Archive
13 November 2020
Vulnerabilities first published on this day (UTC), newest first.
37 results · Feed
-
Unscored —
An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 …
-
Unscored —
ask_password in Tomb 2.0 through 2.7 returns a warning when pinentry-curses is used and $DISPLAY is non-empty, causing …
-
Unscored —
Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an …
-
Unscored —
Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user …
-
Unscored —
Improper access control in the PMC for some Intel(R) Processors may allow a privileged user to potentially enable escal…
-
Unscored —
Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken th…
-
Unscored —
lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account c…
-
High 7.5
Improper Validation of Specified Quantity in Input in Eclipse Hono
In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated duri…
-
Unscored —
Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack. The vulnerability allows a ma…
-
Unscored —
An issue was discovered in One Identity Password Manager 5.8. An attacker could enumerate valid answers for a user. It …
-
High 7.4
Deanonymization of COVID-19 positive users of Radar COVID
Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerabilit…
-
Low —
Persistent XSS in newsletter module in Shopware
### Impact Persistent XSS in newsletter module ### Patches We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Pl…
-
Low —
Persistent XSS in shopping worlds
### Impact Persistent XSS in shopping worlds ### Patches We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plug…
-
High 7.7
Authorization bypass in Spree
Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint…
-
High 8.7
Remote code execution in dependabot-core
Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability i…
-
Low —
Persistent XSS in customer module in Shopware
### Impact Persistent XSS in customer module ### Patches We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plug…
-
Unscored —
The affected product does not properly validate input, which may allow an attacker to execute a denial-of-service attac…
-
Unscored —
The affected product transmits unencrypted sensitive information, which may allow an attacker to access this informatio…
-
Unscored —CVE-2020-25557 Public exploit
In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. …
-
Unscored —CVE-2020-25538 Public exploit
An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and …
-
Unscored —
Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could …
-
Unscored —
Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could …
-
Medium 4.0
IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by …
-
Unscored —
BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The…
-
Unscored —
In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a mali…
-
Unscored —
Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CCon…
-
Unscored —
There is a denial of service vulnerability in some Huawei products. There is no protection against the attack scenario …
-
Unscored —
HUAWEI Mate 30 versions earlier than 10.1.0.159(C00E159R7P2) have a vulnerability of improper buffer operation. Due to …
-
Unscored —
Some Huawei products have a command injection vulnerability. Due to insufficient input validation, an attacker with hig…
-
High 8.8
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD …
-
High 8.8
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD …
-
High 8.8
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD …
-
High 8.8
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD …
-
High 8.8
A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD…
-
Medium 6.1
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use…
-
High 8.8
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompress…
-
Medium 6.5
Avaya WebLM Improper Restriction of XML External Entity Reference
An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7…