31 October 2020

14 results · Feed

• High 7.5
  CVE-2020-5425

  User Impersonation possible in Tanzu SSO

  Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same usern…

  VMware Tanzu Single Sign-On for VMware Tanzu
  Oct 31, 2020
• Unscored —
  CVE-2020-27359

  A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScri…

  Oct 31, 2020
• Unscored —
  CVE-2020-27358 Public exploit

  An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to expor…

  Oct 31, 2020
• Unscored —
  CVE-2020-27992

  Dr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because %PROGRAMFILES(X86)%\Wo…

  Oct 31, 2020
• Medium 4.0
  CVE-2020-15703

  aptdaemon allows unprivileged users to test for the presence of local files via the transaction Locale property

  There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and …

  Canonical aptdaemon aptdaemon aptdaemon Ubuntu PyPI
  Oct 31, 2020
• Unscored —
  CVE-2020-28032 Public exploit EPSS 16%

  WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.

  wordpress wordpress Debian Ubuntu
  Oct 31, 2020
• Unscored —
  CVE-2020-28033

  WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam…

  wordpress wordpress Debian Ubuntu
  Oct 31, 2020
• Unscored —
  CVE-2020-28034

  WordPress before 5.5.2 allows XSS associated with global variables.

  wordpress wordpress Debian Ubuntu
  Oct 31, 2020
• Unscored —
  CVE-2020-28036

  wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC t…

  wordpress wordpress Debian Ubuntu
  Oct 31, 2020
• Unscored —
  CVE-2020-28037

  is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is alr…

  wordpress wordpress Debian Ubuntu
  Oct 31, 2020
• Unscored —
  CVE-2020-28038

  WordPress before 5.5.2 allows stored XSS via post slugs.

  wordpress wordpress Debian Ubuntu
  Oct 31, 2020
• Unscored —
  CVE-2020-28040

  WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.

  wordpress wordpress Debian Ubuntu
  Oct 31, 2020
• Unscored —
  CVE-2020-28039

  is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not …

  wordpress wordpress Debian Ubuntu
  Oct 31, 2020
• Unscored —
  CVE-2020-28035

  WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.

  wordpress wordpress Debian Ubuntu
  Oct 31, 2020