Archive
5 November 2020
Vulnerabilities first published on this day (UTC), newest first.
60 results · Feed
-
Unscored —
A ZTE product is impacted by an information leak vulnerability. An attacker could use this vulnerability to obtain the …
-
Unscored —
Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. The vulnerabi…
-
Critical 9.8
Authentication bypass in Apache Shiro
Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
-
Unscored —
A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers usi…
-
Critical 9.3
An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.…
-
Critical 9.3
An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.…
-
High 7.5
A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled…
-
Unscored —
Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client …
-
High 7.8CVE-2020-24436 EPSS 17%
Acrobat Pro DC PDF Export Out-Of-Bounds Write Vulnerability Could Lead to Arbitrary Code Execution
Acrobat Pro DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds write vulnerability that could result in writing past the end of an allocated memory structure. An attacker co…
-
Low 2.8
Acrobat Reader DC for macOS Signature Validation Bypass
Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been impleme…
-
High 7.8CVE-2020-24433 EPSS 16%
Adobe Acrobat Reader DC Local Privilege Escalation via Installer Component
Adobe Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a local privilege escalation vulnerability that could enable a user without administrator privileges to delete arbitra…
-
Low 3.3
Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Information Disclosure
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interact…
-
Low 3.3
Acrobat Pro DC Out-Of-Bounds Read Vulnerability Could Lead to Information Disclosure
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulne…
-
High 7.8CVE-2020-24435 EPSS 53%
Acrobat Reader DC Heap-based Buffer Overflow Could Lead to Arbitrary Code Execution
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer overflow vulnerability in the submitForm function, potentially resulting in arbitrary code execution in …
-
Medium 6.7CVE-2020-24432 EPSS 11%
Acrobat Reader DC Arbitrary JavaScript Execution in PDF Documents
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) and Adobe Acrobat Pro DC 2017.011.30175 (and earlier) are affected by an improper input validation vulnerability that could result in arbitr…
-
High 7.8CVE-2020-24430 EPSS 19%
Acrobat Pro DC Use-After-Free vulnerability Could Lead to Arbitrary Code Execution
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability when handling malicious JavaScript. This vulnerability could result in arbitrary code executi…
-
High 7.7
Acrobat Reader DC for macOS Signature Verification Bypass Could Lead to Privilege Escalation
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a signature verification bypass that could result in local privilege escalation. Exploitation of this issue requir…
-
Medium 4.4
Acrobat Reader DC for macOS Dynamic Library Injection Vulnerability
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a security feature bypass that could result in dynamic library code injection by the Adobe Reader process. Exploit…
-
High 7.7
Acrobat Reader DC for macOS Race Condition Vulnerability Could Lead to Privilege Escalation
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a time-of-check time-of-use (TOCTOU) race condition vulnerability that could result in local privilege escalation.…
-
High 7.8CVE-2020-24437 EPSS 47%
Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Arbitrary Code Execution
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in th…
-
Low 3.3
Acrobat Reader DC Codec Input Validation Vulnerability Could Lead to Information Disclosure
Acrobat Reader versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an input validation vulnerability when decoding a crafted codec that could result in the disclosure of sensitive memory. An att…
-
Low 3.3
Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulne…
-
Unscored —
In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances…
-
Unscored —
In BIG-IQ 7.1.0, accessing the DoS Summary events and DNS Overview pages in the BIG-IQ system interface returns an erro…
-
Unscored —
In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface…
-
Unscored —
In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross…
-
Unscored —
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability ex…
-
Unscored —
On BIG-IP versions 16.0.0-16.0.0.1 and 15.1.0-15.1.0.5, using the RESOLV::lookup command within an iRule may cause the …
-
Unscored —
In BIG-IP PEM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-…
-
Unscored —
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edi…
-
Unscored —
A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could al…
-
Medium 6.6CVE-2020-12146 EPSS 28%
Silver Peak Unity OrchestratorTM subject to path traversal.
In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted files on the Orchestrator server using the/debugFiles REST API.
-
Medium 6.6
Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database.
In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing.
-
Medium 6.6
Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.
Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. O…
-
Unscored —
A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect con…
-
Unscored —
Telerik Fiddler through 5.0.20202.18177 allows attackers to execute arbitrary programs via a hostname with a trailing s…
-
Unscored —
A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 a…
-
Unscored —
A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an att…
-
Unscored —
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to re…
-
Low 3.2
IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force I…