1 October 2020

47 results · Feed

• Unscored —
  CVE-2020-25990

  WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php. Expl…

  Oct 1, 2020
• Unscored —
  CVE-2020-24860

  CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persiste…

  Oct 1, 2020
• Unscored —
  CVE-2020-24861

  GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is exec…

  Oct 1, 2020
• Medium 5.9
  CVE-2020-8109

  Bitdefender ace.xmd parser out-of-bounds write (VA-8772)

  A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. This can result in denial-of-service. This issue affects: Bitdefend…

  Bitdefender Bitdefender Engines
  Oct 1, 2020
• Unscored —
  RUSTSEC-2020-0051

  Obsolete versions of the `rustsec` crate do not support the new V3 advisory format

  If you are seeing this message, you are running an obsolete version of `cargo-audit` which does not support the new V3 advisory format. These versions are end-of-life. This advisory is a notice that that it will soon be unable to parse the advisory database. …

  rustsec crates.io
  Oct 1, 2020
• Medium 5.4
  CVE-2019-20903

  Cross-site scripting in @atlaskit/editor-core

  The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.

  Atlassian @atlaskit/editor-core @atlaskit/editor-core npm
  Oct 1, 2020
• Unscored —
  CVE-2019-20902

  Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from befo…

  Atlassian Crowd
  Oct 1, 2020