Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
2,205 results · Feed
-
Unscored —
Heap buffer overflow in storage in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perfor…
-
Unscored —
Insufficient policy enforcement in networking in Google Chrome prior to 85.0.4183.102 allowed an attacker who convinced…
-
High 7.5
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack …
-
Medium 6.1
IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed a…
-
Medium 5.3
IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server …
-
High 7.5
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by send…
-
High 7.5
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by send…
-
Medium 4.3
IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or sess…
-
High 7.5
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by send…
-
Unscored —CVE-2020-16171 Public exploit
An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams…
-
Unscored —
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availabil…
-
Unscored —
Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-a…
-
Unscored —
Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field…
-
High 7.5
Array size is not checked in sized-chunks
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with unit().
-
Unscored —
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size i…
-
Unscored —
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, clone can have a…
-
Unscored —
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, insert_from can …
-
Unscored —
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the InlineArray implementation, an unalign…
-
Unscored —
Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP arch…
-
Unscored —
An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requestin…
-
Unscored —
An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mis…
-
Unscored —
An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. The cached_url feature mishandles JavaScript i…
-
Unscored —
webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header…
-
High 8.7
RFD Protection Bypass via jsessionid
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid pa…
-
High 7.5
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size i…
-
Unscored —
Improper authentication in Citrix StoreFront Server < 1912.0.1000 allows an attacker who is authenticated on the same M…
-
High 7.5
Uncontrolled Resource Consumption in json-bigint
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
-
Unscored —
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspe…
-
Unscored —
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix A…
-
Unscored —
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix A…
-
Critical 9.8CVE-2020-8158 Public exploit
TypeORM vulnerable to MAID and Prototype Pollution
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
-
Unscored —
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.…
-
Unscored —
Improper authentication in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix X…
-
Unscored —
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined t…
-
Unscored —
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can …
-
Unscored —
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies…
-
Unscored —
Unauthorized escalation of local privileges vulnerability on Micro Focus Operation Agent, affecting all versions prior …
-
Medium 5.3
Generation of Error Message Containing Sensitive Information in RESTEasy client
A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat…
-
Unscored —
Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a use-after-free (UAF) vulnerability. An authenticated,…
-
Unscored —
All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. A…