Archive
October 2020
Vulnerabilities first published in this month (UTC), newest first.
1,608 results · Feed
-
High 8.3
Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-…
-
Medium 5.8
Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session…
-
High 8.3
Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allo…
-
High 7.5
Prototype Pollution
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this …
-
Unscored —
NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in whic…
-
Unscored —
NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in whic…
-
Unscored —
NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prio…
-
Unscored —
NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prio…
-
Unscored —
NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmw…
-
Unscored —
NVIDIA DGX servers, DGX-1 with BMC firmware versions prior to 3.38.30. DGX-2 with BMC firmware versions prior to 1.06.0…
-
Unscored —
NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery (CSRF)…
-
Unscored —
NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prio…
-
Unscored —
NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firm…
-
Medium 5.5
A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and befo…
-
High 7.5
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/setti…
-
Unscored —
CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error…
-
Unscored —
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.
-
Unscored —
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.
-
Unscored —
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service vi…
-
Medium 5.3
Gophish vulnerable to Server-Side Request Forgery
Gophish before 0.11.0 allows SSRF attacks.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.
-
Unscored —
An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69, a remote…
-
Unscored —
The God Kings application 0.60.1 for Android exposes a broadcast receiver to other apps called com.innogames.core.front…
-
Unscored —
Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker t…
-
Unscored —
A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack…
-
Unscored —
An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers t…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbi…
-
Unscored —
Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: …
-
Medium 6.1
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has a…
KEV May 24, 2022 -
High 8.0
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has a…
KEV May 24, 2022 -
Critical 9.8
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has alr…
KEV May 24, 2022 -
Unscored —
Sectona Spectra before 3.4.0 has a vulnerable SOAP API endpoint that leaks sensitive information about the configured a…
-
Unscored —
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents…
-
Unscored —
Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with…
-
Unscored —
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with oth…
-
Unscored —
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and view…
-
Unscored —
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
-
Unscored —
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.