Skip to content
OpenAdvisories

Archive

19 October 2020

Vulnerabilities first published on this day (UTC), newest first.

← September 2020 2020 / October /19 November 2020 →
  1. 147
  2. 273
  3. 3 
  4. 41
  5. 523
  6. 672
  7. 728
  8. 855
  9. 941
  10. 106
  11. 11 
  12. 1260
  13. 1323
  14. 1452
  15. 1552
  16. 16201
  17. 171
  18. 181
  19. 1998
  20. 2049
  21. 21245
  22. 2299
  23. 2328
  24. 24 
  25. 251
  26. 2626
  27. 27173
  28. 2859
  29. 2954
  30. 3026
  31. 3114
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 5.6
    GHSA-8xv9-qcr9-ww9j

    Authenticated XML External Entity Processing

    ### Impact Authenticated XML External Entity Processing ### Patches We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/down…

    shopware/platform shopware/core Packagist
  • Medium 4.3
    CVE-2020-15245

    Email verification bypass in Sylius

    In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different ema…

    Sylius Sylius sylius/sylius Packagist
  • Medium 5.3
    CVE-2020-13937 Public exploit Scanner template EPSS 78%

    Authentication bypass in Apache Kylin

    Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's…

    org.apache.kylin:kylin Maven
  • Medium 6.1
    CVE-2020-26891

    Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint

    AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote attacker to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malic…

    matrix-synapse matrix-synapse synapse Ubuntu Alpine PyPI
  • Medium 5.3
    CVE-2020-8929

    Ciphertext integrity weakness in Tink

    A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This ca…

    Google Tink tink com.google.crypto.tink:tink Maven PyPI