Archive
October 2020
Vulnerabilities first published in this month (UTC), newest first.
298 results · Clear filters · Feed
-
High 7.5
Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial
Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial prior to 4.0.176.1 allows local users to schedule tasks which call malicious software to execute with elevated privileges via editing of environment variables
-
High 7.7
Privilege Escalation in Channelmgnt plug-in for Sopel
In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less …
-
High 7.8CVE-2020-17417 EPSS 10%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.3…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PhantomPDF 10.0.0.3…
-
High 7.8CVE-2020-17416 EPSS 10%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.0.3…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Foxit Reader 10.0.0.35798…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0…
-
High 7.8CVE-2020-17410 EPSS 10%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE …
-
High 7.3
Integer overflow in ROS communications library
Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated network traffic to cause unexpected behavior. This issue affects: OpenRobotics ros_comm communications packages Noetic …
-
High 7.3
Prototype Pollution
The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
-
High 7.5
An issue was discovered in HelpDeskZ 1.0.2. The feature to auto-login a user, via the RememberMe functionality, is pron…
-
High 7.5
ARC Informatique PcVue Exposure of Sensitive Information to an Unauthorized Actor
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit.
-
High 7.5
ARC Informatique PcVue Access to Critical Private Variable via Public Method
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems …
-
High 8.1
A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a speci…
-
High 7.1
An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A…
-
High 8.1
"Deserialization errors in MyBatis"
MyBatis before 3.5.6 mishandles deserialization of object streams.
-
High 8.8
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0…
-
High 8.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.10,…
-
High 8.3
Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6200 before 1.1.00.…
-
High 7.5
Certain NETGEAR devices are affected by CSRF. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before…
-
High 8.8
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5…
-
High 8.3
Certain NETGEAR devices are affected by authentication bypass. This affects GS110EMX before 1.0.1.7, GS810EMX before 1.…
-
High 7.3
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6220 before 1.1.0.100…
-
High 7.1
victor Web Client - Arbitrary File Deletion Vulnerability
A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a…
-
High 8.7CVE-2020-13340 EPSS 67%
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job…
-
High 7.8
IBM Informix spatial 14.10 could allow a local user to execute commands as a privileged user due to an out of bounds wr…
-
High 7.5
IBM QRadar SIEM 7.3 and 7.4 when configured to use Active Directory Authentication may be susceptible to spoofing attac…
-
High 8.8
Improper authorization due to caching in Jenkins Role-based Authorization Strategy Plugin
Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting in permissions being granted based on an outdated configuration.
-
High 7.1
PyroCMS Vulnerable to CSRF
PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary plugin will be deleted.
-
High 8.8
Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service Vulnerability
A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute arbitrary code on an affected device or cause the device to reload. This vulnerabil…
-
High 7.8
Cisco Webex Teams Client for Windows DLL Hijacking Vulnerability
A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an authenticated, local attacker to load a malicious library. To exploit this vulnerability, the attacker needs valid credentials on the Windows …
-
High 7.7
Cisco Identity Services Engine Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. The vulnerability is due to improper enforcement of role-ba…
-
High 8.0
Unauthenticated Stored XSS in GLPI
In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting …
-
High 8.7
SQL injection in GLPI
In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive informa…
-
High 7.4
Unauthenticated File Deletion in GLPI
In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the …
-
High 7.5
Prototype Pollution
This affects the package simpl-schema before 1.10.2.
-
High 7.5
An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Pr…
-
High 7.5
Unpreventable top-level navigation in Electron
In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation ac…