Archive
16 September 2020
Vulnerabilities first published on this day (UTC), newest first.
82 results · Feed
-
Unscored —
A DNS rebinding vulnerability in the Freebox OS web interface in Freebox Server before 4.2.3.
-
Unscored —
A DNS rebinding vulnerability in the UPnP IGD implementations in Freebox v5 before 1.5.29 and Freebox Server before 4.2…
-
Unscored —
A CSRF vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3.
-
Unscored —
A DNS rebinding vulnerability in Freebox v5 before 1.5.29.
-
Unscored —
A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2…
-
Unscored —
An attacker could send a specially crafted packet that could have CodeMeter (All versions prior to 7.10) send back pack…
-
Unscored —
CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a specifically crafted lice…
-
Unscored —
CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in…
-
Unscored —
This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All versions prior to 7.00 are …
-
Unscored —
Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected, including Version 6.90…
-
Unscored —
Multiple memory corruption vulnerabilities exist in CodeMeter (All versions prior to 7.10) where the packet parser mech…
-
High 8.8CVE-2020-6146 EPSS 75%
An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.…
-
Unscored —CVE-2020-13259 Public exploit
A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unaut…
-
Medium 6.8
Improper Certificate Validation in Bosch Smart Home System App for iOS
Improper certificate validation for certain connections in the Bosch Smart Home System App for iOS prior to version 9.17.1 potentially allows to intercept video contents by performing a man-in-the-middle attack.
-
Unscored —
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed…
-
Medium 4.9
Incorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in Keycloak
A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.
-
Unscored —
A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft…
-
Medium 6.1
Cross-site Scripting in Keycloak
A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks.
-
High 8.8
Insecure permissions on build temporary rootfs in Singularity
Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.
-
Unscored —
It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the u…
-
High 8.1
Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity
Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.
-
Medium 6.1
Cross-site scripting in Apache Atlas
Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it triggers the XSS vulnerability.
-
Unscored —CVE-2020-25015 Public exploit
A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generall…
-
Unscored —
VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an information disclosure vulnerabi…
-
Unscored —
VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain a denial of service vulnerability d…
-
Unscored —
VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability…
-
Unscored —
VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability…
-
Unscored —
VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability…
-
Unscored —
VMware Fusion (11.x) contains a privilege escalation vulnerability due to the way it allows configuring the system wide…
-
Unscored —
An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other t…
-
Low 3.7
IBM Security Trusteer Pinpoint Detect 11.6.5 could disclose some information due to using a wildcard in the Access-Cont…
-
Medium 6.8
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbi…
-
Unscored —
A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator (V1.2.0 and pr…
-
Unscored —
A CWE-284 Improper Access Control vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allo…
-
Unscored —
A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allow…
-
Unscored —
A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Transversal') vulnerability exists in SCADA…
-
Unscored —
A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) …
-
High 7.5
Incorrect Authorization in WildFly Elytron
A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information expos…
-
High 7.5
Allocation of Resources Without Limits or Throttling in Keycloak
A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.
-
Unscored —
The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified path…