30 September 2020

54 results · Feed

• Unscored —
  CVE-2020-21244

  An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder vi…

  Sep 30, 2020
• Low 3.5
  CVE-2019-17098

  Use of Hard-coded Cryptographic Key vulnerability in August Connect Wi-Fi Bridge App

  Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridg…

  August Connect Firmware Smart Lock and Connect Wi-Fi Bridge App
  Sep 30, 2020
• High 7.5
  CVE-2020-26160 Public exploit

  Authorization bypass in github.com/dgrijalva/jwt-go

  jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if th…

  gitness dgraph docker-credential-acr-env gitea Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 30, 2020
• Unscored —
  CVE-2020-22481

  An issue was discovered in HFish 0.5.1. When a payload is inserted where the password is entered, XSS code is triggered…

  Sep 30, 2020
• High 8.1
  CVE-2019-20920

  Arbitrary Code Execution in Handlebars

  Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on…

  handlebars node-handlebars node-handlebars Debian Ubuntu npm
  Sep 30, 2020
• Medium 6.1
  CVE-2019-20921

  Cross-site scripting in bootstrap-select

  bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

  bootstrap-select bootstrap-select npm NuGet
  Sep 30, 2020
• High 7.5
  CVE-2019-20922

  Regular Expression Denial of Service in Handlebars

  Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.

  handlebars node-handlebars Ubuntu npm
  Sep 30, 2020
• High 7.5
  CVE-2020-26149

  Sensitive data exposure in NATS

  NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.

  nats nats.ws npm
  Sep 30, 2020
• Low 3.2
  CVE-2020-15731

  Local Privilege Escalation in Bitdefender Engines (VA-8953)

  An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender…

  Bitdefender Bitdefender Engines
  Sep 30, 2020
• Unscored —
  CVE-2020-5132

  SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as …

  SonicWall SonicOS SMA100 SMA1000 Network devices
  Sep 30, 2020
• Unscored —
  CVE-2020-26157

  Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code…

  Sep 30, 2020
• Unscored —
  CVE-2020-26158

  Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This…

  Sep 30, 2020
• Unscored —
  CVE-2020-22842

  CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/mo…

  Sep 30, 2020
• Unscored —
  CVE-2020-14378

  An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large …

  ceph dpdk dpdk Debian Ubuntu Azure Linux
  Sep 30, 2020