19 November 2020

12 results · Clear filters · Feed

• High 7.0
  CVE-2020-28209

  A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server install…

  Nov 19, 2020
• High 7.1
  CVE-2020-7567

  A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) tha…

  Nov 19, 2020
• High 7.1
  CVE-2020-7566

  A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could …

  Nov 19, 2020
• High 7.1
  CVE-2020-7565

  A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that coul…

  Nov 19, 2020
• High 7.5
  CVE-2020-28924

  Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone

  An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time th…

  rclone github.com/rclone/rclone Debian Go
  Nov 19, 2020
• High 7.8
  CVE-2020-28948 Public exploit EPSS 47%

  Multiple vulnerabilities through filename manipulation in Archive_Tar

  Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

  drupal/core drupal7 drupal7 php-pear Debian Ubuntu Alpine Packagist
  Nov 19, 2020
• High 7.8
  CVE-2020-28949 Exploited Public exploit EPSS 85%

  Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrappe…

  drupal7 drupal7 php-pear php-pear Debian Ubuntu Alpine
  Nov 19, 2020

  KEV Aug 25, 2022
• High 7.3
  CVE-2020-12510

  Beckhoff: Privilege Escalation through TwinCat System

  The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created with permissions which allow every local user to modify the content. The default …

  Beckhoff TwinCat XAR 3.1 ICS / OT
  Nov 19, 2020
• High 7.5
  CVE-2020-25698

  Improper Access Control in moodle

  Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3…

  moodle/moodle moodle Web / CMS Ubuntu Packagist
  Nov 19, 2020
• High 7.1
  CVE-2020-9049

  victor Web Client and C•CURE Web Client JSON Web Token (JWT) Vulnerability

  A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method witho…

  Johnson Controls victor Web Client version 5.6 and prior C•CURE Web Client version 2.90 and prior (Note - This does not affect the new web-based C•CURE 9000 client that was introduced in C•CURE 9000 v2.90)
  Nov 19, 2020
• High 8.4
  CVE-2020-4701

  IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a buffer overfl…

  IBM DB2 for Linux, UNIX and Windows Linux Windows
  Nov 19, 2020
• High 7.5
  CVE-2020-25699

  Privilage Escalation in moodle

  In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported ver…

  moodle/moodle moodle Web / CMS Ubuntu Packagist
  Nov 19, 2020