Archive
18 September 2020
Vulnerabilities first published on this day (UTC), newest first.
105 results · Feed
-
Unscored —
Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same M…
-
High 7.5
Uncontrolled Resource Consumption in json-bigint
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
-
Unscored —
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspe…
-
Unscored —
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix A…
-
Unscored —
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix A…
-
Critical 9.8CVE-2020-8158 Public exploit
TypeORM vulnerable to MAID and Prototype Pollution
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
-
Unscored —
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.…
-
Unscored —
Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix X…
-
Unscored —
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined t…
-
Unscored —
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can …
-
Unscored —
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies…
-
Unscored —
Unauthorized escalation of local privileges vulnerability on Micro Focus Operation Agent, affecting all versions prior …
-
Medium 5.3
Generation of Error Message Containing Sensitive Information in RESTEasy client
A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat…
-
Unscored —
Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a use-after-free (UAF) vulnerability. An authenticated,…
-
Unscored —
All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. A…
-
Medium —
Potential XSS in jQuery dependency in Mirador
### Impact Mirador users less than v3.0.0 (alpha-rc) versions that have an unpatched jQuery. When adopters update jQuery they will find some of Mirador functionality to be broken. ### Patches Mirador adopters should update to v3.0.0, no updates exist for v2.x…
-
Unscored —
Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credenti…
-
Medium 6.8
Philips Clinical Collaboration Platform Configuration
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
-
Critical 9.3
Admin account takeover in Alfresco Reset Password
The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem i…
-
Medium 6.5
Philips Clinical Collaboration Platform Algorithm Downgrade
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not properly control the allocation and maintenance of a limited resource, thereby enabling an attacker to influence the amount of resources consumed, eventually leading to the exhaustio…
-
Medium 5.0
Philips Clinical Collaboration Platform Protection Mechanism Failure
When an attacker claims to have a given identity, Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not prove or insufficiently proves the claim is correct.
-
Low 3.5
Philips Clinical Collaboration Platform Improper Neutralization of Script in Attributes in a Web Page
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a webpage that is served to other users.
-
Low 3.4
Philips Clinical Collaboration Platform Cross-site Request Forgery
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.
-
Unscored —
A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory wri…
-
Unscored —
InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at initi…
-
Unscored —
An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form…
-
Medium 6.8
Remote Code Execution in SOY CMS
SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to access a specially …
-
Unscored —
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The ASP.net SMS module can be used to read and validate…
-
Unscored —
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe …
-
Critical 10.0
Unauthenticated Remote Code Execution in SOY CMS
SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute any arbitrary code when the inquiry form feature is enabled by the service. The vulnerability is caused by unserializing the form …
-
Unscored —
A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulne…
-
Unscored —
In netd, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of serv…
-
Unscored —
In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disc…
-
Unscored —
In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information dis…
-
Unscored —
In Settings, there is a possible permissions bypass. This could lead to local information disclosure of the device's IM…
-
Unscored —
In core networking, there is a missing permission check. This could lead to local information disclosure of app network…
-
Unscored —
In NFC, there is a missing bounds check. This could lead to local information disclosure with System execution privileg…
-
Unscored —
In Telephony, there is a missing permission check. This could lead to local information disclosure of radio data with n…
-
Unscored —
In Zen Mode, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information…
-
Unscored —
In NotificationManagerService, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to…