Archive
11 November 2020
Vulnerabilities first published on this day (UTC), newest first.
131 results · Feed
-
Unscored —
NVIDIA GeForce NOW application software on Windows, all versions prior to 2.0.25.119, contains a vulnerability in its o…
-
High 8.0
Stored Cross Site Scripting in touchbase.ai
touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpag…
-
Low 3.5
Information exposure in touchbase.ai
toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain its geolocation, device, and software version data etc (if present. The issue is fixed in version 2.0.
-
Medium 4.7
Open Redirect in touchbase.ai
touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attack…
-
High 8.0CVE-2020-26218 Public exploit
HTML Injection in touchbase.ai
touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0.
-
Medium 6.7
Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configu…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook mo…
-
Low 2.4
In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration chan…
-
High 8.6
Scheduler for TAS can transmit privileged UAA token in plaintext
Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server which is used to cache a UAA client token used by the servi…
-
High 8.7
malicious SVG attachment causing stored XSS vulnerability in MoinMoin
MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki…
-
Unscored —
Solstice-Pod up to 5.0.2 WEBRTC server mishandles the format-string specifiers %x; %p; %c and %s in the screen_key, dis…
-
Unscored —
On Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7 MMI Multiplayer with version (N+R_CN_AU_P0395) mishandles …
-
High 8.0
A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to t…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
All versions of package express-validators are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-crafted invalid urls.
-
High 7.5
Prototype Pollution
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.
-
High 7.2
Server-Side Request Forgery (SSRF) in MVISION Endpoint ePO extension
Server-side request forgery vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers trigger server-side DNS requests to arbitrary domains via carefully constructed XML files loaded by an ePO administrator.
-
High 7.2
Server-Side Request Forgery (SSRF) in MVISION Endpoint ePO extension
External entity attack vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers to gain control of a resource or trigger arbitrary code execution via improper input validation of an HTTP request, where the content f…
-
Medium 5.4
Azure DevOps Server and Team Foundation Services Spoofing Vulnerability
Azure DevOps Server and Team Foundation Services Spoofing Vulnerability
-
Medium 5.5
-
High 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
-
Medium 5.5
Windows Camera Codec Information Disclosure Vulnerability
Windows Camera Codec Information Disclosure Vulnerability
-
High 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
-
High 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
-
High 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
-
High 7.8
AV1 Video Extension Remote Code Execution Vulnerability
AV1 Video Extension Remote Code Execution Vulnerability
-
High 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
-
High 7.8
Visual Studio Code JSHint Extension Remote Code Execution Vulnerability
Visual Studio Code JSHint Extension Remote Code Execution Vulnerability
-
Medium 5.5
WebP Image Extensions Information Disclosure Vulnerability
WebP Image Extensions Information Disclosure Vulnerability
-
Medium 5.5
Visual Studio Tampering Vulnerability
Visual Studio Tampering Vulnerability
-
High 7.8
HEIF Image Extensions Remote Code Execution Vulnerability
HEIF Image Extensions Remote Code Execution Vulnerability
-
Medium 5.3
Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
-
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
-
High 7.8
Microsoft Teams Remote Code Execution Vulnerability
Microsoft Teams Remote Code Execution Vulnerability
-
High 7.8
Windows Kernel Local Elevation of Privilege Vulnerability
Windows Kernel Local Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
High 7.8CVE-2020-17086 Public exploit
Raw Image Extension Remote Code Execution Vulnerability
Raw Image Extension Remote Code Execution Vulnerability
-
High 8.5
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
-
Medium 6.2
Microsoft Exchange Server Denial of Service Vulnerability
Microsoft Exchange Server Denial of Service Vulnerability
-
Medium 5.5CVE-2020-17083 EPSS 12%
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
-
High 7.8
Raw Image Extension Remote Code Execution Vulnerability
Raw Image Extension Remote Code Execution Vulnerability
-
Medium 5.5
Microsoft Raw Image Extension Information Disclosure Vulnerability
Microsoft Raw Image Extension Information Disclosure Vulnerability