Archive
18 November 2020
Vulnerabilities first published on this day (UTC), newest first.
64 results · Feed
-
High 8.7
Cisco IoT Field Network Director SOAP API Authorization Bypass Vulnerability
A vulnerability in the SOAP API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to access and modify information on devices that belong to a different domain. The vulnerability is due to insufficient authorization in th…
-
Medium 5.5
Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation Vulnerability
A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient access authorization. An…
-
Unscored —
This module enables your users residing at a SAML 2.0 compliant Identity Provider to login to your Drupal website. The …
-
Medium 5.3
IBM MQ Appliance 9.1.CD and LTS could allow an authenticated user, under nondefault configuration to cause a data corru…
-
Unscored —
The File Example submodule within the Examples project does not properly sanitize certain filenames as described in [SA…
-
Unscored —
REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message.
-
High 7.2
Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1…
-
Unscored —CVE-2020-28091 Public exploit
cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords param…
-
Unscored —
Panic during division of very large numbers in math/big
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
-
Unscored —
app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files.
-
Unscored —
httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS co…
-
Unscored —
httpd on TP-Link TL-WPA4220 devices (hardware versions 2 through 4) allows remote authenticated users to trigger a buff…
-
Unscored —
RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could…
-
Medium 6.1
Open Redirect in werkzeug
Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.
-
Unscored —
Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in…
-
Medium 6.3
A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premi…
-
Medium 6.3
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Serve…
-
Medium 6.3
A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Prem…
-
Unscored —
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allo…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & …
-
Unscored —
An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It save…
-
Unscored —
A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by loca…
-
Unscored —
Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
-
Unscored —
Arbitrary code execution via the go command with cgo in cmd/go
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.