Archive
30 October 2020
Vulnerabilities first published on this day (UTC), newest first.
26 results · Feed
-
Unscored —
eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authent…
-
Unscored —
NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bo…
-
Unscored —
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by c…
-
High 7.3
Cross-Site Scripting in baserCMS
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering speci…
-
High 7.7
Cross Site Scripting in baserCMS
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.
-
Unscored —
A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the init…
-
Unscored —
A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter…
-
Unscored —
A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two…
-
High 7.2
Remote Code Execution in baserCMS
baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in…
-
Unscored —CVE-2020-7373 EPSS 45%
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabb…
-
Unscored —
A cross-site scripting (XSS) vulnerability exists in the Origin Client for Mac and PC 10.5.86 or earlier that could all…
-
Unscored —
A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to eithe…
-
Unscored —
Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E8…
-
High 7.7
IBM i2 iBase 8.9.13 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspectin…
-
Low 3.3
IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error messa…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/ja…
-
Medium 6.5
SQL Injection
The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demons…
-
Unscored —
Resource Management Errors vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 E…
-
Unscored —
Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function inc…
-
Unscored —
NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 Et…
-
Unscored —
Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 Ethe…
-
Unscored —
Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP …
-
Unscored —
Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP…
-
Unscored —
Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R, Q and L series CPU modules (R 00/01/02…
-
Unscored —
In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty va…
-
Medium 5.3
Uncontrolled Resource Consumption in WildFly
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attack…