Archive
6 November 2020
Vulnerabilities first published on this day (UTC), newest first.
23 results · Clear filters · Feed
-
Medium 5.9
Axios vulnerable to Server-Side Request Forgery
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
-
Medium 6.5
Cisco SD-WAN vManage Software Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization and modify the configuration of an affected system. The vulnerability is due to insufficient authoriza…
-
Medium 4.3
Cisco SD-WAN vManage Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-b…
-
Medium 6.4
Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. The vulnerability exists because the web-based management i…
-
Medium 6.4
Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. The vulnerability exists because the web-based management i…
-
Medium 6.1
Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-bas…
-
Medium 6.1
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerabili…
-
Medium 5.8
Cisco SD-WAN Software Packet Filtering Bypass Vulnerability
A vulnerability in the packet filtering features of Cisco SD-WAN Software could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters. The vulnerability is due to improper traffic filtering conditions on an affected device. An attacker…
-
Medium 6.3
Cisco Integrated Management Controller Command Injection Vulnerability
A vulnerability in the web UI of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary code and execute arbitrary commands at the underlying operating system level. The vulnerability is due to insuffici…
-
Medium 6.7
Cisco SD-WAN vManage Software Command Injection Vulnerability
A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands t…
-
Medium 6.5CVE-2020-27128 EPSS 59%
Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker c…
-
Medium 5.5
Cisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read Vulnerability
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read arbitrary files on the underlying operating system of an affected device. The vulnerabi…
-
Medium 4.4
Cisco Identity Services Engine Privilege Escalation Vulnerability
A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to elevate privileges on an affected device. To exploit this vulnerability, an attacker would need to have a val…
-
Medium 4.3
Cisco Unified Communications Manager IM and Presence Service Denial of Service Vulnerability
A vulnerability in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) Software could allow an authenticated, remote attacker to cause the Cisco XCP Authentication Service on an affected device to restart, resulting in a denia…
-
Medium 4.3
Cisco TelePresence Collaboration Endpoint Software Information Disclosure Vulnerability
A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper stora…
-
Medium 6.5
Cisco Edge Fog Fabric Resource Exposure Vulnerability
A vulnerability in the REST API of Cisco Edge Fog Fabric could allow an authenticated, remote attacker to access files outside of their authorization sphere on an affected device. The vulnerability is due to incorrect authorization enforcement on an affected …
-
Medium 4.8
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vul…
-
Medium 5.9
Denial of Service in teler
In teler before version 0.0.1, if you run teler inside a Docker container and encounter `errors.Exit` function, it will cause denial-of-service (`SIGSEGV`) because it doesn't get process ID and process group ID of teler properly to kills. The issue is patched…
-
Medium 4.3
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could disclose sensitive information to an authentica…
-
Medium 4.3
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive inf…
-
Medium 5.3
IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow an authenticated user to bypass security.…
-
Medium 5.5
SaltStack Salt Allows creating certificates with weak file permissions
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
-
Medium 6.1CVE-2020-28249 Public exploit
Cross-site scripting in Joplin
Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.