Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
418 results · Clear filters · Feed
-
Medium —
Cross-Site Scripting in google-closure-library
Versions of `google-closure-library` prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The `safedomtreeprocessor.processToString()` function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through M…
-
Medium 6.8
Dell Inspiron 7352 BIOS versions prior to A12 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attack…
-
Medium 6.8
Dell Inspiron 7347 BIOS versions prior to A13 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attack…
-
Medium 6.8
Dell G7 17 7790 BIOS versions prior to 1.13.2 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attack…
-
Medium —
HTML Injection in preact
Versions of `preact` 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-S…
-
Medium 5.4
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Medium 5.4
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Medium 5.4
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Medium —
Unauthorized File Access in glance
Versions of `glance` prior to 3.0.7 are vulnerable to Unauthorized File Access. The package provides a `--nodot` option meant to hide files and directories with names that begin with a `.`, such as `.git` but fails to hide files inside a folder that begins wi…
-
Medium —
Cross-Site Scripting in buttle
All versions of `buttle` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, `buttle` does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files. ## Recommenda…
-
Medium 4.3
Incorrect Authorization in TYPO3 extension
The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).
-
Medium 4.3
Information Disclosure in TYPO3 extension sf_event_mgt
The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, and event data via email) because of Broken Access Control.
-
Medium —
Prototype Pollution in smart-extend
All versions of `smart-extend` are vulnerable to Prototype Pollution. The `deep()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects. ## Recommendation No fi…
-
Medium —
Sandbox Breakout / Arbitrary Code Execution in sandbox
All versions of `sandbox` through 0.8.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. Due to insufficient input sanitization it is possible to escape the sandbox using constructors. ## Proof of concept ``` var Sandbox = require("sandbox")…
-
Medium 6.1
The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS…
-
Medium 5.9
Man-in-the-middle attack in Apache Cassandra
In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle at…
-
Medium —
Out-of-bounds Read in base64url
Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below. ## Recommendation Update to version 3.0.0 or later.
-
Medium —
Remote Memory Exposure in openwhisk
Versions of `openwhisk` before 3.3.1 are vulnerable to remote memory exposure. When a number is passed to `api_key`, affected versions of `openwhisk` allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded). Proof o…
-
Medium 5.1
Remote Memory Exposure in mongoose
Versions of `mongoose` before 4.3.6, 3.8.39 are vulnerable to remote memory exposure. Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database. ## Recommendatio…
-
Medium —
Directory Traversal in featurebook
Affected versions of `featurebook` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of privat…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in the DownloadWindow.php functionality of OS4Ed openSIS 7.3. A speci…
-
Medium 6.4
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Stock Mana…
-
Medium 6.4CVE-2020-23835 Public exploit
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Man…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in the Validator.php functionality of OS4Ed openSIS 7.3. A specially …
-
Medium 6.4
IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of…
-
Medium 4.3
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to XML external entity injection, caused by improper validatio…
-
Medium —
Cross-Site Scripting in c3
Affected versions of `c3` are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips. ## Recommendation Update to 0.4.11 or later.
-
Medium —
Spoofing attack due to unvalidated KDC in node-krb5
Affected versions of `node-krb5` do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. ## Recommendation It appears t…
-
Medium 5.3
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An atta…
-
Medium 6.3
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to SQL injection. A remote authenticated attacker could send s…
-
Medium 4.2
Insecure Defaults Leads to Potential MITM in ezseed-transmission
Affected versions of `ezseed-transmission` download and run a script over an HTTP connection. An attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromis…
-
Medium 6.3
Template Injection in jsrender
Affected versions of `jsrender` are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input. ## Proof of Concept ```js //POC-REQUEST {{for ~x!=1?(constructor.constructor("ret…
-
Medium 5.3
Regular Expression Denial of Service in bleach
All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. ## Recommendation The `bleach` package is not currently maintained, and has not seen an upd…
-
Medium 6.4
SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page MassD…
-
Medium 6.4
SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page Cours…
-
Medium 6.4
SQL injection vulnerability exists in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page Choose…
-
Medium 6.4
SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. A specially crafted HTTP req…
-
Medium 6.4
SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. The id parameter in the page…
-
Medium 6.4
SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. The course_period_id paramet…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3. A specially …