Archive
17 November 2020
Vulnerabilities first published on this day (UTC), newest first.
59 results · Feed
-
Unscored —
SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to proc…
-
Unscored —CVE-2020-28092 Public exploit
PESCMS Team 2.3.2 has multiple reflected XSS via the id parameter:?g=Team&m=Task&a=my&status=3&id=,?g=Team&m=Task&a=my&…
-
Unscored —
An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath vo…
-
Unscored —
An issue was discovered in Aviatrix Controller before R6.0.2483. Several APIs contain functions that allow arbitrary fi…
-
Unscored —
An issue was discovered in Aviatrix Controller before R6.0.2483. Multiple executable files, that implement API endpoint…
-
High 8.0
Cross-Site Scripting in TYPO3 Fluid
TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes a…
-
Unscored —
An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file.
-
Unscored —
An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated …
-
Unscored —
An issue was discovered in Aviatrix Controller before R5.4.1290. The htaccess protection mechanism to prevent requests …
-
Unscored —
An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can…
-
Unscored —
An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows th…
-
Unscored —
Stored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and …
-
Unscored —
The web application of Kyocera printer (ECOSYS M2640IDW) is affected by Stored XSS vulnerability, discovered in the add…
-
Unscored —CVE-2020-25988 Public exploit
UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H) has an action 'X_GetAccess' w…
-
Unscored —
An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remot…
-
Unscored —
An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. There was authentication…
-
Unscored —
SourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image upload feature of Produc…
-
Unscored —
SourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail f…
-
Unscored —
SourceCodester Online Clothing Store 1.0 is affected by a SQL Injection via the txtUserName parameter to login.php.
-
High 7.1
Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to s…
-
Medium 4.3
An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a …
-
Medium 5.7
An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could…
-
Unscored —
Cross domain policies in Taskcafe Project Management tool before version 0.1.0 and 0.1.1 allows remote attackers to acc…
-
Low 3.1
CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab insta…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Dashboards section in Kaa IoT Platform v1.2.0 allows remote attackers to in…
-
Medium 6.5
Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable name…
-
Unscored —CVE-2020-13958 Public exploit
A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks p…
-
Unscored —
In fastadmin V1.0.0.20191212_beta, when a user with administrator rights has logged in, a malicious parameter can be pa…
-
Unscored —
In BASETech GE-131 BT-1837836 firmware 20180921, the web-server on the system is configured with the option “DocumentRo…
-
Unscored —
Cleartext Transmission of Sensitive Information vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 exists wh…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users …
-
Unscored —
Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attacker…
-
Unscored —
A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to conn…
-
Unscored —
Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows local users to …
-
Unscored —
Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video s…
-
Unscored —
QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obt…
-
Unscored —
The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to up…
-
Unscored —
The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upl…
-
Unscored —CVE-2020-28647 Public exploit
In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If …
-
High 8.8
TOBESOFT XPLATFORM arbitrary hta file execution vulnerability
Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string is begun with http://, https://, mailto://