Archive
16 November 2020
Vulnerabilities first published on this day (UTC), newest first.
77 results · Feed
-
Unscored —
In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.
-
Unscored —
JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.
-
Unscored —
In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.
-
Unscored —
In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there …
-
Unscored —
JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler.
-
Unscored —
JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler.
-
Unscored —
JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.
-
Unscored —
In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.
-
Unscored —
JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.
-
Unscored —
In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure…
-
Unscored —
Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via applicat…
-
Unscored —
Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees th…
-
Unscored —
In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.
-
Medium 6.5
Cross-site Scripting (XSS)
This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); con…
-
Medium 5.6
Prototype Pollution
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
-
Medium 4.8
Robustness weakness in AWS KMS and Encryption SDKs
A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to…
-
Unscored —
Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrar…
-
Unscored —
Stored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject a…
-
Unscored —
SQL injection vulnerability in the XooNIps 3.49 and earlier allows remote authenticated attackers to execute arbitrary …
-
Unscored —
Reflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to injec…
-
Unscored —
The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically p…
-
High 8.8
The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_fil…
-
Medium 6.4
The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard …
-
Unscored —
Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to…
-
Unscored —
In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it e…
-
High 7.2
If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issu…
-
High 7.2
If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issu…
-
Unscored —
Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from …
-
Unscored —CVE-2020-25695 EPSS 46%
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before …
-
Unscored —
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before …
-
Unscored —
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace th…
-
Unscored —
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace th…
-
Unscored —
An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versio…
-
Unscored —
An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009,…
-
Unscored —
Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.…
-
Unscored —
Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.…
-
Unscored —CVE-2020-8271 EPSS 11%
Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and …