Archive
October 2020
Vulnerabilities first published in this month (UTC), newest first.
338 results · Clear filters · Feed
-
Medium 6.5
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NET…
-
Medium 4.4
Information disclosure in JUnit4
In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files a…
-
Medium 4.3CVE-2020-13943 EPSS 53%
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent re…
-
Medium 6.4
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows…
-
Medium 5.2
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicio…
-
Medium 6.8
IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary command…
-
Medium 5.4
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 5.4
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 6.5
IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in …
-
Medium 4.9
IBM Security Guardium 11.2 could allow an attacker with admin access to obtain and read files that they normally would …
-
Medium 4.8
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja…
-
Medium 5.5
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a C…
-
Medium 4.9
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permiss…
-
Medium 6.2
Samsung Update Local Privilege Escalation Vulnerability
Samsung Update 3.0.2.0 ~ 3.0.32.0 has a vulnerability that allows privilege escalation as commands crafted by attacker are executed while the engine deserializes the data received during inter-process communication
-
Medium 4.3
OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Manage…
-
Medium 6.5
An improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9…
-
Medium 5.9
IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which le…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulner…
-
Medium 5.3
A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a rem…
-
Medium 5.4
An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling…
-
Medium 6.5
A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, whic…
-
Medium 5.3
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive usi…
-
Medium 5.3
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive usi…
-
Medium 5.3
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive usi…
-
Medium 6.1
phpMyAdmin Cross-site Scripting (XSS)
phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.
-
Medium 5.9
Missing Authentication for Critical Function in Apache Calcite
HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen wh…
-
Medium 6.8
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 befo…
-
Medium 6.7
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6200 before 1.1.00.38…
-
Medium 6.0
Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 …
-
Medium 5.4
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6200 before 1.1.00.…
-
Medium 4.1
Certain NETGEAR devices are affected by stored XSS. This affects EX7000 before 1.0.1.78, R6250 before 1.0.4.34, R6400 b…
-
Medium 4.1
Certain NETGEAR devices are affected by stored XSS. This affects EX7000 before 1.0.1.78, R6250 before 1.0.4.34, R6400 b…
-
Medium 6.4
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WC7500 before 6.5.5.24…
-
Medium 4.3
Certain NETGEAR devices are affected by stored XSS. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600…
-
Medium 5.9
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects WC7500 before 6.5.5.24, WC760…
-
Medium 4.7
Cross-Site Scripting in TYPO3 Fluid Engine
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultVa…
-
Medium —
XSS vulnerability when listing users on add & modify server pages.
### Impact An XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server. ### Patches T…
-
Medium 4.7
Open Redirect in Next.js
Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users altho…
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Previe…
-
Medium 5.7
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are st…