Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
2,205 results · Feed
-
Unscored —
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).
-
Unscored —
hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.
-
Unscored —
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a writ…
-
Unscored —
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
-
Unscored —
The Framer Preview application 12 for Android exposes com.framer.viewer.FramerViewActivity to other applications. By ca…
-
Unscored —
A Cross-Site Request Forgery (CSRF) vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attack…
-
Unscored —
bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 202…
-
Unscored —
Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to retrieve sensi…
-
Unscored —
Mitel MiCloud Management Portal before 6.1 SP5 could allow an unauthenticated attacker to execute arbitrary scripts due…
-
Unscored —
Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and acce…
-
Unscored —
Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system in…
-
Unscored —
The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary script…
-
Unscored —
A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.1…
-
Unscored —
Pexip Infinity before 24.1 has Improper Input Validation, leading to temporary denial of service via SIP.
-
Unscored —
Pexip Infinity before 23.4 has a lack of input validation, leading to temporary denial of service via H.323.
-
Unscored —
Pexip Infinity 23.x before 23.3 has improper input validation, leading to a temporary software abort via RTP.
-
Unscored —
Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN.
-
Unscored —
Pexip Infinity before 17 allows an unauthenticated remote attacker to achieve stored XSS via management web interface v…
-
Unscored —
Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup.
-
Unscored —
Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin.
-
Unscored —
Pexip Infinity before 18 allows remote Denial of Service (XML parsing).
-
Unscored —
Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP).
-
Unscored —CVE-2020-25749 Public exploit
The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) could allow …
-
Unscored —CVE-2020-25748 Public exploit
A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342,…
-
Unscored —CVE-2020-25747 Public exploit
The Telnet service of Rubetek RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) can allow a remote a…
-
Critical 9.8
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511…
KEV Mar 25, 2022 -
Unscored —
Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an au…
-
Unscored —
ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure fold…
-
Medium 5.4
Stored XSS in PrestaShop
In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.
-
Unscored —
vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register.
-
Unscored —
Blind SQL Injection in PrestaShop
PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8
-
Medium 5.4
Potential XSS in PrestaShop
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8
-
Medium 6.1
A DOM-based cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.…
-
Medium 6.1
A reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStati…
-
Unscored —
Lack of access control in Nakivo Backup & Replication Transporter version 9.4.0.r43656 allows remote users to access un…
-
Unscored —
Insecure permissions in Nakivo Backup & Replication Director version 9.4.0.r43656 on Linux allow local users to access …
-
High 7.4
Improper Certificate Validation in oauth ruby gem
lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
-
Medium 6.1CVE-2020-15930 Public exploit
Cross-site Scripting in Joplin
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.
-
High 8.8
Cisco IOS XE Software Privilege Escalation Vulnerabilities
Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to elevate privileges to the level of an Administrator user on an affected device. For more information a…