Skip to content
OpenAdvisories

Archive

30 September 2020

Vulnerabilities first published on this day (UTC), newest first.

← August 2020 2020 / September /30 October 2020 →
  1. 1192
  2. 2134
  3. 3364
  4. 4123
  5. 51
  6. 6 
  7. 7 
  8. 852
  9. 9124
  10. 1043
  11. 11223
  12. 12 
  13. 136
  14. 1460
  15. 1553
  16. 1682
  17. 17138
  18. 18105
  19. 1912
  20. 20 
  21. 2158
  22. 2234
  23. 2376
  24. 2499
  25. 25112
  26. 26 
  27. 2711
  28. 2810
  29. 2939
  30. 3054
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.1
    CVE-2020-13952

    Plaintext password leak in Apache Superset

    In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata…

    apache-superset PyPI
  • High 7.8
    CVE-2020-6654

    DLL Hijacking

    A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attacker to execute arbitrary code by replacing the required DLLs with malicious DLLs when the software try to load vci11un6.DLL and cinpl.DLL.

    Eaton 9000x Programming and Configuration Software
  • High 7.5
    CVE-2020-13951 Public exploit EPSS 69%

    Denial of service in Apache OpenMeetings

    Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.

    org.apache.openmeetings:openmeetings-parent Maven
  • High 7.5
    CVE-2018-11765

    Improper Authentication in Apache Hadoop

    In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.

    org.apache.hadoop:hadoop-main Maven
  • High 8.2
    CVE-2020-12505

    WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07

    Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852, WAGO 750-880/xxx-xxx, WAGO 750-881, WAGO 750-831/xxx-xxx, WAGO …

    WAGO 750-882 750-889 750-852 ICS / OT
  • High 7.5
    CVE-2020-26160 Public exploit

    Authorization bypass in github.com/dgrijalva/jwt-go

    jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if th…

    gitness dgraph docker-credential-acr-env gitea Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.1
    CVE-2019-20920

    Arbitrary Code Execution in Handlebars

    Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on…

    handlebars node-handlebars node-handlebars Debian Ubuntu npm
  • High 7.5
    CVE-2019-20922

    Regular Expression Denial of Service in Handlebars

    Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.

    handlebars node-handlebars Ubuntu npm
  • High 7.5
    CVE-2020-26149

    Sensitive data exposure in NATS

    NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.

    nats nats.ws npm