Archive
November 2020
Vulnerabilities first published in this month (UTC), newest first.
31 results · Clear filters · Feed
-
Low 2.6
In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can ac…
-
Low 3.7
IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could a…
-
Low —
datasette-graphql leaks details of the schema of private database files
### Impact When running against a Datasette instance with private databases, `datasette-graphql` would expose the schema of those database tables - but not the table contents. ### Patches Patched in version 1.2. ### Workarounds This issue is only present if a…
-
Low 3.7
XML External Entity in Dashboard Widget
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possibl…
-
Low 2.8
Stored XSS by authenticated backend user with access to upload files
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upload SVG files without any sanitization …
-
Low 3.1
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all referen…
-
Low 3.1
CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab insta…
-
Low 3.7
Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to p…
-
Low 2.5
Gitaly Insufficient Session Expiration vulnerability
When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.
-
Low —
Persistent XSS in newsletter module in Shopware
### Impact Persistent XSS in newsletter module ### Patches We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Pl…
-
Low —
Persistent XSS in shopping worlds
### Impact Persistent XSS in shopping worlds ### Patches We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plug…
-
Low —
Persistent XSS in customer module in Shopware
### Impact Persistent XSS in customer module ### Patches We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plug…
-
Low 3.3
PAN-OS: System proxy passwords may be logged in clear text while viewing system state
An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This issue impacts: PAN-OS 8…
-
Low 3.5
Information exposure in touchbase.ai
toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain its geolocation, device, and software version data etc (if present. The issue is fixed in version 2.0.
-
Low 2.4
In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration chan…
-
Low 3.3
Microsoft Word Security Feature Bypass Vulnerability
Microsoft Word Security Feature Bypass Vulnerability
-
Low 2.8
accountsservice .pam_environment infinite loop
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to…
-
Low 3.3CVE-2020-16126 Public exploit
accountsservice drops ruid, allows unprivileged users to send it signals
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a…
-
Low 2.7
Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API w…
-
Low 3.7
Document root path disclosure on Maintenance page
When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and earlier) are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able t…
-
Low 2.7
Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized ch…
-
Low 3.3
PackageKit error messages leak presence and mimetype of files to unprivileged users
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
-
Low 2.8
Acrobat Reader DC for macOS Signature Validation Bypass
Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been impleme…
-
Low 3.3
Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Information Disclosure
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interact…
-
Low 3.3
Acrobat Pro DC Out-Of-Bounds Read Vulnerability Could Lead to Information Disclosure
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulne…
-
Low 3.3
Acrobat Reader DC Codec Input Validation Vulnerability Could Lead to Information Disclosure
Acrobat Reader versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an input validation vulnerability when decoding a crafted codec that could result in the disclosure of sensitive memory. An att…
-
Low 3.3
Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulne…
-
Low 3.2
IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force I…
-
Low 3.3
Password stored in plain text by Jenkins VMware Lab Manager Slaves Plugin
Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Low 3.3
Password stored in plain text by Jenkins AppSpider Plugin
Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
-
Low 3.5
IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 applications can be installed on a deprecated operating syst…