Archive
5 October 2020
Vulnerabilities first published on this day (UTC), newest first.
23 results · Feed
-
Medium 5.9
Timing attack in Shrine
In Shrine before version 3.3.0, when using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant …
-
Unscored —
Mitsubishi Electric Multiple Products
Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remotely execute arbitrary commands.
-
Unscored —
Symmetric DS <3.12.0 uses mx4j to provide access to JMX over HTTP. mx4j, by default, has no auth and is available on al…
-
Medium 5.9
Sensitive data exposure in RACTF
In RACTF before commit f3dc89b, unauthenticated users are able to get the value of sensitive config keys that would normally be hidden to everyone except admins. All versions after commit f3dc89b9f6ab1544a289b3efc06699b13d63e0bd(3/10/20) are patched.
-
High 8.6
Directory Traversal in Wiki.js
In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. A malicious user can potentially read any file on the file system by crafting a special URL that al…
-
Unscored —
A ZTE product is impacted by the improper access control vulnerability. Due to lack of an authentication protection mec…
-
Unscored —
The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file withi…
-
Unscored —
Improper conditions check in BIOS firmware for 8th Generation Intel(R) Core(TM) Processors and Intel(R) Pentium(R) Silv…
-
Unscored —
Improper initialization in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor…
-
Unscored —
Insufficient control flow management in BIOS firmware 8th, 9th Generation Intel(R) Core(TM) Processors and Intel(R) Cel…
-
Unscored —
Insufficient control flow management in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron…
-
Unscored —
Improper permissions in the Intel(R) Driver & Support Assistant before version 20.7.26.7 may allow an authenticated use…
-
Unscored —
Buffer overflow in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & …
-
Unscored —CVE-2020-26061 Public exploit
ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerabil…
-
Critical 9.8
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow an attacker to bypass authentication and issue commands using a…
-
Medium 5.0
Ansible does not collect garbage after playbook run
A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality.
-
Unscored —
Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permis…
-
Unscored —
A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher …
-
Unscored —
Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view …
-
Unscored —
A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amoun…
-
Medium 6.6
A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file …
-
Unscored —
The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attacke…
-
Medium 6.0
Prototype Pollution
This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.