Archive
29 September 2020
Vulnerabilities first published on this day (UTC), newest first.
39 results · Feed
-
Unscored —
url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC fi…
-
Unscored —
info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct reque…
-
Medium 4.3
Authenticated users can exploit an enumeration vulnerability in Harbor
Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor.
-
Unscored —
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to exec…
-
Unscored —CVE-2018-5354 Public exploit
The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code a…
-
Unscored —
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with res…
-
Unscored —
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection …
-
Unscored —
Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers…
-
Unscored —
An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input …
-
Unscored —
Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on…
-
Unscored —
Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input vali…
-
Unscored —
In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user t…
-
Unscored —
md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial…
-
Medium 4.3
A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the restriction for Github pr…
-
High 8.3
A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowin…
-
Medium 6.5
A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a use…
-
High 7.1
A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting…
-
High 7.7
A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be …
-
Medium 5.4
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by i…
-
Medium 4.4
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in i…
-
Medium 6.5
An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a sto…
-
Medium 4.8
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable t…
-
Medium 6.5
An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions t…
-
High 7.2
A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthori…
-
Medium 5.3
Signature Validation Bypass in goxmldsig
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxml…
-
Medium 4.3
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission chec…
-
Medium 6.5
An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6. Improper…
-
Unscored —
An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cnda…
-
Low 3.3
IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass securit…
-
Unscored —
An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php
-
High 7.2
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to uplo…
KEV Nov 3, 2021 -
Unscored —
An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php
-
Unscored —
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain…
-
Unscored —
A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could…
-
Unscored —
An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php
-
Medium 4.3
An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration f…
-
Unscored —
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the…
-
Medium 4.3
An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to…
-
Medium 6.5
CRLF injection in urllib3
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.