Archive
9 November 2020
Vulnerabilities first published on this day (UTC), newest first.
42 results · Feed
-
Unscored —
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may…
-
Unscored —
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash tha…
-
Unscored —CVE-2020-27019 EPSS 18%
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulne…
-
Unscored —
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processi…
-
Unscored —
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery v…
-
Unscored —
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (C…
-
Unscored —
The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to e…
-
Critical 9.8
gajira-create GitHub action vulnerable to arbitrary code execution
The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue.
-
Unscored —
upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overf…
-
Unscored —
The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x…
-
Unscored —
An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputSt…
-
High 7.0
IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote attacker could execute…
-
Medium 4.8
IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery …
-
Medium 4.0
IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which …
-
Unscored —
CapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges for an actor who attempt…
-
Medium 6.1
Locust Stored Cross-site Scripting Vulnerability
A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users.
-
Unscored —CVE-2020-27982 Scanner template
IceWarp 11.4.5.0 allows XSS via the language parameter.
-
Unscored —
An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLD…
-
Unscored —
Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a use…
-
Unscored —
Microweber 1.1.18 is affected by broken authentication and session management. Local session hijacking may occur, which…
-
Unscored —
An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can u…
-
Medium 5.5
Microweber Insufficient Session Expiry
Microweber v1.1.18 is affected by no session expiry after log-out.
-
Medium 6.8
Path Traversal
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be expose…
-
Unscored —
There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description para…
-
Unscored —
The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin,…
-
Medium 5.7
An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correc…
-
Unscored —
A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrit…
-
Unscored —
A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the i…
-
High 7.5
Prototype pollution in json8-merge-patch
Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.
-
Unscored —
The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the time…
-
Unscored —
Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header.
-
High 7.1
Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Too…
-
Unscored —
The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a …
-
Unscored —
An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform upli…
-
Low 2.7
Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API w…
-
Critical 9.1
Arbitrary code execution via file import functionality
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data an…
-
Low 3.7
Document root path disclosure on Maintenance page
When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able t…
-
Medium 4.3
Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.
-
Low 2.7
Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized ch…
-
Medium 6.5
Incorrect permissions following the deletion of a user role or deactivation of a user
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account.