Archive
6 October 2020
Vulnerabilities first published on this day (UTC), newest first.
72 results · Feed
-
Unscored —
Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Ji…
-
Unscored —CVE-2020-16267 EPSS 41%
Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp …
-
Unscored —CVE-2020-15927 EPSS 41%
Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp …
-
Unscored —
An issue was discovered on Samsung mobile devices with Q(10.0) software. Auto Hotspot allows attackers to obtain sensit…
-
Unscored —
An issue was discovered in DirEncryptService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Pendi…
-
Unscored —
An issue was discovered in EthernetNetwork on Samsung mobile devices with O(8.1), P(9.0), Q(10.0), and R(11.0) software…
-
Unscored —
An issue was discovered in SystemUI on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Pendi…
-
Unscored —
An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software. They allow attac…
-
Unscored —
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. An attacker can a…
-
Unscored —
An issue was discovered in TimaService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. PendingInte…
-
Unscored —
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Sticker Center allows dire…
-
Unscored —
An issue was discovered on Samsung mobile devices with Q(10.0) software. The DynamicLockscreen Terms and Conditions can…
-
Low 3.5
Directory Traversal in xmpp-http-upload
In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This can lead to Information Disclosure and in some shared-hostin…
-
Medium 4.3
A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a li…
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes
-
High 7.5
An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Pr…
-
Unscored —
An issue was discovered on LG mobile devices with Android OS 9.0 and 10 software. The Wi-Fi subsystem has incorrect inp…
-
Unscored —
An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, and 9.0 software. The Network Management compone…
-
Medium 5.6CVE-2020-15215 Public exploit
Context isolation bypass in Electron
Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affe…
-
Unscored —
A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, Wh…
-
Unscored —
A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could …
-
Unscored —
A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could hav…
-
Unscored —
Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for…
-
Unscored —
An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for …
-
Unscored —
A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or What…
-
Unscored —
Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the applicatio…
-
High 7.5
Unpreventable top-level navigation in Electron
In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation ac…
-
Unscored —
"HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Str…
-
Unscored —
"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."
-
High 7.8
File restriction bypass in socket.io-file
The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects…
-
High 8.2CVE-2020-7740 Public exploit
Server-side Request Forgery (SSRF)
This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an…
-
Medium 5.9
IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user, under sp…
-
Medium 6.1
IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to emb…
-
Unscored —
D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metachar…
-
High 8.2
Server-side Request Forgery (SSRF)
This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.
-
Unscored —
In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was ad…
-
Unscored —
In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was a…
-
Unscored —
In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a b…
-
Unscored —
In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in…
-
Unscored —
Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScrip…