Archive
November 2020
Vulnerabilities first published in this month (UTC), newest first.
232 results · Clear filters · Feed
-
Medium 4.8
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross…
-
Medium 5.4
IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to emb…
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authent…
-
Medium 6.5
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 stores potentially sen…
-
Medium 4.3
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on auth…
-
Medium 6.3
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 is vulnerable to SQL injection. A remote …
-
Medium 6.3
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to SQL i…
-
Medium 5.3
IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain s…
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote a…
-
Medium 6.5
IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 stores potentially hig…
-
Medium 6.5
Cross-site Scripting (XSS)
This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); con…
-
Medium 5.6
Prototype Pollution
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
-
Medium 4.8
Robustness weakness in AWS KMS and Encryption SDKs
A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to…
-
Medium 6.4
The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard …
-
Medium 4.0
IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by …
-
Medium 6.1
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use…
-
Medium 6.5
Avaya WebLM Improper Restriction of XML External Entity Reference
An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7…
-
Medium 6.3
Avaya Equinox Conferencing XSS
A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authenticated user to perform XSS attacks. The affected versions of Equinox Conferencing includes all 9.x versions before 9.1.…
-
Medium 6.1
Improper Neutralization of Input During Web Page Generation in CKEditor4
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.
-
Medium 5.3
Argument injection in lettre
The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.
-
Medium 5.5
Improper Access Control in Adobe Acrobat Reader for Android
Adobe Acrobat Reader for Android version 20.6.2 (and earlier) does not properly restrict access to directories created by the application. This could result in disclosure of sensitive information stored in databases used by the application. Exploitation requi…
-
Medium 6.1
Reflected Cross-Site Scripting (XSS) in Adobe Connect
Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the con…
-
Medium 6.1
Reflected Cross-Site Scripting (XSS) in Adobe Connect
Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the con…
-
Medium 6.1CVE-2020-13954 EPSS 41%
Apache CXF Reflected XSS in the services listing page via the styleSheetPath
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject ja…
-
Medium 6.5
Prototype Pollution
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
-
Medium 4.8
Cross-site Scripting (XSS) in firewall ePO extension of McAfee Endpoint Security (ENS)
Cross site scripting vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows administrators to inject arbitrary web script or HTML via the configuration wizard.
-
Medium 5.3
PAN-OS: Threat signatures are evaded by specifically crafted packets
A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packet…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of er…
-
Medium 4.7
Open Redirect in touchbase.ai
touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attack…
-
Medium 6.7
Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configu…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook mo…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
All versions of package express-validators are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-crafted invalid urls.
-
Medium 5.4
Azure DevOps Server and Team Foundation Services Spoofing Vulnerability
Azure DevOps Server and Team Foundation Services Spoofing Vulnerability
-
Medium 5.5
-
Medium 5.5
Windows Camera Codec Information Disclosure Vulnerability
Windows Camera Codec Information Disclosure Vulnerability
-
Medium 5.5
WebP Image Extensions Information Disclosure Vulnerability
WebP Image Extensions Information Disclosure Vulnerability
-
Medium 5.5
Visual Studio Tampering Vulnerability
Visual Studio Tampering Vulnerability
-
Medium 5.3
Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
-
Medium 6.2
Microsoft Exchange Server Denial of Service Vulnerability
Microsoft Exchange Server Denial of Service Vulnerability
-
Medium 5.5CVE-2020-17083 EPSS 12%
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability