Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
2,205 results · Feed
-
Critical 9.1
IBM Spectrum Protect Operations Center 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 may allow an attacker to ex…
-
Medium 5.4
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Medium 5.4
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Medium —
Unauthorized File Access in glance
Versions of `glance` prior to 3.0.7 are vulnerable to Unauthorized File Access. The package provides a `--nodot` option meant to hide files and directories with names that begin with a `.`, such as `.git` but fails to hide files inside a folder that begins wi…
-
Medium —
Cross-Site Scripting in buttle
All versions of `buttle` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, `buttle` does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files. ## Recommenda…
-
Low —
Cross-Site Scripting in express-cart
All versions of `harp` are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other p…
-
High 8.2
Arbitrary code execution via configuration file in Miller
In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See linked GitHub Security A…
-
High 8.0
RCE in Symfony
In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cac…
-
Unscored —
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Split…
-
Unscored —
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smugg…
-
High 8.8
Dolibarr Unrestricted Upload of File with Dangerous Type
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to…
-
Unscored —
Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specifica…
-
Unscored —
The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-…
-
Unscored —
Cross-site scripting in net/http/cgi and net/http/fcgi
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
-
Unscored —
In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as d…
-
Medium 4.3
Incorrect Authorization in TYPO3 extension
The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).
-
Medium 4.3
Information Disclosure in TYPO3 extension sf_event_mgt
The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, and event data via email) because of Broken Access Control.
-
Unscored —CVE-2020-24028 Public exploit
ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, passwo…
-
Unscored —CVE-2020-24029 Public exploit
Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can …
-
Unscored —CVE-2020-24030 Public exploit
ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and acces…
-
Unscored —
A Cross-Site Request Forgery (CSRF) vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 …
-
Medium —
Prototype Pollution in smart-extend
All versions of `smart-extend` are vulnerable to Prototype Pollution. The `deep()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects. ## Recommendation No fi…
-
High —
Command Injection in tomato
All versions of `tomato` are vulnerable to Command Injection. The /api/exec endpoint does not validate user input allowing attackers to run arbitrary commands in the system. ## Recommendation No fix is currently available. Consider using an alternative module…
-
High —
Improper Authorization in googleapis
Versions of `googleapis` prior to 39.1.0 are vulnerable to Improper Authorization. Setting credentials to one client may apply to all clients which may cause requests to be sent with the incorrect credentials. ## Recommendation Upgrade to version 39.1.0.
-
High —
Denial of Service in serialize-to-js
Versions of `serialize-to-js` prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead the execution to loop indefinitely. ## Recommendation Upgrade to version 2.0.0 or later.
-
High —
Arbitrary File Overwrite in decompress-zip
Vulnerable versions of `decompress-zip` are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because `decompress-zip` does not verify that extracted files do not resolve to targets outside of the extracti…
-
Critical —
Malicious Package in stream-combine
Version 2.0.2 of `stream-combine` has malicious code design to steal credentials and credit card information. The code searches all form elements for passwords, credit card numbers and CVC codes. It then uploads the information to a remote server using HTML l…
-
High —
Remote Code Execution in pi_video_recording
All versions of `pi_video_recording` are vulnerable to Remote Code Execution. Due to insufficient input validation the server executes arbitrary code through the /api/record/start endpoint. After running the server, `curl -POST -H "Content-Type: application/j…
-
High —
Improper Authorization in loopback
Vulnerable versions of `loopback` may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as the…
-
High —
Cross-Site Scripting in bootstrap-vue
Versions of `bootstrap-vue` prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the `options` variable. This may lead to the execution of malicious J…
-
High —
NoSQL Injection in loopback-connector-mongodb
Versions of `loopback-connector-mongodb` prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak. ## Recommendation Upgrade to vers…
-
Medium —
Sandbox Breakout / Arbitrary Code Execution in sandbox
All versions of `sandbox` through 0.8.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. Due to insufficient input sanitization it is possible to escape the sandbox using constructors. ## Proof of concept ``` var Sandbox = require("sandbox")…
-
Critical 9.8
Malicious Package in portionfatty12
All versions of `portionfatty12` are considered malicious. The package is malware designed to steal user's data. When installed it uploads the user's public SSH keys to a remote server. ## Recommendation This package is not available on the npm Registry anymo…
-
Critical 9.8
Malicious Package in rrgod
All versions of `rrgod` are considered malicious. The package is malware designed to run arbitrary scripts. When installed, the package downloads an arbitrary file and executes its contents as a pre, post and install scripts. ## Recommendation This package is…
-
Critical 9.8
Malicious Package in commander-js
All versions of `commander-js` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads an arbitrary file and executes its contents…
-
High —
Cross-Site Scripting in semantic-ui-search
All versions of `semantic-ui-search` are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text. ## Recommendation No fix is currently available. Consider using a…
-
High 7.3
Sandbox Breakout / Arbitrary Code Execution in static-eval
Versions of `static-eval`prior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. ## Proof of concept ``` var evaluate = require('st…
-
High —
Remote Code Execution in office-converter
All versions of `office-converter` are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution. ## Recommendation No fix is…
-
High —
Remote Code Execution in pomelo-monitor
All versions of `pomelo-monitor` are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution. ## Recommendation No fix is c…
-
High —
Sensitive Data Exposure in rails-session-decoder
All versions of `rails-session-decoder` are missing verification of the Message Authentication Code appended to the cookies. This may lead to decryption of cipher text thus exposing encrypted information. ## Recommendation No fix is currently available. Consi…