Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
2,205 results · Feed
-
Unscored —
An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder vi…
-
Low 3.5
Use of Hard-coded Cryptographic Key vulnerability in August Connect Wi-Fi Bridge App
Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridg…
-
High 7.5CVE-2020-26160 Public exploit
Authorization bypass in github.com/dgrijalva/jwt-go
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if th…
-
Unscored —
An issue was discovered in HFish 0.5.1. When a payload is inserted where the password is entered, XSS code is triggered…
-
High 8.1
Arbitrary Code Execution in Handlebars
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on…
-
Medium 6.1
Cross-site scripting in bootstrap-select
bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.
-
High 7.5
Regular Expression Denial of Service in Handlebars
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.
-
High 7.5
Sensitive data exposure in NATS
NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.
-
Low 3.2
Local Privilege Escalation in Bitdefender Engines (VA-8953)
An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender…
-
Unscored —
SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as …
-
Unscored —
Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code…
-
Unscored —
Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This…
-
Unscored —
CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/mo…
-
Unscored —
An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large …
-
Unscored —
url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC fi…
-
Unscored —
info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct reque…
-
Medium 4.3
Authenticated users can exploit an enumeration vulnerability in Harbor
Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor.
-
Unscored —
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to exec…
-
Unscored —CVE-2018-5354 Public exploit
The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code a…
-
Unscored —
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with res…
-
Unscored —
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection …
-
Unscored —
Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers…
-
Unscored —
An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input …
-
Unscored —
Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on…
-
Unscored —
Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input vali…
-
Unscored —
In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user t…
-
Unscored —
md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial…
-
Medium 4.3
A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the restriction for Github pr…
-
High 8.3
A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowin…
-
Medium 6.5
A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a use…
-
High 7.1
A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting…
-
High 7.7
A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be …
-
Medium 5.4
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by i…
-
Medium 4.4
An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in i…
-
Medium 6.5
An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a sto…
-
Medium 4.8
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable t…
-
Medium 6.5
An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions t…
-
High 7.2
A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthori…
-
Medium 5.3
Signature Validation Bypass in goxmldsig
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxml…
-
Medium 4.3
An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission chec…