Skip to content
OpenAdvisories

Archive

7 October 2020

Vulnerabilities first published on this day (UTC), newest first.

← September 2020 2020 / October /7 November 2020 →
  1. 147
  2. 273
  3. 3 
  4. 41
  5. 523
  6. 672
  7. 728
  8. 855
  9. 941
  10. 106
  11. 11 
  12. 1260
  13. 1323
  14. 1452
  15. 1552
  16. 16201
  17. 171
  18. 181
  19. 1998
  20. 2049
  21. 21245
  22. 2299
  23. 2328
  24. 24 
  25. 251
  26. 2626
  27. 27173
  28. 2859
  29. 2954
  30. 3026
  31. 3114
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.3
    CVE-2020-25768

    Contao Insert tag injection in forms

    Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.

    contao/core-bundle contao/contao Packagist
  • Medium 5.0
    CVE-2020-15226

    SQL Injection in GLPI Search API

    In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version…

    GLPI glpi
  • Medium 5.3
    CVE-2020-15217

    User data exposure in GLPI

    In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.

    GLPI glpi
  • Medium 6.6
    CVE-2020-7316

    File and Removable Media Protection update fixes one vulnerability

    Unquoted service path vulnerability in McAfee File and Removable Media Protection (FRP) prior to 5.3.0 allows local users to execute arbitrary code, with higher privileges, via execution and from a compromised folder. This issue may result in files not being …

    McAfee File & Removable Media Protection (FRP)
  • Medium 4.8
    CVE-2020-17551

    Cross-site scripting (XSS)

    ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.

    impresscms/impresscms Packagist
  • Medium 6.1
    CVE-2020-26870

    Cross-site Scripting in dompurify

    Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

    dompurify dompurify.js Ubuntu npm
  • Medium 6.5
    CVE-2020-13346

    Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allo…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.9
    CVE-2020-13334

    In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/g…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2020-13335

    Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account …

    GitLab GitLab gitlab Web / CMS Ubuntu