Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
418 results · Clear filters · Feed
-
Medium 6.5
Cross-Site Scripting in @hapi/boom
Versions of `@hapi/boom` prior to 0.3.8 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser. ## Recommendation Upgrade to version 0.…
-
Medium 5.3
Outdated Static Dependency in vue-moment
Versions of `vue-moment` prior to 4.1.0 contain an Outdated Static Dependency. The package depends on `moment` and has it loaded statically instead of as a dependency that can be updated. It has `moment@2.19.1` that contains a Regular Expression Denial of Ser…
-
Medium 6.5
Cross-Site Scripting in react
Affected versions of `react` are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input. ## Recommendation If y…
-
Medium —
Sandbox Breakout / Prototype Pollution in notevil
Versions of `notevil` prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype. Evaluating the payload ```try{a[b];}catch…
-
Medium 5.0
Sensitive Data Exposure vulnerability in McAfee True Key Windows Client
Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key (TK) prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine vi…
-
Medium 5.7
IBM InfoSphere Metadata Asset Manager 11.7 is vulnerable to server-side request forgery. By sending a specially crafted…
-
Medium 6.4
IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to…
-
Medium 4.3
Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker t…
-
Medium 4.3
Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability
A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to …
-
Medium 4.7
Cisco Small Business RV340 Series Routers Command Injection and Remote Code Execution Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system (OS) as …
-
Medium 4.7
Cisco Small Business RV340 Series Routers Command Injection and Remote Code Execution Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system (OS) as …
-
Medium 6.5
Cisco Jabber for Windows Information Disclosure Vulnerability
A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specia…
-
Medium 5.7
Cisco Jabber for Windows Universal Naming Convention Link Handling Vulnerability
A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by se…
-
Medium 4.4
Cisco Webex Meetings Client for Windows, Webex Meetings Desktop App, and Webex Teams Information Disclosure Vulnerability
A vulnerability in the media engine component of Cisco Webex Meetings Client for Windows, Cisco Webex Meetings Desktop App for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to gain access to sensitive information. The…
-
Medium 5.3
Cisco Webex Training Unauthorized Meeting Join Vulnerability
A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meet…
-
Medium 6.0
Cisco FXOS Software Buffer Overflow Vulnerability
A vulnerability in Cisco FXOS Software could allow an authenticated, local attacker with administrative credentials to cause a buffer overflow condition. The vulnerability is due to incorrect bounds checking of values that are parsed from a specific file. An …
-
Medium 5.3
Cisco Email Security Appliance Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to insuffi…
-
Medium —
Denial of Service in handlebars
Affected versions of `handlebars` are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service. ## …
-
Medium 6.8
Authentication Bypass in saml2-js
Versions of `saml2-js` prior to 2.0.5 are vulnerable to an Authentication Bypass. The package fails to enforce the assertion conditions for encrypted assertions, which may allow an attacker to reuse encrypted assertion tokens indefinitely. ## Recommendation U…
-
Medium 5.9
Insecure Cryptography Algorithm in simple-crypto-js
Versions of `simple-crypto-js` prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data. ## Recommendation Upgrade to version 2.3.0 or later.
-
Medium —
Denial of Service in http-live-simulator
Versions of `http-live-simulator` prior to 1.0.8 are vulnerable to Denial of Service. The package fails to catch an exception that causes the Node process to crash, effectively shutting down the server. This allows an attacker to send an HTTP request that cra…
-
Medium 5.0
Sensitive Data Exposure in ibm_db
Versions of `ibm_db` prior to 2.6.0 are vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode. ## Recommendation Upgrade to version 2.6.0 or later and ensure sensitive information was not logg…
-
Medium 6.5
Configuration Override in helmet-csp
Versions of `helmet-csp` before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the `default-src` CSP policy, which is the fallback policy. This …
-
Medium 6.5
Cross-Site Scripting in mavon-editor
All versions of `mavon-editor` are vulnerable to Cross-Site Scripting. The package fails to sanitize entered input, allowing attackers to execute arbitrary JavaScript in a victim's browser. ## Recommendation No fix is currently available. Consider using an al…
-
Medium —
Unintended Require in larvitbase-www
All versions of `larvitbase-www` are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is ru…
-
Medium —
Path Traversal in public
All versions of `public` are vulnerable to Path Traversal. This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL. ## Recommendation No fix is currently available. Do not use `public` in product…
-
Medium —
Denial of Service in sequelize
Versions of `sequelize` prior to 4.44.4 are vulnerable to Denial of Service (DoS). The SQLite dialect fails to catch a `TypeError` exception for the `results` variable. The `results` value may be undefined and trigger the error on a `.map` call. This may allo…
-
Medium —
Local File Inclusion in domokeeper
All versions of `domokeeper` are vulnerable to Local File Inclusion. The `/plugin/` route passes a GET parameter unsanitized to a `require()` call. It then returns the output of `require()` in the server response. This may allow attackers to load unintended c…
-
Medium 6.5
Reverse Tabnabbing in quill
Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening l…
-
Medium —
Open Redirect in apostrophe
Versions of `apostrophe` prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing `/` were appended at the end. ## Recommendation Update to version 2.92.0 or later.
-
Medium 6.5
Cross-Site Scripting in @berslucas/liljs
Versions of `@berslucas/liljs` prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. ## Recomm…
-
Medium 6.1CVE-2020-23814 Scanner template
xxl-job Multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.
-
Medium 6.1
silverstripe-advancedreports vulnerable to XSS
silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectRepo…
-
Medium —
Buffer Overflow in node-weakauras-parser
Affected versions of `node-weakauras-parser` are vulnerable to a Buffer Overflow. The `encode_weakaura` function fails to properly validate the input size. A buffer of 13835058055282163711 bytes causes an overflow on 64-bit systems. ## Recommendation Upgrade …
-
Medium —
HTML Injection in marky-markdown
All versions of `marky-markdown` are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is `youtube.com` but it is possible to bypass the validation with sources where `youtube.com` is the sub-domain, suc…
-
Medium 6.8
Unquoted Path in Rapid7 Nexpose Installer
Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file into the executable path. This issue affects: Rapid7 Nexpose versions prior to 6.6.40.
-
Medium 5.8
Code Injection in Rapid7 Nexpose Installer
In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a va…
-
Medium 6.5
IBM API Connect 2018.4.1.0 through 2018.4.1.12 could allow an attacker to launch phishing attacks by tricking the serve…
-
Medium 5.9
Denial of Service in ipfs-bitswap
Versions of `ipfs-bitswap` prior to 0.24.1 are vulnerable to Denial of Service (DoS). The package put unwanted blocks in the blockstore, which could be used to exhaust system resources in specific conditions. ## Recommendation Upgrade to version 0.24.1 or lat…
-
Medium —
Sandbox Breakout / Arbitrary Code Execution in value-censorship
All versions of `value-censorship` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code. ## Recommendation No fix is currently available. Cons…