Skip to content
OpenAdvisories

Archive

24 November 2020

Vulnerabilities first published on this day (UTC), newest first.

← October 2020 2020 / November /24 December 2020 →
  1. 18
  2. 253
  3. 354
  4. 440
  5. 560
  6. 674
  7. 73
  8. 88
  9. 942
  10. 1059
  11. 11131
  12. 12159
  13. 1337
  14. 14 
  15. 158
  16. 1677
  17. 1759
  18. 1864
  19. 1962
  20. 2017
  21. 218
  22. 22 
  23. 2357
  24. 2460
  25. 2512
  26. 2619
  27. 2733
  28. 289
  29. 299
  30. 3040
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical —
    GHSA-mjcr-rqjg-rhg3

    Implementation trusts the "me" field returned by the authorization server without verifying it

    ### Impact A malicious user can sign in as a user with any IndieAuth identifier. This is because the implementation does not verify that the final `"me"` URL value returned by the authorization server belongs to the same domain as the initial value entered by…

    datasette-indieauth PyPI
  • Critical 9.8
    CVE-2020-13942 Public exploit Scanner template EPSS 69%

    Remote Code Execution in Apache Unomi

    It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly…

    Apache Software Foundation Apache Unomi org.apache.unomi:unomi Maven
  • Critical 9.1
    CVE-2020-7378 Public exploit

    CRIXP OpenCRX Unverified Password Change

    CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen va…

    CRIXP OpenCRX
  • Critical 9.8
    CVE-2020-28991

    Improper Access Control in Gitea

    Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go.

    github.com/go-gitea/gitea Go