Archive
17 November 2020
Vulnerabilities first published on this day (UTC), newest first.
59 results · Feed
-
High 7.3CVE-2020-7774 EPSS 70%
Prototype Pollution
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
-
Critical 9.1CVE-2020-27130 EPSS 66%
Cisco Security Manager Path Traversal Vulnerability
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within requests to an affected device…
-
High 8.1CVE-2020-27131 EPSS 92%
Cisco Security Manager Java Deserialization Vulnerabilities
Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. These vulnerabilities are due to insecure deserialization…
-
High 7.4
Cisco Security Manager Static Credential Vulnerability
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker co…
-
Unscored —
BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which all…
-
Unscored —CVE-2020-15349 Public exploit
BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool …
-
Medium 4.8
Cross-site Scripting in keycloak
A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.
-
Unscored —
Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7.…
-
Unscored —CVE-2020-25705 Public exploit
A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an of…
-
Unscored —
Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability co…
-
Unscored —CVE-2020-11851 Public exploit
Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. Th…
-
Unscored —
Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vu…
-
Unscored —
Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability cou…
-
Medium 4.3
A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name ch…
-
Low 3.7
Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to p…
-
Low 2.5
Gitaly Insufficient Session Expiration vulnerability
When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.
-
Medium 4.7
A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access …
-
Medium 5.3
Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This in…
-
High 8.1
Improper privilege management in Keycloak
It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.