Archive
October 2020
Vulnerabilities first published in this month (UTC), newest first.
1,608 results · Feed
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to i…
-
Unscored —
A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix publiXone before 2020.015 allows attackers to …
-
Unscored —
konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter.
-
Low 3.8
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Setti…
-
Unscored —
An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) bef…
-
Unscored —
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal …
-
Unscored —
libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to…
-
High 7.5
Out-of-bounds Read in Facebook Hermes
An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this i…
-
Unscored —
Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attack…
-
Unscored —
Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API …
-
Unscored —
eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via t…
-
Medium 5.8
Stored XSS via search result in Wiki.js
In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit…
-
High 8.7
Shell-injection in git-tag-annotation GitHub action
In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable].…
-
Critical 9.3
Shell Command Execution in lookatme
In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their…
-
Unscored —
opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and…
-
Unscored —
A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a…
-
Unscored —
In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host heade…
-
High 8.8
Command Injection
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
-
Unscored —
An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logi…
-
Unscored —
A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of c…
-
Unscored —
A cross-site scripting (XSS) vulnerability AntSword v2.0.7 can remotely execute system commands.
-
Unscored —
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Pr…
-
Unscored —
A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to…
-
Unscored —
A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
-
Unscored —
A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
-
Unscored —
A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1…
-
Unscored —
A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.…
-
Unscored —
Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attac…
-
Unscored —
SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off no…
-
Unscored —
The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of ha…
-
Unscored —
Arista’s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x be…
-
Unscored —
AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added si…
-
Medium 6.0
Prototype Pollution
pathval before version 1.1.1 is vulnerable to prototype pollution.
-
Unscored —
An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and S…
-
Medium 5.4
YOURLS Stored Cross Site Scripting (XSS)
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.
-
Unscored —
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform…
-
Unscored —
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protec…
-
Unscored —
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which …
-
Unscored —
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in its services in which a folder …
-
Unscored —
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Se…