Archive
27 November 2020
Vulnerabilities first published on this day (UTC), newest first.
33 results · Feed
-
High 8.1
Prototype Pollution leading to Command Injection in systeminformation
npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you…
-
High 7.8
blosc2 heap-based buffer overflow
blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data.
-
Unscored —
An issue was discovered in Devid Espenschied PC Analyser through 4.10. The PCADRVX64.SYS kernel driver exposes IOCTL fu…
-
Unscored —
An issue was discovered in Devid Espenschied PC Analyser through 4.10. The PCADRVX64.SYS kernel driver exposes IOCTL fu…
-
Unscored —
A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a spec…
-
Unscored —
An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-202…
-
Medium 6.5
Missing Authorization in Crafter CMS
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
-
Critical 9.8
Path Traversal in Crafter CMS Crafter Studio
In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.
-
Medium —
Cross site scripting in Crafter CMS
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.
-
High 8.6
XML injection in Crafter CMS
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
-
High 7.5
Path Traversal in Crafter CMS Crafter Studio
Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.
-
High 8.6
XML Injection in Crafter CMS Crafter Studio 3.0.1
Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
-
Medium 6.1
Cross-site scripting in Crafter CMS Crafter Studio
Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.
-
Unscored —
A stack-based buffer overflow in fbwifi_continue.cgi on Zyxel UTM and VPN series of gateways running firmware version V…
-
Unscored —
Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X…
-
Unscored —
Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin.
-
Medium 6.3
Cross-site Request Forgery (CSRF)
This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints …
-
Unscored —
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to historical …
-
Unscored —
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to sensitive i…
-
Unscored —
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An EnMon PHP script was vulnerable to SQL…
-
Unscored —
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (usi…
-
Unscored —
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Some web scripts in the web interface all…
-
Unscored —
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get information from the …
-
Unscored —
Incorrect Access Control in the configuration backup path in SAGEMCOM F@ST3486 NET DOCSIS 3.0, software NET_4.109.0, al…
-
Unscored —
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. The AprolLoader could be used to inject a…
-
Unscored —
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. PVs could be changed (unencrypted) by usi…
-
Unscored —
CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism…
-
Unscored —
In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS vi…
-
Unscored —
In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a web base module in BSCS iX that is vulnerable to stored XSS …
-
Unscored —
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).
-
Unscored —
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
-
Unscored —
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).
-
Unscored —
jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded personal signature, as demonstrated by a .jpg.html filenam…