Archive
1 September 2020
Vulnerabilities first published on this day (UTC), newest first.
192 results · Feed
-
High —
Cross-Site Scripting in mrk.js
Versions of `mrk.js` before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML. ## Recommendation Update to version 2.0.1 or later and use `mark.sanitizeURL()` for any `src` and `href` attributes when extending the markdown.
-
Low —
Reflected Cross-Site Scripting in redis-commander
Affected versions of `redis-commander` contain a cross-site scripting vulnerability in the `highlighterId` paramter of the clipboard.swf component on hosts serving Redis Commander. Mitigating factors: Flash must be installed / enabled for this to work. The be…
-
High —
Directory Traversal in @vivaxy/here
The @vivaxy/here module is a small web server that serves files with the process' working directory acting as the web root. It is vulnerable to a directory traversal attack. This means that files on the local file system which exist outside of the web root ma…
-
Medium —
Directory Traversal in featurebook
Affected versions of `featurebook` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of privat…
-
Low —
Silently Runs Cryptocoin Miner in hooka-tools
Affected versions of `hooka-tools` were compromised and modified to silently run a cryptocoin miner in the background. All affected versions have been unpublished from the npm registry. ## Recommendation While this module has been unpublished, some versions m…
-
Unscored —
A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Service…
-
High 7.8CVE-2020-24557 Exploited
A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an att…
KEV Nov 3, 2021 -
Unscored —
A vulnerability in an Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Serv…
-
Unscored —
A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business…
-
High —
Directory Traversal in yjmyjmyjm
Affected versions of `yjmyjmyjm` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private …
-
High 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Sym…
-
High —
Directory Traversal in nodeload-nmickuli
Affected versions of `nodeload-nmickuli` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of …
-
High 7.5
Directory Traversal in wenluhong1
Affected versions of `wenluhong1` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private…
-
Critical 9.8
An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted …
-
Unscored —
Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated …
-
Medium 6.4
An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3. A speci…
-
Critical —
Command Injection in pidusage
Affected versions of `pidusage` pass unsanitized input to `child_process.exec()`, resulting in arbitrary code execution in the `ps` method. This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX. Windows and Linux are not vulnerable. ## Pro…
-
Unscored —
interface/new/new_comprehensive_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerabili…
-
Medium 6.4
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Stock Mana…
-
Unscored —
A Cross-Site Request Forgery (CSRF) vulnerability in edit_user.php in OSWAPP Warehouse Inventory System (aka OSWA-INV) …
-
Medium 6.4CVE-2020-23835 Public exploit
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Man…
-
Unscored —
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webp…
-
High 7.3
fury-adapter-swagger allows arbitrary file read from system
`fury-adapter-swagger` from version 0.2.0 until version 0.9.7 has a weakness that allows an attacker to read arbitrary files off of the system. This can be used to read sensitive data, or to cause a denial of service condition by attempting to read something …
-
Critical 9.0
Remote Code Execution in paginator(hex)
There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the paginate() function. This will potentially affect all current users of Paginator prior to version 1.0.0. T…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3. A specially …
-
Medium 6.4
IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of…
-
Medium 4.3
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to XML external entity injection, caused by improper validatio…
-
Low 3.7
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by imp…
-
High 7.5
Denial of Service in mqtt
Affected versions of `mqtt` will cause the node process to crash when receiving specially crafted MQTT packets, making the application vulnerable to a denial of service condition. ## Recommendation Update to v1.0.0 or later
-
High —
Cross-Site Scripting (XSS) in pivottable
Affected versions of `pivottable` are vulnerable to cross-site scripting, due to a new mechanism used to render JSON elements. ## Recommendation Update to version 2.0.0 or later.
-
Medium —
Cross-Site Scripting in c3
Affected versions of `c3` are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips. ## Recommendation Update to 0.4.11 or later.
-
Critical —
Cross-Site Scripting in swagger-ui
Affected versions of `swagger-ui` are vulnerable to cross-site scripting via the `url` query string parameter. ## Recommendation Update to 2.2.1 or later.
-
Medium —
Spoofing attack due to unvalidated KDC in node-krb5
Affected versions of `node-krb5` do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. ## Recommendation It appears t…
-
High —
fuelux vulnerable to Cross-Site Scripting in Pillbox feature
Affected versions of `fuelux` contain a cross-site scripting vulnerability in the Pillbox feature. By supplying a script as a value for a new pillbox, it is possible to cause arbitrary script execution. ## Recommendation Update to version 3.15.7 or later.
-
Medium 5.3
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An atta…
-
Medium 6.3
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to SQL injection. A remote authenticated attacker could send s…
-
High —
Cross-Site Scripting in swagger-ui
Affected versions of `swagger-ui` are vulnerable to cross-site scripting. This vulnerability exists because `swagger-ui` automatically executes external Javascript that is loaded in via the `url` query string parameter when a `Content-Type: application/javasc…
-
High —
Cross-Site Scripting in jqtree
Affected versions of `jqtree` are vulnerable to cross-site scripting in the drag and drop functionality for modifying tree data. When a user attempts to drag a node to a different position in the hierarchy, script content existing within the node will be exec…
-
High —
Cross-Site Scripting in emojione
Affected versions of `emojione` are vulnerable to cross-site scripting when user input is passed into the `toShort()`, `shortnameToImage()`, `unicodeToImage()`, and `toImage()` functions. ## Recommendation Update to version 1.3.1 or later.
-
High —
XSS in client rendered block templates in rendr
Affected versions of `rendr` are vulnerable to cross-site scripting when client side rendering is done inside a `_block`. Server side rendering is not affected and is properly escaped. ## Recommendation Update to version 1.1.4 or later.