Archive
15 September 2020
Vulnerabilities first published on this day (UTC), newest first.
53 results · Feed
-
Medium 5.7
Web Gateway (MWG) - Privilege Escalation vulnerability
Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via improper access control in the user interface.
-
Medium 5.5
A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect br…
-
Medium 5.7
Web Gateway (MWG) - Privilege Escalation vulnerability
Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected configuration files via improper access control in the user interface.
-
Low 3.5
Web Gateway (MWG) - Privilege Escalation vulnerability
Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface.
-
Medium 4.6
Web Gateway (MWG) - Privilege Escalation vulnerability
Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected files via improper access controls in the REST interface.
-
Critical 9.0
Web Gateway (MWG) - Privilege Escalation vulnerability
Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user with low permissions to change the system's root password via improper access controls in the user interface.
-
Medium 5.5
A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Predict…
-
Medium 5.5
A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling al…
-
Unscored —CVE-2020-25453 Public exploit
An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability (bypass csrf_token) that allows remot…
-
Medium 5.5
A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause a…
-
Unscored —
Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers …
-
Unscored —
A File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote attackers to achieve Remote…
-
Unscored —
A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitra…
-
Medium 4.4
A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of t…
-
High 7.2
Shell command injection in Apache Syncope
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code exec…
-
High 8.2
TIBCO Spotfire Stored Cross Site Scripting Vulnerability
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inj…
-
Unscored —
A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker at…
-
High 8.7
Remote Code Execution in Act module
The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit, Discord users can use specially crafted messages to perform destructive actions and/or access sensitive information. Unloading the Act module …
-
Unscored —CVE-2020-10759 Public exploit
A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmwar…
-
High 8.9
Unsafe deserialization in Yii 2
Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.
-
High 8.0
HTML Injection in ScratchSig
The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using <script> tag inside <scratchsig> tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potent…
-
High 8.0
Potential XSS in PrestaShop contactform
In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The `message` field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript i…
-
Unscored —
Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visi…
-
Medium 5.5
A denial of service vulnerability was reported in the Lenovo Vantage component called Lenovo System Interface Foundatio…
-
High 7.3
A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalat…
-
Medium 4.3
A cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter Advanced Management Mo…
-
Medium 6.3
A cross-site scripting (XSS) vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 (Integrated Manage…
-
Unscored —
A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lea…
-
Medium 5.4
IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site …
-
High 8.0
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload …
-
Medium 6.5
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An…
-
High 8.8
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote authenticated attacker to execute arbitrary code on th…
-
Medium 4.3
IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site request forgery which could allow an attacker t…
-
Medium 4.0
IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by a…
-
Medium 6.3
IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to SQL injection. A remote attacker could send specially-craf…
-
Unscored —
VR CAM P1 Model P1 v1 has an incorrect access control vulnerability where an attacker can obtain complete access of the…
-
High 7.5
It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an ou…
-
Critical 9.9
In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991…
-
Critical 9.8
It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions…
-
High 7.5
It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM webso…