Archive
3 December 2020
Vulnerabilities first published on this day (UTC), newest first.
55 results · Feed
-
Medium 6.1
EC-CUBE Improper Restriction of Rendered UI Layers or Frames
Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. If a user accesses a specially crafted page while logged into the administrative page, unintended operations may be conducted.
-
Unscored —
Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary sc…
-
Unscored —
Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary scrip…
-
Unscored —
Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's N…
-
Unscored —
GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified ve…
-
High 7.7
Authorization bypass in Pimcore
Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions.
-
Unscored —
WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outsi…
-
Unscored —
In `GammaImage()` of /MagickCore/enhance.c, depending on the `gamma` value, it's possible to trigger a divide-by-zero c…
-
Unscored —
A flaw was found in ImageMagick in MagickCore/resize.c. An attacker who submits a crafted file that is processed by Ima…
-
Unscored —
In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cas…
-
Unscored —
A flaw was found in ImageMagick in coders/hdr.c. An attacker who submits a crafted file that is processed by ImageMagic…
-
Unscored —
In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() where a size_t cast should have been a s…
-
Medium 6.5
Improper Access Control in infinispan-server-runtime
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without th…
-
Unscored —
A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This fi…
-
Medium 4.3
A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to …