Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
2,205 results · Feed
-
Low 3.7
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by imp…
-
High 7.5
Denial of Service in mqtt
Affected versions of `mqtt` will cause the node process to crash when receiving specially crafted MQTT packets, making the application vulnerable to a denial of service condition. ## Recommendation Update to v1.0.0 or later
-
High —
Cross-Site Scripting (XSS) in pivottable
Affected versions of `pivottable` are vulnerable to cross-site scripting, due to a new mechanism used to render JSON elements. ## Recommendation Update to version 2.0.0 or later.
-
Medium —
Cross-Site Scripting in c3
Affected versions of `c3` are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips. ## Recommendation Update to 0.4.11 or later.
-
Critical —
Cross-Site Scripting in swagger-ui
Affected versions of `swagger-ui` are vulnerable to cross-site scripting via the `url` query string parameter. ## Recommendation Update to 2.2.1 or later.
-
Medium —
Spoofing attack due to unvalidated KDC in node-krb5
Affected versions of `node-krb5` do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials. ## Recommendation It appears t…
-
High —
fuelux vulnerable to Cross-Site Scripting in Pillbox feature
Affected versions of `fuelux` contain a cross-site scripting vulnerability in the Pillbox feature. By supplying a script as a value for a new pillbox, it is possible to cause arbitrary script execution. ## Recommendation Update to version 3.15.7 or later.
-
Medium 5.3
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An atta…
-
Medium 6.3
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to SQL injection. A remote authenticated attacker could send s…
-
High —
Cross-Site Scripting in swagger-ui
Affected versions of `swagger-ui` are vulnerable to cross-site scripting. This vulnerability exists because `swagger-ui` automatically executes external Javascript that is loaded in via the `url` query string parameter when a `Content-Type: application/javasc…
-
High —
Cross-Site Scripting in jqtree
Affected versions of `jqtree` are vulnerable to cross-site scripting in the drag and drop functionality for modifying tree data. When a user attempts to drag a node to a different position in the hierarchy, script content existing within the node will be exec…
-
High —
Cross-Site Scripting in emojione
Affected versions of `emojione` are vulnerable to cross-site scripting when user input is passed into the `toShort()`, `shortnameToImage()`, `unicodeToImage()`, and `toImage()` functions. ## Recommendation Update to version 1.3.1 or later.
-
High —
XSS in client rendered block templates in rendr
Affected versions of `rendr` are vulnerable to cross-site scripting when client side rendering is done inside a `_block`. Server side rendering is not affected and is properly escaped. ## Recommendation Update to version 1.1.4 or later.
-
High —
DOM-based XSS in gmail-js
Affected versions of `gmail-js` are vulnerable to cross-site scripting in the `tools.parse_response`, `helper.get.visible_emails_post`, and `helper.get.email_data_post` functions, which pass user input directly into the Function constructor. ## Recommendation…
-
High —
Cross-Site Scripting in bootstrap-tagsinput
All versions of `bootstrap-tagsinput` are vulnerable to cross-site scripting when user input is passed into the `itemTitle` parameter unmodified, as the package fails to properly sanitize or encode user input for that parameter. ## Recommendation This package…
-
Critical —
Cross-Site Scripting in swagger-ui
Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API. Additionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the qu…
-
Critical 9.8
SQL Injection via GeoJSON in sequelize
Affected versions of `sequelize` are vulnerable to SQL Injection in Models that have fields with the `GEOMETRY` DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using `ST_GeomFromGeoJSON`, and …
-
Medium 4.2
Insecure Defaults Leads to Potential MITM in ezseed-transmission
Affected versions of `ezseed-transmission` download and run a script over an HTTP connection. An attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromis…
-
Medium 6.3
Template Injection in jsrender
Affected versions of `jsrender` are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input. ## Proof of Concept ```js //POC-REQUEST {{for ~x!=1?(constructor.constructor("ret…
-
High 8.7
Forgeable Public/Private Tokens in jws
Affected versions of the `jws` package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use…
-
Critical —
Command Injection in gm
Versions of `gm` prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into `gm.compare()`, which fails to sanitize input correctly before calling the graphics magic binary. ## Recommendati…
-
Medium 5.3
Regular Expression Denial of Service in bleach
All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. ## Recommendation The `bleach` package is not currently maintained, and has not seen an upd…
-
High 7.5
Denial of Service in yar
Versions of `yar` prior to 2.2.0 are affected by a denial of service vulnerability related to an invalid encrypted session cookie value. When an invalid encryped session cookie value is provided, the process will crash. ## Recommendation Update to version 2.2…
-
Unscored —
Spiceworks Version <= 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XS…
-
Unscored —
gmapfp.org Joomla Component GMapFP J3.30pro is affected by Insecure Permissions. An attacker can access the upload func…
-
High 7.5
Rapid7 Metasploit HTTP Handler Denial of Service
By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established…
-
Medium 6.4
SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page MassD…
-
Medium 6.4
SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page Cours…
-
Medium 6.4
SQL injection vulnerability exists in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page Choose…
-
Medium 6.4
SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. A specially crafted HTTP req…
-
Medium 6.4
SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. The id parameter in the page…
-
Medium 6.4
SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. The course_period_id paramet…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3. A specially …
-
Medium 6.4
An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3. The email …
-
Medium 6.4
An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3. The email …
-
Medium 4.3
Trailer Power Line Communications vulnerability
All trailer Power Line Communications are affected. PLC bus traffic can be sniffed reliably via an active antenna up to 6 feet away. Further distances are also possible, subject to environmental conditions and receiver improvements.
-
Medium 6.4
SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The mn parameter in the …
-
Medium 6.4
SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The ln parameter in the…
-
Medium 6.4
SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The fn parameter in the …
-
High 7.5
Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction.