Skip to content
OpenAdvisories

Archive

26 October 2020

Vulnerabilities first published on this day (UTC), newest first.

← September 2020 2020 / October /26 November 2020 →
  1. 147
  2. 273
  3. 3 
  4. 41
  5. 523
  6. 672
  7. 728
  8. 855
  9. 941
  10. 106
  11. 11 
  12. 1260
  13. 1323
  14. 1452
  15. 1552
  16. 16201
  17. 171
  18. 181
  19. 1998
  20. 2049
  21. 21245
  22. 2299
  23. 2328
  24. 24 
  25. 251
  26. 2626
  27. 27173
  28. 2859
  29. 2954
  30. 3026
  31. 3114
All Critical High Medium Low Exploited only Public exploit

26 results · Feed

  • Unscored —
    CVE-2020-27743

    libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to…

    libpam-tacplus Ubuntu
  • High 7.5
    CVE-2020-1915

    Out-of-bounds Read in Facebook Hermes

    An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this i…

    Facebook Hermes hermes-engine npm
  • Unscored —
    CVE-2020-26879 Scanner template EPSS 44%

    Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attack…

  • Unscored —
    CVE-2020-26878 Public exploit EPSS 12%

    Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API …

  • Unscored —
    CVE-2020-25034

    eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via t…

  • Medium 5.8
    CVE-2020-15274

    Stored XSS via search result in Wiki.js

    In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit…

    requarks Wiki.js
  • High 8.7
    CVE-2020-15272

    Shell-injection in git-tag-annotation GitHub action

    In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable].…

    ericcornelissen git-tag-annotation-action
  • Critical 9.3
    CVE-2020-15271

    Shell Command Execution in lookatme

    In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their…

    d0c-s4vage lookatme lookatme lookatme Debian PyPI
  • Unscored —
    CVE-2017-18925

    opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and…

    opentmpfiles Ubuntu
  • Unscored —
    CVE-2020-26566

    A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a…

    motion motion Debian Ubuntu
  • Unscored —
    CVE-2020-26161

    In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host heade…

  • High 8.8
    CVE-2020-7752

    Command Injection

    This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.

    systeminformation npm
  • Unscored —
    CVE-2020-27187

    An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logi…

    kpmcore kpmcore kpmcore Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-6876

    A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of c…

  • Unscored —
    CVE-2020-18766

    A cross-site scripting (XSS) vulnerability AntSword v2.0.7 can remotely execute system commands.

  • Unscored —
    CVE-2020-7127

    A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Pr…

  • Unscored —
    CVE-2020-7126

    A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to…

  • Unscored —
    CVE-2020-7125

    A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.

  • Unscored —
    CVE-2020-7124

    A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.

  • Unscored —
    CVE-2020-24632

    A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1…

  • Unscored —
    CVE-2020-24631

    A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.…

  • Unscored —
    CVE-2020-15897

    Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attac…

  • Unscored —
    CVE-2020-7197

    SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off no…

  • Unscored —
    CVE-2020-7196

    The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of ha…

  • Unscored —
    CVE-2020-13100

    Arista’s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x be…

  • Unscored —
    CVE-2020-25470

    AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added si…