Archive
21 October 2020
Vulnerabilities first published on this day (UTC), newest first.
245 results · Feed
-
Medium 5.3
Cisco Firepower Threat Defense Software Hidden Commands Vulnerability
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration commands. An attacker could exploit this…
-
High 8.6
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IP Fragment Memory Leak Vulnerability
A vulnerability in the IP fragment-handling implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. This…
-
High 8.1
Cisco Firepower Management Center Software Common Access Card Authentication Bypass Vulnerability
A vulnerability in the Common Access Card (CAC) authentication feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and access the FMC system. The attacker must have a valid CAC t…
-
High 8.6
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services File Upload Denial of Service Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to upload arbitrary-sized files to specific folders on an affected devic…
-
Medium 6.7
Cisco FXOS Software for Firepower 4100/9300 Series Appliances Secure Boot Bypass Vulnerability
A vulnerability in the secure boot process of Cisco FXOS Software could allow an authenticated, local attacker to bypass the secure boot mechanisms. The vulnerability is due to insufficient protections of the secure boot process. An attacker could exploit thi…
-
High 8.8
Cisco FXOS Software Firepower Chassis Manager Cross-Site Request Forgery Vulnerability
A vulnerability in the Cisco Firepower Chassis Manager (FCM) of Cisco FXOS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected device. The vulnerability is due to insuffi…
-
Medium 6.7
Cisco FXOS Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An …
-
Medium 6.7
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 1000/2100 Series Appliances Secure Boot Bypass Vulnerabilities
Multiple vulnerabilities in the secure boot process of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software for the Firepower 1000 Series and Firepower 2100 Series Appliances could allow an authenticated, local attacker…
-
Medium 6.7
Cisco FXOS Software for Firepower 4100/9300 Series Command Injection Vulnerability
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An …
-
High 8.6
Cisco Firepower Management Center Software Denial of Service Vulnerability
A vulnerability in the licensing service of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.The vulnerability is due to improper handling of system resource values b…
-
High 8.2
Cisco Firepower Threat Defense Software Multi-Instance Container Escape Vulnerability
A vulnerability in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their Cisco FTD instance and execute commands with root privileges in the host namespace. T…
-
Medium 4.8
Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabil…
-
High 8.6
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software OSPFv2 Link-Local Signaling Denial of Service Vulnerability
A vulnerability in the OSPF Version 2 (OSPFv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resultin…
-
High 8.6
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL VPN Direct Memory Access Denial of Service Vulnerability
A vulnerability in the SSL VPN negotiation process for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a d…
-
High 8.6
Cisco Firepower Threat Defense Software SNMP Denial of Service Vulnerability
A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly. The vulnerability is …
-
High 8.1
Cisco Firepower Management Center Software and Firepower Threat Defense Software sftunnel Pass the Hash Vulnerability
A vulnerability in the sftunnel functionality of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to obtain the device registration hash. The vulnerability is du…
-
High 8.1
Cisco Firepower Management Center Software and Firepower Threat Defense Software Directory Traversal Vulnerability
A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to perform directory traversal and access directories outside the restricte…
-
Medium 4.8
Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabil…
-
Medium 5.8
Multiple Cisco Products SNORT HTTP Detection Engine File Policy Bypass Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets us…
-
High 8.8
Authentication bypass in Apache Hadoop
Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.
-
High 7.4
Regression in JWT Signature Validation
omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. …
-
Critical 9.6CVE-2020-7750 Public exploit
Cross-site Scripting (XSS)
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
-
Unscored —
SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary S…
-
Unscored —
Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an ar…
-
Unscored —
In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs…
-
Unscored —CVE-2020-27603 Public exploit
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access ext…
-
Unscored —
BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated …
-
Unscored —
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject…
-
Unscored —
In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop acc…
-
Unscored —
BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface.…
-
Unscored —
BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.
-
Unscored —
The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which a…
-
Unscored —
Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information…
-
Unscored —
The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external int…
-
Unscored —
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, …
-
Unscored —
BigBlueButton before 2.2.28 (or earlier) does not set the secure flag for the session cookie in an https session, which…
-
Unscored —
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authT…
-
Medium 5.3
A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earl…
-
Medium 6.5
Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Core). Suppo…
-
Medium 5.4
Vulnerability in the Oracle Application Express Data Reporter component of Oracle Database Server. The supported versio…