Archive
16 November 2020
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
High 8.7
Reflected XSS in PrestaShop Product Comments
In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2.0
-
High 7.5
Improper Access Control in PrestaShop
In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.
-
High 8.0
Remote Code Execution in XStream
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XS…
-
Unscored —
Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
-
Unscored —
Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow. The component is: ConnectIQ TVM. The attack vector …
-
Unscored —
Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
-
Unscored —
Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow. The component is: ConnectIQ TVM. The attack vector i…
-
Unscored —
An unrestricted file upload issue in HorizontCMS 1.0.0-beta allows an authenticated remote attacker to upload PHP code …
-
Unscored —
Airleader Master <= 6.21 devices have default credentials that can be used to access the exposed Tomcat Manager for dep…
-
Unscored —
Airleader Master and Easy <= 6.21 devices have default credentials that can be used for a denial of service.
-
Unscored —
The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials …
-
Unscored —
In Gila CMS 1.16.0, an attacker can upload a shell to tmp directy and abuse .htaccess through the logs function for exe…
-
High 8.8CVE-2020-23489 Public exploit
AVideo vulnerable to Improper Privilege Management
The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.
-
Unscored —
There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker ca…
-
Unscored —CVE-2020-27991 EPSS 34%
Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).
-
Unscored —CVE-2020-27990 EPSS 34%
Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).
-
Unscored —CVE-2020-27989 EPSS 34%
Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).
-
Unscored —CVE-2020-27988 EPSS 90%
Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).
-
Unscored —
Memory leak in IPv6Param::setAddress in CloudAvid PParam 1.3.1.
-
Medium 4.3
IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on auth…
-
High 7.5
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authent…
-
Medium 4.8
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross…
-
Medium 5.4
IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to emb…
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authent…
-
Medium 6.5
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 stores potentially sen…
-
Medium 4.3
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on auth…
-
Medium 6.3
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 is vulnerable to SQL injection. A remote …
-
Medium 6.3
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to SQL i…
-
Medium 5.3
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain s…
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote a…
-
Medium 6.5
IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 stores potentially hig…
-
Unscored —CVE-2020-27422 Public exploit
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an …
-
Unscored —CVE-2020-27423 Public exploit
Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial …
-
Unscored —
SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System With admin panel 2.1 all…
-
Unscored —
Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_spl…
-
Unscored —
LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device …
-
Unscored —
In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about …
-
Unscored —CVE-2020-27191 Scanner template
LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the in…
-
Unscored —
JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances.
-
Unscored —
In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version.