-
Medium 6.0
This vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Des…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…
-
High 7.5
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…
-
Medium 6.5
This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…
-
High 7.5
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4.…
-
Medium 6.5
This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3…
-
Medium 6.0
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.3-…
-
Medium 6.5
This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3…
-
Low 3.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-…
-
Unscored —
An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate tha…
-
Medium 6.5
Ericssonlg iPECS Privilege Escalation Vulnerability
A vulnerability in the web-based management interface of iPECS could allow an authenticated, remote attacker to get administrator permission. The vulnerability is due to insecure permission when handling session cookies. An attacker could exploit this vulnera…
-
Unscored —
In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.
-
Unscored —
Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that coul…
-
High 8.1CVE-2020-24616 Public exploit
Code Injection in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
-
Medium 6.1
Codiad Cross-site Scripting Vulnerability
** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanage…
-
Unscored —CVE-2020-24609 Public exploit
TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the …
-
High 8.7
Cross-Site Scripting in highcharts
Versions of `highcharts` prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize `href` values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they clic…
-
Unscored —
In Netwide Assembler (NASM) 2.15rc10, SEGV can be triggered in tok_text in asm/preproc.c by accessing READ memory.
-
Unscored —
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
-
Unscored —
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte i…
-
Unscored —
Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbit…
-
Critical 9.8
Softing Industrial Automation OPC
Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.
-
High 7.5
Softing Industrial Automation OPC
Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to uncontrolled resource consumption, which may allow an attacker to cause a denial-of-service condition.
-
High 8.1
USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916
GateManager versions prior to 9.2c, The affected product uses a weak hash type, which may allow an attacker to view user passwords.
-
Critical 9.8
OFF-BY-ONE ERROR CWE-193
GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as root.
-
High 8.1
OFF-BY-ONE ERROR CWE-193
GateManager versions prior to 9.2c, The affected product is vulnerable to an off-by-one error, which may allow an attacker to remotely execute arbitrary code or cause a denial-of-service condition.
-
Critical 10.0
IMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-158
Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.
-
Medium 6.5
Cellopoint CelloOS - Server-Side Request Forgery (SSRF)
Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.
-
High 7.5
Cellopoint CelloOS - Unauthenticated Arbitrary File Disclosure
Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly, which allows unauthorized user to launch Path Traversal attack and access arbitrate file on the system.
-
High 7.2
Cellopoint CelloOS - Remote Command Execution (RCE)
Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With the cookie of the system administrator, attackers can inject and remotely execute arbitrary command to manipulate the system.
-
Unscored —
Cross-site scripting vulnerability in Exment prior to v3.6.0 allows remote authenticated attackers to inject arbitrary …
-
Unscored —
Cross-site scripting vulnerability in Exment prior to v3.6.0 allows remote authenticated attackers to inject arbitrary …
-
Unscored —
Open redirect vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to redirect users to arbitrary sit…
-
Unscored —
Cross-site scripting vulnerability in CyberMail Ver.6.x and Ver.7.x allows remote attackers to inject arbitrary script …
-
Unscored —
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in …
-
Medium 6.7
An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .confi…