Archive
October 2020
Vulnerabilities first published in this month (UTC), newest first.
1,608 results · Feed
-
Unscored —
The API on Winston 1.5.4 devices is vulnerable to CSRF.
-
Low —
CLI does not correctly implement strict mode
In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a…
-
Unscored —
Winston 1.5.4 devices are vulnerable to command injection via the API.
-
High 7.7
Unauthorized privilege escalation in Mod module
Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition …
-
High 7.5
IBM Sterling Connect Direct for Microsoft Windows 4.7, 4.8, 6.0, and 6.1 could allow a remote attacker to cause a denia…
-
Medium 6.5
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sy…
-
Unscored —
Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause…
-
Unscored —
NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUS_SCM_BlockStart.php?code= XSS.
-
Unscored —
osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.
-
Unscored —CVE-2020-27976 Public exploit
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter…
-
Unscored —
The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-u…
-
Medium 6.1
Grafana XSS via a query alias for the ElasticSearch datasource
Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
-
Unscored —
A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduc…
-
Unscored —
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Si…
-
Unscored —
A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.
-
High 7.2
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perfor…
KEV Nov 3, 2021 -
Unscored —CVE-2020-8241 Public exploit
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a MITM Attack if end use…
-
Unscored —
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perfor…
-
Unscored —
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry privilege escalation at…
-
Unscored —CVE-2020-8254 Public exploit
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to…
-
Unscored —
A vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an endpoint machine can use syst…
-
Unscored —CVE-2020-8250 Public exploit
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.
-
Unscored —CVE-2020-8249 Public exploit
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer overfl…
-
Unscored —CVE-2020-8248 Public exploit
A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.
-
Unscored —
SonicWall Global VPN client version 4.10.4.0314 and earlier allows unprivileged windows user to elevate privileges to S…
-
Unscored —
SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerabil…
-
Unscored —
The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When cert…
-
Unscored —
An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the us…
-
Unscored —
When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial …
-
Unscored —
Issues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0.1Beta. Due to insufficien…
-
Unscored —
An issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in the default installati…
-
Unscored —
Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66. Due to insufficien…
-
Unscored —
An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation di…
-
Unscored —
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS.
-
Unscored —
A logic issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.1, Security Update 20…
-
Unscored —
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, watchOS 5.2.1.…
-
Unscored —
A validation issue existed in Trust Anchor Management. This issue was addressed with improved validation. This issue is…
-
Unscored —
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Apple Music 3.4.0…
-
Unscored —
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.7, Secur…
-
Unscored —
This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.7, Security Update 2020-005 …