Archive
10 November 2020
Vulnerabilities first published on this day (UTC), newest first.
59 results · Feed
-
Unscored —
Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for…
-
Unscored —
An XSS issue exists in the question-pool file-upload preview feature in ILIAS 6.4.
-
Unscored —
Incorrect file permissions in BlueStacks 4 through 4.230 on Windows allow a local attacker to escalate privileges by mo…
-
Unscored —
The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.
-
Unscored —
The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g., a button) when events such as …
-
Unscored —
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.
-
High 8.8CVE-2019-7357 Public exploit
Subrion CMS CSRF Vulnerability
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.
-
Unscored —CVE-2020-23968 Public exploit
Ilex International Sign&go Workstation Security Suite 7.1 allows elevation of privileges via a symlink attack on Progra…
-
Unscored —
Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the gu…
-
Unscored —
A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by T…
-
Medium 5.0
TIBCO iProcess Workspace Browser CSRF
The Core component of TIBCO Software Inc.'s TIBCO iProcess Workspace (Browser) contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a Cross Site Request Forgery (CSRF) attack on the affected system. A s…
-
Unscored —
A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by T…
-
High 8.8
MoinMoin vulnerable to remote code execution via cache action
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
-
Medium 4.4
SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its i…
-
High 7.5
SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to…
-
Critical 10.0
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because …
-
Critical 10.0
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because …
-
Medium 6.5
SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated use…
-
Critical 10.0
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because …
-
Medium 4.3
SAP 3D Visual Enterprise Viewer, version - 9, allows an user to open manipulated HPGL file received from untrusted sour…
-
Critical 10.0
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because …
-
Medium 4.9
SAP Process Integration (PGP Module - Business-to-Business Add On), version - 1.0, allows an attacker to read PGP Keys …
-
Critical 9.1
SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administr…
-
Medium 5.4
SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated use…
-
High 8.6
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to sen…
-
Critical 9.1
SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 …
-
Medium 5.3
SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to…
-
Medium 4.3
SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization i…
-
Medium 5.3
SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission …
-
High 7.5
Prototype pollution in @strikeentco/set
Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
-
High 7.3
Prototype Pollution
This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target obj…
-
Medium 5.5
The frame touch module does not make validity judgments on parameter lengths when processing specific parameters,which …
-
Medium 6.4
IBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbi…
-
Medium 5.4
IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…
-
Medium 6.3
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read b…
-
Medium 6.9
Dell Inspiron 15 7579 2-in-1 BIOS versions prior to 1.31.0 contain an Improper SMM communication buffer verification vu…
-
Unscored —
A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution…
-
Unscored —
There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: …
-
Unscored —
There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: …
-
Unscored —
There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: …