Archive
October 2020
Vulnerabilities first published in this month (UTC), newest first.
92 results · Clear filters · Feed
-
Unscored —CVE-2020-27358 Public exploit
An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to expor…
-
Unscored —
WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
-
Unscored —CVE-2020-27747 Public exploit
An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself …
-
High 7.0
Client-Side Command Injection in Rapid7 Metasploit
Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.
-
Unscored —CVE-2020-27976 Public exploit
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter…
-
High 7.2
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perfor…
KEV Nov 3, 2021 -
Unscored —CVE-2020-8241 Public exploit
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a MITM Attack if end use…
-
Unscored —CVE-2020-8254 Public exploit
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to…
-
Unscored —CVE-2020-8250 Public exploit
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.
-
Unscored —CVE-2020-8249 Public exploit
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer overfl…
-
Unscored —CVE-2020-8248 Public exploit
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.
-
Unscored —CVE-2019-8852 Public exploit
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.2, S…
-
Unscored —CVE-2019-8656 Public exploit
This was addressed with additional checks by Gatekeeper on files mounted through a network share. This issue is fixed i…
-
High 7.1CVE-2020-15238 Public exploit
Local privilege escalation Blueman
Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polkit-1 is disabled and…
-
High 7.8CVE-2020-11858 Public exploit
Code execution with escalated privilegesn vlnerability in Operation bridge Manager and Operations Bridge (containerized) products.
Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,…
-
Critical 9.8
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products.
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Applicati…
-
Unscored —
Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API …
-
Unscored —CVE-2020-26887 Public exploit
FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of a DNS Rebinding protection mechanism.
-
Unscored —CVE-2020-15002 Public exploit
OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.
-
Unscored —CVE-2018-8062 Public exploit
A cross-site scripting (XSS) vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04_R02.A2pD035g.d23i firmwar…
-
High 8.8
Arbitrary code execution vulnerability on multiple Micro Focus products
Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management af…
-
Unscored —
tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.
-
Unscored —CVE-2020-27533 Public exploit
A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to…
-
Unscored —CVE-2020-24033 Public exploit
An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token auth…
-
Unscored —
The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_f…
-
Medium 6.1
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against …
KEV Nov 3, 2021 -
Critical 9.6CVE-2020-7750 Public exploit
Cross-site Scripting (XSS)
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
-
Unscored —CVE-2020-27603 Public exploit
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access ext…
-
High 7.2
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…
KEV Nov 3, 2021 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…
KEV Nov 3, 2021 -
High 7.5
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: In…
KEV Jan 18, 2022 -
Critical 10.0
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported v…
KEV Nov 3, 2021 -
Unscored —
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an upload…
-
Unscored —
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated adm…
-
Unscored —
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin use…
-
Unscored —CVE-2020-15931 Public exploit
Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challen…
-
Critical 9.8
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650…
KEV Nov 3, 2021 -
Medium 5.3
SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated a…
-
High 8.0
Unquoted service path vulnerability on Veyon
On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students a…
-
Medium 5.3
Authentication bypass in Apache Kylin
Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's…