Archive
November 2020
Vulnerabilities first published in this month (UTC), newest first.
1,262 results · Feed
-
Unscored —
ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a comman…
-
Unscored —
Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. An authenticated, remote attacker…
-
Unscored —
HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attack…
-
Unscored —
HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker cou…
-
Unscored —
Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templat…
-
Unscored —
HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into a…
-
High 7.2
An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. An unauthenticated attacker …
-
Unscored —
Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by…
-
Unscored —
An issue was discovered on Canon MF237w 06.07 devices. An "Improper Handling of Length Parameter Inconsistency" issue i…
-
Unscored —
Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification. Thi…
-
Unscored —
Tesla Model X vehicles before 2020-11-23 have key fobs that rely on five VIN digits for the authentication needed for a…
-
Unscored —
Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob …
-
Unscored —
Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporar…
-
Unscored —
Quick Heal Total Security before 19.0 allows attackers with local admin rights to obtain access to files in the File Va…
-
Unscored —
Quick Heal Total Security before version 19.0 transmits quarantine and sysinfo files via clear text.
-
Unscored —
Quick Heal Total Security before 19.0 allows attackers with local admin rights to modify sensitive anti virus settings …
-
High 7.8
A privilege escalation vulnerability was reported in Lenovo PCManager prior to version 3.0.50.9162 that could allow an …
-
Unscored —
The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.
-
Low 2.6
In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can ac…
-
Unscored —
Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user.
-
Unscored —
The Estil Hill Lock Password Manager Safe app 2.3 for iOS has a *#06#* backdoor password. An attacker with physical acc…
-
Unscored —CVE-2020-29364 Public exploit
In NetArt News Lister 1.0.0, the news headlines vulnerable to stored xss attacks. Attackers can inject codes in news ti…
-
Unscored —CVE-2020-29390 EPSS 40%
Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that c…
-
Unscored —
File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain ser…
-
Unscored —
ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to …
-
Unscored —
An issue was discovered in PNGOUT 2020-01-15. When compressing a crafted PNG file, it encounters an integer overflow.
-
Medium 5.1
IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a…
-
Medium 5.3
IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated us…
-
Medium 6.5
IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote attacker could execute arbit…
-
Medium 5.0
IBM Cloud Pak for Security 1.3.0.1 (CP4S) could reveal sensitive information about the internal network to an authentic…
-
Medium 4.0
IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the f…
-
Low 3.7
IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could a…
-
Unscored —
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make …
-
Unscored —
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make …
-
Unscored —
The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can mak…
-
Critical 9.6
SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute …
-
High 8.4
Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to …
-
Unscored —
An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25. After logging into the portal a…
-
Unscored —
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
-
Unscored —
A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon through 2.18.5 (GENIVI Diagnostic Log…