Archive
12 October 2020
Vulnerabilities first published on this day (UTC), newest first.
60 results · Feed
-
Critical 9.8
JFrog Artifactory does not enforce default admin password change
Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Ar…
-
Unscored —
A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that request…
-
High 7.5
An issue was discovered in HelpDeskZ 1.0.2. The feature to auto-login a user, via the RememberMe functionality, is pron…
-
Medium 4.4
Information disclosure in JUnit4
In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files a…
-
Unscored —
In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs.
-
Unscored —
XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint w…
-
Unscored —CVE-2020-8821 EPSS 79%
An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A us…
-
Unscored —
An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter…
-
Unscored —
Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a buffer overflow vulnerability. A function in a module…
-
Unscored —
Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an information disclosure vulnerability. The device doe…
-
Unscored —
Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an out-of-bounds read and write vulnerability. Some fun…
-
Critical 9.8
ARC Informatique PcVue Deserialization of Untrusted Data
ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
-
High 7.5
ARC Informatique PcVue Exposure of Sensitive Information to an Unauthorized Actor
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit.
-
High 7.5
ARC Informatique PcVue Access to Critical Private Variable via Public Method
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems …
-
Medium 4.3CVE-2020-13943 EPSS 53%
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent re…
-
Unscored —
HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have a path traversal vulnerability. The system does not s…
-
Unscored —
HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) and versions earlier than 10.1.0.160(C01E160R2P8) have a b…
-
Unscored —
There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the …
-
Unscored —
Some Huawei products have an insufficient input verification vulnerability. Attackers can exploit this vulnerability in…
-
Unscored —
HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have an out-of-bounds read and write vulnerability. An una…
-
Unscored —
Taurus-AL00A version 10.0.0.1(C00E1R1P1) has an out-of-bounds read vulnerability in XFRM module. An authenticated, loca…
-
Unscored —
FusionAccess version 6.5.1 has an improper authorization vulnerability. A command is authorized with incorrect privileg…
-
Unscored —
HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have an out-of-bounds read and write vulnerability. An una…
-
Unscored —
WS5800-10 version 10.0.3.25 has a denial of service vulnerability. Due to improper verification of specific message, an…
-
Unscored —
Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a buffer overflow vulnerability. A function in a module…
-
Medium 6.4
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows…
-
Medium 5.2
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicio…
-
Medium 6.8
IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary command…
-
Medium 5.4
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 5.4
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 6.5
IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in …
-
Medium 4.9
IBM Security Guardium 11.2 could allow an attacker with admin access to obtain and read files that they normally would …
-
Medium 4.8
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 5.5
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a C…
-
Medium 4.9
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permiss…
-
Medium 6.2
Samsung Update Local Privilege Escalation Vulnerability
Samsung Update 3.0.2.0 ~ 3.0.32.0 has a vulnerability that allows privilege escalation as commands crafted by attacker are executed while the engine deserializes the data received during inter-process communication
-
Medium 4.3
OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Manage…
-
Medium 6.5
An improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9…
-
High 8.1
A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a speci…
-
Medium 5.9
IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which le…