Archive
November 2020
Vulnerabilities first published in this month (UTC), newest first.
1,262 results · Feed
-
Medium 4.1
Cisco IoT Field Network Director Improper Domain Access Control Vulnerability
A vulnerability in the user management functionality of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to manage user information for users in different domains on an affected system. The vulnerability is due to improper …
-
Medium 4.1
Cisco IoT Field Network Director Unprotected Storage of Credentials Vulnerability
A vulnerability in the web UI of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to obtain hashes of user passwords on an affected device. The vulnerability is due to insufficient protection of user credentials. An attacke…
-
Medium 4.9
Cisco IoT Field Network Director File Overwrite Vulnerability
A vulnerability in the file system of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to overwrite files on an affected system. The vulnerability is due to insufficient file system protections. An attacker could exploit th…
-
Medium 5.0
Cisco IoT Field Network Director Improper Access Control Vulnerability
A vulnerability in the access control functionality of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to view lists of users from different domains that are configured on an affected system. The vulnerability is due to im…
-
Medium 5.3
Cisco IoT Field Network Director Information Disclosure Vulnerability
A vulnerability in Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive database information on an affected device. The vulnerability is due to the absence of authentication for sensitive information. An att…
-
Medium 6.3
Cisco IoT Field Network REST API Insufficient Input Validation Vulnerability
A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API reques…
-
High 8.7
Cisco IoT Field Network Director SOAP API Authorization Bypass Vulnerability
A vulnerability in the SOAP API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to access and modify information on devices that belong to a different domain. The vulnerability is due to insufficient authorization in th…
-
Medium 5.5
Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation Vulnerability
A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient access authorization. An…
-
Unscored —
This module enables your users residing at a SAML 2.0 compliant Identity Provider to login to your Drupal website. The …
-
Medium 5.3
IBM MQ Appliance 9.1.CD and LTS could allow an authenticated user, under nondefault configuration to cause a data corru…
-
Unscored —
The File Example submodule within the Examples project does not properly sanitize certain filenames as described in [SA…
-
Unscored —
REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message.
-
High 7.2
Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1…
-
Unscored —CVE-2020-28091 Public exploit
cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords param…
-
Unscored —
Panic during division of very large numbers in math/big
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
-
Unscored —
app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files.
-
Unscored —
httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS co…
-
Unscored —
httpd on TP-Link TL-WPA4220 devices (hardware versions 2 through 4) allows remote authenticated users to trigger a buff…
-
Unscored —
RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could…
-
Medium 6.1
Open Redirect in werkzeug
Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.
-
Unscored —
Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in…
-
Medium 6.3
A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premi…
-
Medium 6.3
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Serve…
-
Medium 6.3
A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Prem…
-
Unscored —
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allo…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & …
-
Unscored —
An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It save…
-
Unscored —
A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by loca…
-
Unscored —
Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
-
Unscored —
Arbitrary code execution via the go command with cgo in cmd/go
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
-
Unscored —
SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to proc…
-
Unscored —CVE-2020-28092 Public exploit
PESCMS Team 2.3.2 has multiple reflected XSS via the id parameter:?g=Team&m=Task&a=my&status=3&id=,?g=Team&m=Task&a=my&…
-
Unscored —
An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath vo…
-
Unscored —
An issue was discovered in Aviatrix Controller before R6.0.2483. Several APIs contain functions that allow arbitrary fi…
-
Unscored —
An issue was discovered in Aviatrix Controller before R6.0.2483. Multiple executable files, that implement API endpoint…
-
High 8.0
Cross-Site Scripting in TYPO3 Fluid
TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes a…
-
Unscored —
An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file.
-
Unscored —
An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated …
-
Unscored —
An issue was discovered in Aviatrix Controller before R5.4.1290. The htaccess protection mechanism to prevent requests …
-
Unscored —
An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can…