Archive
12 November 2020
Vulnerabilities first published on this day (UTC), newest first.
159 results · Feed
-
Medium 6.1
Reflected Cross-Site Scripting (XSS) in Adobe Connect
Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the con…
-
Medium 6.1
Reflected Cross-Site Scripting (XSS) in Adobe Connect
Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the con…
-
Unscored —
FusionCompute versions 8.0.0 have an insecure encryption algorithm vulnerability. Attackers with high permissions can e…
-
High 7.5
Timing attacks in python-rsa
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
-
Unscored —CVE-2020-27481 Scanner template
An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_n…
-
Medium 6.1CVE-2020-13954 EPSS 41%
Apache CXF Reflected XSS in the services listing page via the styleSheetPath
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject ja…
-
Medium 6.5
Prototype Pollution
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
-
Unscored —
u'When a non standard SIP sigcomp message is received from the network, then there may be chances of using more UDVM cy…
-
Unscored —
u'Incorrect validation of ring context fetched from host memory can lead to memory overflow' in Snapdragon Compute, Sna…
-
Unscored —
Out of Bound issue in DSP services while processing received arguments due to improper validation of length received as…
-
Unscored —
Buffer overflow in LibFastCV library due to improper size checks with respect to buffer length' in Snapdragon Auto, Sna…
-
Unscored —
Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821,…
-
Unscored —
u'Possible integer overflow to heap overflow while processing command due to lack of check of packet length received' i…
-
Unscored —
Possible buffer overflow in Fastrpc while handling received parameters due to lack of validation on input parameters' i…
-
Unscored —
Arbitrary access to DSP memory due to improper check in loaded library for data received from CPU side' in Snapdragon A…
-
Unscored —
Buffer overflow/underflow occurs when typecasting the buffer passed by CPU internally in the library which is not align…
-
Unscored —
u'Integer overflow to buffer overflow occurs while playback of ASF clip having unexpected number of codec entries' in S…
-
Unscored —
u'Buffer over read can happen while parsing mkv clip due to improper typecasting of data returned from atomsize' in Sna…
-
Unscored —
u'Null-pointer dereference can occur while accessing data buffer beyond its size that leads to access the buffer beyond…
-
Unscored —
u'Possible buffer overflow will occur in video while parsing mp4 clip with crafted esds atom size.' in Snapdragon Auto,…
-
Unscored —
u'Use after free issue in Bluetooth transport driver when a method in the object is accessed after the object has been …
-
Unscored —
u'Possible buffer overflow in WMA message processing due to integer overflow occurs when processing command received fr…
-
Unscored —
u'Buffer over read in boot due to size check ignored before copying GUID attribute from request to response' in Snapdra…
-
Unscored —
u'Integer overflow can cause a buffer overflow due to lack of table length check in the extensible boot Loader during t…
-
Unscored —
u'Possible buffer overflow in WIFI hal process due to copying data without checking the buffer length' in Snapdragon Au…
-
Unscored —
u'information disclosure in gatekeeper trustzone implementation as the throttling mechanism to prevent brute force atte…
-
Unscored —
u'Possible buffer overflow in WIFI hal process due to usage of memcpy without checking length of destination buffer' in…
-
Medium 4.8
Cross-site Scripting (XSS) in firewall ePO extension of McAfee Endpoint Security (ENS)
Cross site scripting vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows administrators to inject arbitrary web script or HTML via the configuration wizard.
-
High 7.0
Cross-Site Request Forgery (CSRF) in firewall ePO extension of McAfee Endpoint Security (ENS)
Cross Site Request Forgery vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows an attacker to execute arbitrary HTML code due to incorrect security configuration.
-
High 7.8
Unquoted service executable path in McAfee Endpoint Security (ENS)
Unquoted service executable path in McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files.
-
High 8.6
Command Injection
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
-
High 8.6
Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers Slow Path Forwarding Denial of Service Vulnerability
A vulnerability in the ingress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The v…
-
High 8.2
PAN-OS: Authentication bypass vulnerability in GlobalProtect SSL VPN client certificate verification
An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenti…
-
Low 3.3
PAN-OS: System proxy passwords may be logged in clear text while viewing system state
An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This issue impacts: PAN-OS 8…
-
High 7.5
PAN-OS: Panorama session disclosure during context switch into managed device
An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device…
-
High 7.2
PAN-OS: OS command injection and memory corruption vulnerability
An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system processes and potentially execute arbitrary code and OS commands with root privileges. This issue imp…
-
Medium 5.3
PAN-OS: Threat signatures are evaded by specifically crafted packets
A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packet…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of er…
-
High 7.5CVE-2019-17566 EPSS 11%
Server-side request forgery (SSRF) in Apache Batik
Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary…