Archive
20 October 2020
Vulnerabilities first published on this day (UTC), newest first.
49 results · Feed
-
Medium 5.3
SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated a…
-
High 7.5
SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an un…
-
High 7.6
SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML document…
-
Medium 5.7
SAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which ca…
-
High 7.6
Server-side Request Forgery (SSRF)
This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It wi…
-
Medium 5.6
Prototype Pollution
This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a prog…
-
Medium 6.3
Cross-site Scripting (XSS)
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
-
Unscored —
Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execu…
-
Unscored —
A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker …