Archive
November 2020
Vulnerabilities first published in this month (UTC), newest first.
1,262 results · Feed
-
Unscored —
Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.
-
Unscored —
Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-mi…
-
Unscored —
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…
-
Unscored —
In versions 16.0.0-16.0.0.1 and 15.1.0-15.1.1, on specific BIG-IP platforms, attackers may be able to obtain TCP sequen…
-
Unscored —
A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T300 (with firmware 2.7 and old…
-
High 7.5
Privilage Escalation in moodle
In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported ver…
-
High 7.6
The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malic…
-
High 8.2
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request co…
-
High 7.5
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LF…
-
Unscored —
A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash. A remo…
-
Unscored —CVE-2020-12593 Public exploit
Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a…
-
High 8.1
Secret disclosure in semantic-release
In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters …
-
Unscored —
A cross-site scripting (XSS) vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 all…
-
Medium 4.4
Open redirect in Jupyter Notebook
Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted link…
-
Unscored —
Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specifi…
-
Unscored —
SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerab…
-
Unscored —
SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.
-
Unscored —
SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Lea…
-
Unscored —
Cross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting th…
-
Unscored —CVE-2020-28581 EPSS 45%
A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 cou…
-
Unscored —CVE-2020-28579 EPSS 51%
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote at…
-
Unscored —CVE-2020-28580 EPSS 45%
A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could …
-
Unscored —CVE-2020-28578 EPSS 73%
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote …
-
Unscored —
A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Securi…
-
Unscored —
A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall th…
-
Unscored —
Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placi…
-
Unscored —
Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placi…
-
Unscored —
Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placi…
-
Unscored —
The firmware of the PLANET Technology Corp NVR-915 and NVR-1615 before 2020-10-28 embeds default credentials for root a…
-
Critical 9.4
Cisco DNA Spaces Connector Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco DNA Spaces Connector could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient validation of user-supplied input…
-
Critical 9.8
Cisco IoT Field Network Director Unauthenticated REST API Vulnerability
A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to access the back-end database of an affected system. The vulnerability exists because the affected software does not properly authentic…
-
Medium 6.5
Cisco Expressway Software Unauthorized Access Information Disclosure Vulnerability
A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allow an unauthenticated, remote attacker to bypass security controls and send network traffic to restricted destinations. The vulnerability is…
-
Medium 6.5
Cisco Webex Meetings and Cisco Webex Meetings Server Unauthorized Audio Information Exposure Vulnerability
A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to maintain bidirectional audio despite being expelled from an active Webex session. The vulnerability is due to a synchronization issue be…
-
Critical 9.8
Cisco Integrated Management Controller Multiple Remote Code Execution Vulnerabilities
Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerabilities are due to improper boundary checks for certain u…
-
Medium 5.3
Cisco Webex Meetings and Cisco Webex Meetings Server Information Disclosure Vulnerability
A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to view sensitive information from the meeting room lobby. This vulnerability is due to insufficient protection of sensitive participant in…
-
Medium 6.5
Cisco Webex Meetings and Cisco Webex Meetings Server Ghost Join Vulnerability
A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appearing on the participant list. This vulnerability is due to improper handling of authentication tokens …
-
High 7.5
Cisco IoT Field Network Director Missing API Authentication Vulnerability
A vulnerability in the API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not properly authenticate API…
-
Medium 5.3
Cisco Secure Web Appliance Privilege Escalation Vulnerability
A vulnerability in the log subscription subsystem of Cisco AsyncOS for the Cisco Secure Web Appliance (formerly Web Security Appliance) could allow an authenticated, local attacker to perform command injection and elevate privileges to root. This vulnerabilit…
-
Medium 6.1
Cisco Webex Meetings API Cross-Site Scripting Vulnerability
A vulnerability in an API of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of user-supplied input to an application programmatic interface (API) wi…
-
Medium 6.1
Cisco IoT Field Network Director Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web UI of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against users on an affected system. The vulnerabilities are due to insufficient val…