Archive
19 October 2020
Vulnerabilities first published on this day (UTC), newest first.
98 results · Feed
-
Low —
Denial of Service via Cache Flooding
### Impact Denial of Service via Cache Flooding ### Patches We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#sh…
-
Medium 5.6
Authenticated XML External Entity Processing
### Impact Authenticated XML External Entity Processing ### Patches We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/down…
-
High 8.0
Unquoted service path vulnerability on Veyon
On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students a…
-
High 7.7
Prototype pollution in object-path
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new i…
-
Medium 4.3
Email verification bypass in Sylius
In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different ema…
-
High 7.5
An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-B…
-
High 7.5
An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-B…
-
Unscored —
A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to …
-
High 8.0
XSS in platform
In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.
-
Medium 5.3
Authentication bypass in Apache Kylin
Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's…
-
Low 3.7
Invalid integrity hashes in webpack-subresource-integrity
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection o…
-
Unscored —
E6878-370 versions 10.0.3.1(H557SP27C233),10.0.3.1(H563SP21C233) and E6878-870 versions 10.0.3.1(H557SP27C233),10.0.3.1…
-
Unscored —
HUAWEI Mate 20 versions earlier than 10.0.0.188(C00E74R3P8) have a buffer overflow vulnerability in the Bluetooth modul…
-
Unscored —
HUAWEI Mate 30 versions earlier than 10.1.0.150(C00E136R5P3) and HUAWEI P30 version earlier than 10.1.0.160(C00E160R2P1…
-
Unscored —
An issue was discovered in the _send_secure_msg() function of yubihsm-shell through 2.0.2. The function does not valida…
-
Unscored —
An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not expli…
-
Unscored —
HUAWEI Mate 20 versions earlier than 10.1.0.163(C00E160R3P8) have a JavaScript injection vulnerability. A module does n…
-
Unscored —
Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a privilege elevation vulnerability. Due to lack of pri…
-
Unscored —CVE-2019-13633 Public exploit
Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. An attacker can send arbitrary JavaScript code via a built…
-
Unscored —
Sprecher SPRECON-E firmware prior to 8.64b might allow local attackers with access to engineering data to insert arbitr…
-
Unscored —
In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped.
-
Unscored —
A DNS rebinding vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3.
-
Unscored —
GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMF_ScaledData(). Parsing malicious input can result in …
-
Unscored —
GoPro gpmf-parser 1.5 has a division-by-zero vulnerability in GPMF_Decompress(). Parsing malicious input can result in …
-
Unscored —
GoPro gpmf-parser 1.5 has a heap out-of-bounds read and segfault in GPMF_ScaledData(). Parsing malicious input can resu…
-
Unscored —
A iccselectrules expression language injection remote code execution vulnerability was discovered in HPE Intelligent Ma…
-
Unscored —
A perfaddormoddevicemonitor expression language injection remote code execution vulnerability was discovered in HPE Int…
-
Unscored —
A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intellig…
-
Unscored —
A devicethresholdconfig expression language injection remote code execution vulnerability was discovered in HPE Intelli…
-
Unscored —
A devsoftsel expression language injection remote code execution vulnerability was discovered in HPE Intelligent Manage…
-
Unscored —
A deviceselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Mana…
-
Unscored —
A faultflasheventselectfact expression language injectionremote code execution vulnerability was discovered in HPE Inte…
-
Unscored —
A userselectpagingcontent expression language injection remote code execution vulnerability was discovered in HPE Intel…
-
Unscored —
A reportpage index expression language injection remote code execution vulnerability was discovered in HPE Intelligent …
-
Unscored —
A powershellconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intel…
-
Unscored —
A tvxlanlegend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Mana…
-
Unscored —
A viewbatchtaskresultdetailfact expression language injection remote code execution vulnerability was discovered in HPE…
-
Unscored —
A forwardredirect expression language injection remote code execution vulnerability was discovered in HPE Intelligent M…
-
Unscored —
A sshconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Managem…
-
Unscored —
A smsrulesdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent …