Archive
20 October 2020
Vulnerabilities first published on this day (UTC), newest first.
49 results · Feed
-
High 7.8
Adobe Illustrator Memory Corruption Vulnerability
Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This could result in arbitrary code execution in the context of the current user. This vulnerability requir…
-
High 7.8
Adobe Illustrator Memory Corruption Vulnerability
Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This could result in arbitrary code execution in the context of the current user. This vulnerability requir…
-
High 7.8
Adobe Illustrator PDF File Parsing Out-Of-Bounds Read Vulnerability
Adobe Illustrator version 24.2 (and earlier) is affected by an out-of-bounds read vulnerability when parsing crafted PDF files. This could result in a read past the end of an allocated memory structure, potentially resulting in arbitrary code execution in the…
-
High 7.8
Adobe Illustrator PDF File Parsing Out-Of-Bounds Read Vulnerability
Adobe Illustrator version 24.2 (and earlier) is affected by an out-of-bounds read vulnerability when parsing crafted PDF files. This could result in a read past the end of an allocated memory structure, potentially resulting in arbitrary code execution in the…
-
High 7.8
Adobe Illustrator Memory Corruption Vulnerability
Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This could result in arbitrary code execution in the context of the current user. This vulnerability requir…
-
High 7.8
Adobe Illustrator Memory Corruption Vulnerability
Adobe Illustrator version 24.1.2 (and earlier) is affected by a memory corruption vulnerability that occurs when parsing a specially crafted .svg file. This could result in arbitrary code execution in the context of the current user. This vulnerability requir…
-
High 7.8
Adobe Illustrator PDF File Parsing Out-Of-Bounds Write Vulnerability
Adobe Illustrator version 24.2 (and earlier) is affected by an out-of-bounds write vulnerability when handling crafted PDF files. This could result in a write past the end of an allocated memory structure, potentially resulting in arbitrary code execution in …
-
High 7.5
Blind stored XSS in Marketo Sales insight plugin for SalesForce
Marketo Sales Insight plugin version 1.4355 (and earlier) is affected by a blind stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed …
-
Unscored —
The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke querie…
-
Unscored —
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated adm…
-
Unscored —
Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tric…
-
Unscored —
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin use…
-
High 7.6
TIBCO Foresight SQL Injection
The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Health…
-
High 8.0
Privilege Escalation in Boxstarter
The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this direct…
-
High 7.4
Expired token reuse in Spree
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
-
Unscored —CVE-2020-15931 Public exploit
Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challen…
-
Unscored —
InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via …
-
Unscored —
DomainMOD before 4.14.0 uses MD5 without a salt for password storage.
-
Medium 4.3
Raise IT Solutions RITS Browser Address Bar Spooofing
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the RITS Browser version 3.3.9 and pri…
-
Medium 4.3
Yandex Browser Address Bar Spooofing
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser version 20.8.3 and …
-
Medium 4.3
Danyil Vasilenko Bolt Browser Address Bar Spooofing
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version …
-
Medium 4.3
UCWeb UC Browser Address Bar Spooofing
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and …
-
Medium 4.3
UCWeb UC Browser Address Bar Spooofing
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and …
-
Unscored —
In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fu…
-
Unscored —
VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Serv…
-
Unscored —
VMware NSX-T (3.x before 3.0.2, 2.5.x before 2.5.2.2.0) contains a security vulnerability that exists in the way it all…
-
Critical 9.8
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650…
KEV Nov 3, 2021 -
Unscored —
VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Wor…
-
Unscored —
VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Wor…
-
Unscored —
GE Reason S20 Ethernet Switch
The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicio…
-
Medium 6.2
IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0…
-
Medium 5.4
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Medium 6.1
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Medium 4.3
IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. …
-
Medium 5.4
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.…
-
Medium 4.0
IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denia…
-
Medium 6.3
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.2.2 is vulnerable to SQL injection. A remote attacker …
-
Medium 4.8
SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-…
-
High 8.2
There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.…
-
Medium 4.3
SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected r…